DuraShield User Manual

What is DuraShield?

DuraShield is the operational resilience and governance module of the DuraSuite platform. It is designed for organisations that need structured, audit-grade governance across risk management, compliance controls, standard operating procedures, RACI accountability, IR35 worker status, and dependency resilience. DuraShield transforms fragmented compliance efforts into a unified, board-ready governance framework.

What Problem Does It Solve?

Organisations managing payroll, HR, and operational services face complex regulatory obligations across multiple frameworks (EAS, HMRC, GDPR, ISO 27001). DuraShield eliminates spreadsheet-based compliance tracking by providing structured SOPs, automated risk scoring, control mapping, and audit-ready reporting in a single platform.

How DuraShield Fits in the DuraSuite Ecosystem

Pillar	Purpose	Relationship to DuraShield
DuraChoice	Maturity assessments & audit readiness	Assessment gaps feed into DuraShield risk registers and remediation plans
DuraPulse	Market intelligence & benchmarking	Benchmarking data informs risk context and maturity comparisons
DuraScope	Scoping, RFP, vendor evaluation	Scope decisions create governance requirements tracked in DuraShield
DuraScale	Project execution & delivery	Delivery risks feed into DuraShield; RACI matrices inform task ownership
DuraShield	Risk, compliance & governance	This module — operational resilience, SOPs, RACI, IR35, controls
DuraVoice	Employee & stakeholder comms	Governance findings inform targeted communication campaigns
DuraGuide	Policy management & governance	Policy gaps identified in DuraShield trigger reviews in DuraGuide

Who Is It For?

• Compliance Officers and Risk Managers
• HR and Payroll Operations Leaders
• Internal Audit and Governance Teams
• IR35 Status Decision Makers
• Board members requiring resilience reporting
• C-Suite requiring governance KPIs

Key Capabilities

• SOP Library with 18 audit-grade governance procedures
• RACI Matrix engine with 21 cloneable templates
• Risk & Controls register with automated scoring (5-dimension model)
• IR35 Status Determination with weighted 10-factor assessment
• Dependency & Systems Resilience scoring
• Maturity & Resilience dashboard with 5-tier model
• Board-ready PDF/CSV exports for all modules
• AI Co-Pilot for risk generation, control recommendations, and gap analysis

Term	Definition
SOP	Standard Operating Procedure — a structured governance document defining how a process should be executed
RACI	Responsible, Accountable, Consulted, Informed — a matrix defining task ownership
RACM	Risk and Control Matrix — maps risks to mitigating controls with effectiveness ratings
Control	A safeguard or action designed to mitigate a specific risk
Inherent Risk	Risk level before any controls are applied (scored across 5 dimensions)
Residual Risk	Risk level after controls are applied
IR35	UK tax legislation determining whether a contractor is an employee for tax purposes
Resilience Score	A composite metric measuring operational resilience across governance domains
Maturity Tier	A 5-level scale (Initial → Optimised) measuring governance maturity
Dependency	An external system, vendor, or process that the organisation relies upon

Architecture

Component	Technology	Purpose
Frontend	React 18 + TypeScript	Single Page Application with real-time updates
Styling	Tailwind CSS + shadcn/ui	Consistent design system with dark/light themes
Backend	Supabase (PostgreSQL)	Database, authentication, and storage
AI Services	Supabase Edge Functions	AI-powered risk and control recommendations
PDF Engine	jsPDF + ReportLab	Audit-grade document generation
Hosting	Lovable Cloud	Managed deployment with custom domain support

Supported Browsers

• Google Chrome (latest)
• Microsoft Edge (latest)
• Mozilla Firefox (latest)
• Safari 16+

Accessing DuraShield

Navigate to shield.durasuite.co.uk and sign in with your credentials. New users should contact their organisation administrator for account provisioning.

First Steps

• You will land on the Dashboard showing your organisation's governance overview
• Use the left sidebar to navigate between modules
• Start with the SOP Library or RACI Matrix to familiarise yourself with the governance framework

Sidebar Navigation

Menu Item	Description
Dashboard	Overview of resilience scores, risk heatmaps, and governance KPIs
SOP Tracker	Governance Hub (health scores, risk heatmap, accountability) plus the SOP Library of 18 procedures
RACI Matrix	Clone and manage RACI templates; define accountability across processes (12 fully-populated global templates)
Risks & Controls	Risk register, control library, RACM mapping, and automated scoring
IR35 Compliance	Worker status assessments, determination engine, contractor agreement generator, and governance dashboard
Business Case Builder	Structured cost / risk / strategic-fit business cases with AI-assisted wording and PDF export
Governance Map	Unified workflow view linking SOPs → RACI → Risks → Controls across 12 domains, plus a Gap Plan showing what to build next
Dependencies	Track system and vendor dependencies with resilience scoring
Systems Resilience	20-question IT infrastructure maturity evaluation across 5 domains
Holiday Compliance	7-tab tool for ERA 2025/2026 holiday rules (entitlement, accrual, carry-over) — no payment data handled
Payroll Value Map · People Health	KPI & Financial Value dashboard, transformation snapshots, and 28-day wellbeing / workload / recognition / participation metrics sourced from DuraGuide Team Pulse
Remediation	Track and resolve identified governance gaps and action items
Maturity & Resilience	View maturity tier, resilience scores, and trend analysis
Reports	Generate board-ready reports: Board Summary, Gap Analysis, Compliance Pack
Settings	User preferences, Approver Roster, Contract Templates, and system configuration

Reviewing an SOP

1. Navigate to SOP Library from the sidebar
2. Select a procedure from the list (e.g. 'Annual Salary Review')
3. Review the procedure content, appendices, and governance metadata
4. Use 'Customise' to create an editable copy for your organisation
5. Export the SOP as PDF for offline review or audit evidence

