4 Red Rock Compliance Checkpoints for Your Monthly Review (with a Sedona Sunset Prompt)

Introduction: Why Your Monthly Compliance Review Needs a New Lens

If your monthly compliance review feels like a chore you rush through in 15 minutes, you are not alone. Many teams treat it as a checklist of boxes: confirm policies are signed, verify access logs are clean, file the report, move on. But this approach often misses the real risks—the subtle drift in user permissions, the forgotten vendor contract, the training that expired two weeks ago. The problem is not that compliance is unimportant; it is that the process becomes rote, and rote processes breed blind spots.

This guide introduces a framework built around four 'Red Rock' checkpoints—named after the iconic, stable landmarks of Sedona. Just as red rocks stand firm against erosion, these checkpoints provide a durable foundation for your monthly review. They are designed for busy readers who need practical, actionable steps without fluff. You will find specific questions to ask, common mistakes to avoid, and a step-by-step walkthrough for each checkpoint. We also include a reflective exercise called the 'Sedona Sunset Prompt'—a 10-minute mental reset that helps you see your compliance posture from a different angle.

As of May 2026, this guide reflects widely shared professional practices. Compliance requirements vary by industry and jurisdiction, so verify critical details against current official guidance where applicable. This information is for general educational purposes only and does not constitute legal advice. Consult a qualified professional for decisions specific to your organization.

Let us begin by understanding why these four checkpoints matter more than a generic list of tasks.

Checkpoint 1: Policies & Training Currency

Policies and training are the bedrock of any compliance program, but they are often the most neglected during monthly reviews. Too many teams assume that once a policy is written and training is completed, the work is done. In reality, regulations change, staff turnover happens, and even well-intentioned employees can overlook updates. This first checkpoint focuses on verifying that your policies are current, accessible, and understood by everyone who needs them.

Why Policies Drift (and How to Catch It)

Policies drift for several reasons. A new regulation might require a change in data retention periods, but the policy document remains unchanged. A key employee leaves, and no one updates the training materials to reflect new procedures. Over time, the gap between what is written and what is practiced widens. Teams often find that a monthly review that only checks the date of the last policy revision is insufficient. You need to compare the policy against current operational reality: Are people following it? Are there exceptions that should be documented?

Step-by-Step: Monthly Policy Check

Start by listing all active policies and their last review dates. For each policy, ask three questions: (1) Has the underlying regulation changed since this policy was last updated? (2) Are there any recent incidents or audit findings that suggest the policy needs clarification? (3) Have there been organizational changes (new teams, new tools) that the policy does not cover? Next, confirm that every employee has acknowledged the most current version. Many teams use a learning management system (LMS) to track this, but manual checks are still valuable for smaller organizations. Finally, schedule a brief 15-minute review meeting with team leads to discuss any ambiguities they have noticed.

Training: More Than a Completion Certificate

Training completion rates can be misleading. A 100% completion rate does not guarantee understanding or retention. One effective practice is to include a short quiz or scenario-based question in each training module, and then review aggregate scores during your monthly check. If a significant portion of the team misses a particular question, it signals that the material needs clarification. Also, watch for employees who completed training but have not applied the knowledge in practice—for example, a team member who passed data privacy training but still shares sensitive files via unsecured channels. Monthly reviews should include a quick audit of real-world behavior, not just certificates.

Composite Scenario: The Policy Gap That Almost Cost a Contract

Consider a mid-sized software company that updated its data retention policy after a new client contract required stricter controls. The policy was revised and approved by legal, but the monthly review process only checked the policy date. Three months later, an internal audit revealed that two departments were still following the old retention schedule because they had not been notified of the change. The client contract was nearly jeopardized. A more thorough monthly check—one that included a cross-reference between policy updates and department-level workflows—would have caught this gap early.

Common Pitfalls and How to Avoid Them

One common mistake is treating policy reviews as a solo activity. When only the compliance officer reviews policies, blind spots persist. Involve at least one person from the operational team who lives with the policy daily. Another pitfall is failing to track policy exceptions. If you allow exceptions (e.g., a temporary deviation for a project), document them clearly and set a reminder to revisit them monthly. Without this, exceptions become permanent loopholes.

This checkpoint may seem basic, but its consistent application prevents the most common compliance failures. Next, we move to access controls—a checkpoint where small oversights can lead to major breaches.

