---
title: "Declarations and Reviews"
description: "Document compliance evidence against a control with declarations, and assess its implementation with reviews."
source: "Guardian Platform"
---
## About declarations and reviews

Declarations and reviews are written statements used to describe a control's compliance status. As declarations and reviews are the primary actions which drive a control towards its outcome, they form the engine of the compliance process in Guardian.

Declarations are typically made by those responsible for implementing a control — such as an engineer, project manager, or security lead. Reviews are typically made by those responsible for validating the implementation is satisfactory — such as an internal auditor or compliance lead.

Optionally, users can upload attachments to a declaration or review to support their statement.

To uphold the integrity of the compliance process, declarations, reviews, and any associated attachments cannot be edited after being submitted.

Key actions associated with declarations and reviews include:

- [Creating a declaration](#creating-a-declaration)
- [Creating a review](#creating-a-review)
- [Viewing and sharing a statement](#viewing-and-sharing-a-statement)
- [Declaring and reviewing from a script](#declaring-and-reviewing-from-a-script)
- [Best practices for attachments](#best-practices-for-attachments)

## Creating a declaration

A declaration is a statement describing how a control has been implemented.

Declarations can only result in two statuses: **In Progress** or **Ready for Review**.

- An **In Progress** declaration indicates the control has not yet been implemented.
- A **Ready for Review** declaration indicates the control is ready for an auditor to review.

To create a declaration:

1. In the project sidebar, select the applied policy under **Applied Policies**
2. Select the control you wish to declare against
3. Beside **Add New**, open **Select Status** and, under **Declaration**, choose either **In Progress** or **Ready for Review**
4. Optionally, enter a subject line in **Add subject line** and, in the editor below it, a statement describing how the control has been implemented
5. Optionally, upload attachments of up to 10 MB each to support your statement
6. Select **Submit**

![A control page for CE-1 Access review, with its description and Not Started status, an empty activity history, and the Add New form with a status picker, subject line, comment editor, and attachment area, beside a list of the policy's other controls.](../../../assets/declarations-and-reviews/control-evidence.png)

## Creating a review

A review is a statement describing whether a control's implementation is satisfactory.

Reviews can only result in four statuses: **In Review**, **Compliant**, **Non-compliant**, or **Not Applicable**.

There are two categories of reviews:

- Comment reviews: allows auditors to submit non-determinative feedback regarding the implementation of a control.
  - A **General** comment is used for neutral input without necessarily signaling approval or concern with the control's implementation.
  - An **Accepted** comment expresses agreement with the control's implementation.
  - A **Questioned** comment flags potential issues or uncertainties with the control's implementation.
- Outcome reviews: allows auditors to make a determinative assessment regarding the implementation of a control.
  - A **Compliant** review indicates the control's implementation is satisfactory.
  - A **Non-compliant** review indicates the control's implementation is unsatisfactory.
  - A **Not Applicable** review indicates the control does not require implementation.

To create a review:

1. In the project sidebar, select the applied policy under **Applied Policies**
2. Select the control you wish to review
3. Beside **Add New**, open **Select Status**, then choose from the **Comment** group — **In Review**, which opens a submenu of **General**, **Accepted**, and **Questioned** — or from the **Outcome** group — **Compliant**, **Non-compliant**, or **Not Applicable**
4. Optionally, enter a subject line in **Add subject line** and, in the editor below it, a statement describing your assessment
5. Optionally, upload attachments of up to 10 MB each to support your statement
6. Select **Submit**

![The status menu beside Add New on a control that is In Review, grouped into Declaration, Comment, and Outcome, with the In Review submenu open on General, Accepted, and Questioned.](../../../assets/declarations-and-reviews/review-status-menu.png)

Note: reviews cannot be made while a control is Not Started or In Progress. Those options still appear in the menu, but they are disabled.

## Viewing and sharing a statement

Each declaration and review in a control's activity history has a **Statement actions** menu (⋮):

- **View Statement** opens the **Governance Statement**: who registered the signed statement and when, its attachments, and a download of the statement.
- **Copy Link** copies a link straight to that declaration or review.

On an archived applied policy the **Add New** form is not shown. Its controls' history stays readable, but no new declarations or reviews can be added.

## Declaring and reviewing from a script

Scripts post declarations and reviews to the Governance Service at your platform host followed by `/governanceService`, with your sign-in token or an API key. Address the project by UUID, the applied policy by numeric ID or `slug:<slug>`, and the control by numeric ID or `code:<control code>`.

To post a declaration, which needs **Create Declarations**, plus **Submit Controls for Review** when `isReadyForReview` is `true`:

```bash
curl -X POST "https://guardian.example.com/governanceService/api/v1/projects/<project UUID>/policies/slug:<slug>/controls/code:CE-1/declarations" \
  -H "Authorization: Bearer $GUARDIAN_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{
    "subjectLine": "Quarterly access review completed",
    "statement": "Access to production systems was reviewed and approved on 2026-10-01.",
    "isReadyForReview": true
  }'
```

To post a review, which needs **Create Comments**, plus **Determine Control Outcomes** for any `outcome` other than `COMMENT`:

```bash
curl -X POST "https://guardian.example.com/governanceService/api/v1/projects/<project UUID>/policies/slug:<slug>/controls/code:CE-1/reviews" \
  -H "Authorization: Bearer $GUARDIAN_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{
    "outcome": "COMPLIANT",
    "subjectLine": "Access review verified",
    "statement": "The review record matches the approved access list."
  }'
```

`outcome` is `COMPLIANT`, `NON_COMPLIANT`, `NOT_APPLICABLE`, or `COMMENT`. A `COMMENT` review takes a `commentType` of `GENERAL`, `ACCEPTED`, or `QUESTIONED`. Both calls return `201` with the created record, including its `cid`.

## Best practices for attachments

Optionally, users can upload attachments to a declaration or review to support their statement. Below are some best practices to guide your use of attachments.

- **Be aware of attachment access.** Every attachment you upload is viewable by all other members of your project. Additionally, the file itself will be included in the .zip of the policy's report. Attachments cannot be edited or deleted after being submitted.
- **Attach the smallest useful file.** Each attachment can be up to 10 MB. Upload the specific file that supports your statement rather than a broad export. A targeted attachment is easier for a reviewer or auditor to assess.
- **Explain your attachment.** In your statement, describe what each attachment proves and how it satisfies the control, so a colleague or auditor can assess it without prior context.

## Related

- [Controls](./controls.mdx) — how each declaration or review changes a control's status
- [Roles and Permissions](./roles-and-permissions.mdx) — which roles can declare, comment, and determine outcomes
- [Integrity Actions](./integrity-actions.mdx) — why statements and attachments cannot be edited once submitted
- [Reports](./reports.mdx) — how declarations, reviews, and attachments appear in an export
- [Indicators](./indicators.mdx) — post a declaration automatically when an evaluation fails
- [Evidence Records](../integrity-service/evidence-records.mdx) — how Integrity Service keeps stable references to submitted evidence