Checkpoint 2: Access Controls & Permissions Hygiene

Access controls are the gatekeepers of your sensitive data. Yet, in many organizations, permissions accumulate like dust. Employees change roles, contractors come and go, and former employees sometimes retain access longer than they should. A monthly review of access controls is not just about checking who has a login—it is about ensuring that each person has the minimum access needed to do their job, and nothing more. This checkpoint is particularly critical for organizations subject to regulations like GDPR, HIPAA, or SOC 2, where excessive access is a common audit finding.

The Principle of Least Privilege: A Practical Definition

The principle of least privilege means that a user should have only the permissions necessary to perform their assigned tasks. It sounds simple, but applying it consistently across dozens or hundreds of systems is challenging. Teams often find that a user who started in one role and later moved to another retains permissions from both roles. Over time, these compounding permissions create a security surface area that is difficult to manage. The monthly review should systematically compare each user's current role with their actual permissions, flagging any discrepancies.

Step-by-Step: Monthly Access Review

Begin by generating a list of all active users across your critical systems (e.g., cloud infrastructure, HR platform, financial tools). For each user, note their job function, department, and date of last role change. Then, review their permissions against a baseline defined for that role. If a user has permissions that exceed the baseline, investigate why. Common reasons include temporary project needs that were never revoked, or legacy permissions from a previous role. Next, check for inactive accounts—users who have not logged in for 30 days or more. These accounts are prime targets for attackers. Finally, confirm that terminated employees have been removed from all systems within 24 hours of departure. Many organizations have a manual offboarding process that can be inconsistent; a monthly review is your safety net.

Composite Scenario: The Ghost Account That Escaped Notice

A healthcare clinic had a part-time administrator who left the organization but was not removed from the electronic health records (EHR) system for three months. During that period, the account was compromised in a phishing attack, and the attacker accessed patient records. The breach was discovered during a routine monthly access review. The clinic's team had assumed that the HR department would automatically disable accounts, but the offboarding process was not integrated with the EHR system. After this incident, the clinic implemented a cross-check between HR termination records and system access logs every month. This scenario illustrates why access reviews cannot rely solely on automated processes—human verification of the output is essential.

Tools and Approaches: Manual vs. Automated

Small teams often rely on manual reviews using spreadsheets, which is workable for up to 50 users but becomes error-prone beyond that. Larger organizations use identity and access management (IAM) tools with automated attestation workflows. Both approaches have trade-offs. Manual reviews are cheaper and allow for context, but they are time-consuming and prone to oversight. Automated tools are efficient but can miss nuance—for example, a user who legitimately needs cross-departmental access for a project. A hybrid approach often works best: use automation to generate reports and flag anomalies, then have a human review the exceptions. During your monthly review, document any decisions made about access, especially when granting exceptions to the principle of least privilege.

Common Mistakes and How to Fix Them

One frequent mistake is reviewing access only for core systems while ignoring peripheral tools (e.g., shared drives, project management platforms, or development environments). Attackers often target less-monitored systems. Another mistake is failing to review service accounts—non-human accounts used by applications. These accounts can accumulate broad permissions that no one monitors. Include them in your monthly review, and rotate their credentials periodically. Finally, avoid the trap of 'review fatigue' where the same list of users is approved month after month without actual scrutiny. Change the review format occasionally—for example, focus on a different department each month, or use a random sampling technique to keep reviewers engaged.

Access controls are a moving target, but consistent monthly attention keeps them manageable. Next, we turn to incident response—a checkpoint that tests your organization's ability to react when things go wrong.

Checkpoint 3: Incident Response Readiness

No compliance program is complete without a tested incident response (IR) capability. Monthly reviews often neglect this area because no incident has occurred recently, creating a false sense of security. But readiness is not about whether you have a plan on paper—it is about whether your team can execute that plan under pressure. This checkpoint covers three dimensions: plan currency, team training, and simulation results. Each month, you should verify that your IR plan is still relevant, that key personnel know their roles, and that recent tabletop exercises have revealed improvements.

Why Monthly IR Checks Matter (Even When Nothing Happens)

Incident response is a muscle that atrophies without regular exercise. Teams often find that a plan created two years ago no longer reflects current technology, personnel, or threat landscape. For example, if your organization migrated to a cloud environment but the IR plan still references on-premises servers, the plan is worse than useless—it creates confusion during a real incident. Monthly reviews provide a low-stakes opportunity to spot these gaps. Additionally, personnel changes mean that the person who was the 'incident commander' last year may have left the company, and the replacement may not know the plan exists. A monthly check ensures that roles and contact information are current.

Step-by-Step: Monthly IR Readiness Check

Start by opening your incident response plan and reviewing the first three sections: scope, roles, and communication protocols. Confirm that the list of team members with their phone numbers and email addresses is accurate. Next, check that any third-party contacts (e.g., legal counsel, forensic investigators, PR firms) are still under contract and reachable. Then, review the plan's escalation paths. If your organization has added a new system or application since the last review, ensure that the plan includes steps for detecting and containing incidents in that system. Finally, schedule a 30-minute walkthrough with the IR team to discuss a hypothetical scenario (this can be done monthly or quarterly, but include a note about the next scheduled exercise in your monthly report).

Composite Scenario: The Plan That Had the Wrong Phone Number

A financial services firm experienced a ransomware attack on a Friday evening. The incident response plan listed the primary contact for the IT security lead—but that person had left the company three months earlier. The call tree had not been updated. The delay in reaching the right person extended the containment time by several hours, allowing the ransomware to spread to more systems. During the post-incident review, the team realized that their monthly compliance review had never included a check of the IR plan's contact list. After that, they added a simple step: every month, send a test message to all IR team members requesting a confirmation reply. This small practice prevents a common failure.

Tabletop Exercises: Low-Cost, High-Value

A full-scale simulation can be expensive and disruptive, but a monthly tabletop exercise does not need to be elaborate. Choose one scenario (e.g., phishing email with credential theft, data breach notification requirement, or ransomware) and spend 30 minutes walking through the response steps. Ask team members to state their actions at each stage. The goal is not to test speed but to identify gaps in knowledge or procedure. Document any issues found and assign a person to address them before the next monthly review. Over several months, these exercises build a culture of readiness without overwhelming the team.

Common Pitfalls and Practical Fixes

A common mistake is treating the IR plan as a static document. Plans should be version-controlled and updated whenever significant changes occur—new software, new regulations, or new team members. Another pitfall is failing to involve legal and communications teams in the review. In a real incident, these functions are critical for managing liability and reputation. Include them in monthly walkthroughs at least quarterly. Finally, avoid the trap of 'planning to plan'—where you identify improvements but never implement them. Use a simple tracking spreadsheet with columns for the finding, assigned owner, due date, and status. Review this tracker during each monthly compliance meeting.

Incident response readiness is not about predicting every threat; it is about having a reliable process that adapts to change. The fourth checkpoint addresses an area that many teams overlook until it is too late: third-party risk.

Checkpoint 4: Third-Party & Vendor Risk Monitoring

Your compliance posture is only as strong as your weakest vendor. Third-party breaches are increasingly common, and regulators now expect organizations to actively monitor their vendors' security practices. This checkpoint focuses on the vendors and partners who have access to your data, your systems, or your customers. A monthly review of third-party risk is not about redoing a full due diligence assessment every 30 days—it is about maintaining awareness of changes that could increase your exposure.

Why Vendors Are a Moving Target

Vendors change. They update their software, merge with other companies, change their data handling practices, or experience their own security incidents. Without regular monitoring, your organization may be relying on a vendor that no longer meets your compliance requirements. For example, a cloud storage provider might change its data residency policies, moving your data to a jurisdiction with different privacy laws. A monthly review helps you catch these changes early, before they become audit issues or breach vectors. Teams often find that the biggest risk comes from 'shadow vendors'—tools used by individual departments without IT or compliance oversight.

Step-by-Step: Monthly Vendor Risk Check

Begin by maintaining a current inventory of all third-party vendors with access to your data or systems. For each vendor, note the type of data shared, the contract end date, and the last time you reviewed their security documentation (e.g., SOC 2 report, ISO 27001 certificate). During your monthly review, check for three things: (1) Has the vendor experienced a publicized security incident since the last review? (2) Has the vendor's certification or audit report expired? (3) Has your organization started using a new tool or service that should be added to the inventory? If any red flags appear, escalate to a deeper review. Also, verify that contracts with critical vendors include clauses for breach notification and right-to-audit. Without these clauses, your legal recourse is limited.

Composite Scenario: The Free Trial That Became a Data Leak

A marketing team at a retail company signed up for a free trial of a customer analytics platform. No one informed the compliance or IT teams. The platform collected customer data, including names and purchase histories. Six months later, the vendor suffered a data breach, and the retailer's customer data was exposed. The monthly compliance review had never included a process for discovering new vendor relationships. After the incident, the company implemented a simple rule: any new vendor must be registered in a central system before gaining access to data. The monthly review then includes a cross-check between vendor registration records and accounts payable to catch unpaid trials that may be active.

Comparison Table: Vendor Monitoring Approaches

Choose an approach that fits your scale and resources. The key is consistency: whatever method you use, apply it every month.

Common Mistakes and How to Avoid Them

One frequent mistake is treating all vendors equally. Not all vendors pose the same risk. Prioritize those that handle sensitive data (e.g., PII, financial records, health information) or have direct access to your internal network. Another mistake is failing to review sub-vendors. If your vendor outsources part of its service to another company, that sub-vendor may introduce additional risk. Ask your critical vendors for a list of their sub-vendors and include them in your risk assessment. Finally, avoid the trap of 'set and forget'—where you complete a vendor assessment during onboarding and never revisit it. Monthly monitoring is about detecting changes, not repeating the initial assessment.

With these four checkpoints covered, you have a solid foundation for your monthly review. But even the best checklist can become mechanical. That is where the Sedona Sunset Prompt comes in.

The Sedona Sunset Prompt: A Reflective Exercise for Deeper Insight

After you have completed the four checkpoints, take 10 minutes for a reflective exercise we call the 'Sedona Sunset Prompt.' The name comes from the idea of stepping back from the details to see the broader landscape—just as a Sedona sunset transforms the red rocks into a breathtaking panorama. This exercise is designed to help you spot patterns and gaps that the checklist may not reveal. It is not about adding more work; it is about changing your perspective.

Why Reflection Matters in Compliance

Compliance reviews are inherently detail-oriented. You look at policies, access logs, incident reports, and vendor lists. While this granular focus is necessary, it can cause you to miss the forest for the trees. A reflective exercise forces you to zoom out and ask higher-level questions: Are we seeing the same issues month after month? Are there areas where we are over-investing while neglecting others? Are there signals of cultural drift—like employees bypassing procedures because they find them too burdensome? Teams often find that this 10-minute reflection surfaces insights that would otherwise remain hidden.

How to Run the Sedona Sunset Prompt

Find a quiet space where you will not be interrupted. Set a timer for 10 minutes. With your monthly review results in front of you, answer these three questions honestly:

1. What surprised me this month? Identify one or two findings that were unexpected, whether positive or negative. Surprises often indicate blind spots.
2. What pattern is repeating? Look for issues that have appeared in two or more of the checkpoints. For example, if both the access review and the incident response review revealed confusion about roles, that is a systemic problem worth addressing.
3. What am I avoiding? Acknowledge any area you have been reluctant to dig into—perhaps a vendor you suspect is non-compliant, or a policy you know is outdated. Write it down and commit to addressing it before the next monthly review.

Write your answers in a journal or a digital note. Do not overthink them. The goal is not perfection but awareness.

Composite Scenario: The Surprise That Changed a Process

A compliance manager in a logistics company used the Sedona Sunset Prompt after a particularly busy month. She wrote that the surprise was how many access exceptions had been granted for a single project team. The pattern was that exceptions were not being reviewed after the project ended. The avoidance was a vendor contract that had been flagged for renewal but kept getting postponed. Within two weeks, she had cleaned up the exceptions and renegotiated the vendor contract. The reflection took 10 minutes, but the impact saved months of potential risk accumulation.

When to Use This Prompt

The Sedona Sunset Prompt works best immediately after you complete the four checkpoints, before you file the review report. If you do it at the end of the month, the details are still fresh. Some teams use it as a team exercise, gathering for a brief discussion. Others use it individually. Either way, the key is to make it a consistent part of your monthly rhythm. Over time, you will build a habit of critical reflection that sharpens your judgment.

This prompt is not a replacement for the checkpoints; it is a complement. Think of it as the sunset that gives you a new view of the rocks you have been examining up close.

Comparison Table: Four Approaches to Monthly Compliance Reviews

Not every team will implement these four checkpoints in the same way. The best approach depends on your organization's size, industry, and resources. Below is a comparison of three common approaches, with their pros, cons, and use cases. Use this table to decide where your team falls—and whether you need to adjust your strategy.

Whichever approach you choose, ensure that the Sedona Sunset Prompt is included. It is lightweight and adds disproportionate value by forcing reflection. If you are unsure which approach fits, start with the Full Deep Dive for two months, then assess whether the time investment is sustainable. Many teams find that a hybrid—Full Deep Dive quarterly and Exception-Based monthly—strikes the right balance.

Frequently Asked Questions

Based on common questions from teams adopting this framework, here are answers to the most frequent concerns. If you have a question not covered here, treat it as a signal that your monthly review process may need to adapt.

How long should a monthly compliance review take?

For an organization with 50-100 employees and 20-30 vendors, a thorough review using the four checkpoints typically takes 2-3 hours per month. Adding the Sedona Sunset Prompt adds 10 minutes. If your review takes significantly longer, consider whether you are diving into unnecessary detail or if your documentation is disorganized. If it takes less than 30 minutes, you are likely skipping important steps. Aim for a sustainable pace that fits your schedule without causing burnout.

Can I automate the entire process?

Some parts of the review can be automated—for example, generating access reports from your IAM tool, or receiving alerts when a vendor's SOC 2 report expires. However, full automation is not advisable because compliance involves judgment. The Sedona Sunset Prompt, in particular, requires human reflection. Use automation to handle data collection and flagging, but keep a human in the loop for analysis and decision-making. Over-automation can lead to a false sense of security.

What if my organization has no incidents for months? Do I still need to do the IR readiness check every month?

Yes, and this is exactly when the IR readiness check is most valuable—because the risk of atrophy is highest. If you have not had an incident in a while, it is easy to assume the plan is fine. Use the monthly check to verify that contact information is current, that the plan reflects any technology changes, and that your team has not forgotten their roles. A 30-minute check once a month is a small investment compared to the cost of a delayed response during a real incident.

How do I handle findings from the Sedona Sunset Prompt?

Treat each finding as an action item. If you identified a pattern or an area you have been avoiding, add it to your compliance improvement tracker with an owner and a due date. Do not let insights fade—they are the most valuable output of the reflection. If the same issue appears in multiple monthly prompts, consider whether it requires a more fundamental change, such as updating a policy or retraining a team.

Should I involve my team in the monthly review?

It depends on your organization's culture and size. For small teams, the compliance lead can perform the review solo but should share a summary with relevant stakeholders (e.g., IT manager for access issues, legal for policy updates). For larger teams, involving representatives from IT, legal, and operations in a brief monthly meeting (30-45 minutes) can surface insights you might miss alone. The Sedona Sunset Prompt can be done individually before the meeting, then discussed collectively.

What if I find a major issue during the review?

A major finding—such as a data breach, a policy violation, or a vendor with a critical security lapse—should be escalated immediately, not left until the next month. Your monthly review is a detection mechanism, not a response mechanism. If you find something urgent, activate your incident response process. Document the finding in your monthly report for audit purposes, but take action first. The goal of the review is to identify risks, not to manage them after the fact.

Conclusion: Turning Monthly Reviews into Strategic Advantage

The four Red Rock compliance checkpoints—Policies & Training, Access Controls, Incident Response, and Third-Party Risk—are designed to transform your monthly review from a rote task into a strategic practice. By focusing on these areas consistently, and by adding the Sedona Sunset Prompt for reflection, you build a habit of proactive risk management rather than reactive firefighting. The key is not perfection but consistency. Even if you miss a step one month, the framework gives you a clear path to get back on track.

Remember that compliance is not a destination; it is a continuous process of adaptation. Regulations evolve, threats change, and your organization grows. A monthly review that checks these four pillars, combined with reflective insight, keeps you aligned with both regulatory expectations and operational reality. As of May 2026, this approach reflects widely shared professional practices. Verify critical details against current official guidance where applicable, especially in highly regulated industries.

Start small. If you are new to structured monthly reviews, focus on just one checkpoint for the first month. Add the others gradually. Use the comparison table to choose an approach that fits your resources. And do not skip the Sedona Sunset Prompt—it may be the 10 minutes that save you months of trouble. With time, this rhythm will become second nature, and your compliance program will stand as firm as the red rocks of Sedona.