Creating a RACI Matrix

1. Navigate to RACI Matrix → Templates
2. Browse 21 available templates covering payroll, HR, and governance domains
3. Clone a template to create your own editable version
4. Define roles and assign R/A/C/I responsibilities to each task
5. Review the automated Readiness Score based on coverage and completeness
6. Export as PDF or CSV for stakeholder distribution

Managing Risks & Controls

1. Navigate to Risks & Controls
2. Add risks manually or use the AI Risk Generator
3. Each risk is scored across 5 dimensions: Impact, Likelihood, Regulatory Sensitivity, Velocity, Detectability
4. Map controls to risks using the RACM (Risk and Control Matrix)
5. Use the AI Control Recommender for suggested mitigations
6. Track control testing and effectiveness over time

Running an IR35 Assessment

1. Navigate to IR35 Compliance → New Assessment
2. Complete the intake form with worker and engagement details
3. Answer the 10-factor weighted assessment questionnaire
4. Review the automated status determination (Inside/Outside/Borderline)
5. Generate the determination PDF for HMRC-ready evidence
6. Track all assessments on the IR35 Dashboard

Using the Governance Map

1. Navigate to Governance Map from the sidebar
2. Use the Workflow Map tab to see how SOPs, RACI matrices, risks and controls connect for each of the 12 governance domains (Payroll, GDPR, IR35, Holiday, HSE, Financial Controls, IT & Cyber, HR, Vendor, BCP, Compliance, Operational Risk)
3. Switch to the Gap Plan tab to see per-domain readiness scores and a list of items that are existing, ready as templates, or still missing
4. From Risks & Controls, use the Domain filter to focus on a single area, or open the embedded Governance Map tab

The SOP Tracker is the operational governance command centre. It opens on a Governance Hub dashboard and lets you drill into the SOP Library of 18 audit-grade procedures. Every SOP carries a live health score and can be viewed through four different lenses.

Governance Hub (default tab)

• Portfolio health gauge — weighted average of all SOP health scores (0–100)
• Risk heatmap — SOPs grouped by health band (Critical < 50, At Risk 50–69, Healthy 70–84, Strong 85+)
• Accountability lists — who owns the most SOPs, who has the most overdue sign-offs
• Stability trend — change in portfolio score over the last review cycles

SOP Health Engine

Each SOP is scored deterministically out of 100 using five weighted dimensions:

Dimension	Weight	What it measures
Review currency	25%	How recent the last review is vs. the next-review date
Sign-off coverage	25%	Proportion of required approvers who have signed
Ownership	15%	Whether the SOP has a named owner and reviewer
Control coverage	15%	Steps with linked controls or evidence
Exception load	20%	Open exceptions reduce the score

The health badge on each SOP opens a popover with the breakdown and an Export menu — generate a PDF (with circular gauge, dimension bars and ranked weakness remediation bullets) or a CSV.

Visual Modes (per SOP)

• Guide — employee-facing ordered task list for day-to-day execution
• Control — grid of control types, evidence coverage and compliance references
• People — RACI role load table with accountability gap warnings
• Value — automation opportunities and linked KPIs
• Flow — interactive React Flow workflow canvas; nodes are colour-coded by control type, layouts are draggable and persist locally

PDF Export Options

The SOP procedure viewer exposes a dropdown export:

• Full SOP + Workflow — complete procedure with an appendix workflow diagram
• SOP document only — the procedure on its own
• Workflow diagram only — standalone landscape A4 of the flow canvas

SOP Customisation

• Full copy-on-first-edit model preserves system templates
• Date fields (last updated, last reviewed, next review) accept blanks and are coerced safely
• Appendices follow strict system-independent design principles

The Approver Roster is an organisation-level directory of people who can sign off SOPs, plus reusable approver groups (e.g. "Payroll Panel", "GDPR Review Board"). It replaces the old workflow of pasting user UUIDs into the sign-off panel.

Where to Manage It

1. Go to Settings → Approver Roster
2. Add approvers with name, email and role (e.g. Payroll Manager, DPO, Head of HR)
3. Create groups and add the relevant approvers as members

Sending an SOP for Sign-off

1. Open an SOP and use the Sign-off panel
2. Pick a group (one-click panel) or select individual approvers from the roster
3. Send — each approver gets a sign-off request that feeds the SOP Health Engine

Sign-off coverage directly drives the SOP's health score and the Governance Hub accountability widgets.

The RACI engine uses a 3-layer hierarchy (Process → Stages → Tasks) with tasks grouped into logical Control Points. 21 standalone global templates cover domains from Annual Salary Review to TUPE Transfer Management, and 12 core templates are fully populated with stages, tasks and R/A/C/I assignments out of the box — New Starter, Leaver, Salary Review, Bonus Review, Termination, Disciplinary, Probation, Performance Review, Sickness Return, Long-Term Sickness, IR35, Recruitment.

Template Lifecycle

• Clone from global templates to create organisation-specific versions
• Archive templates (soft-delete) with option for permanent deletion
• Risk-weighted Readiness Score based on process completeness
• Export governance analytics as PDF or CSV
• All generated reports persisted in secure Supabase Storage

Grid Page Layout

The RACI grid page uses natural page scrolling, so you can scroll past the "What is a RACI Matrix?" explainer to reach the baseline tasks. The grid itself retains its own horizontal scroll for wide role sets.

The Governance Map provides a single, end-to-end view of how your governance assets fit together. Every SOP, RACI matrix, risk and control is tagged to one of 12 governance domains, so you can see at a glance which areas are well covered and which still have gaps.

The 12 Governance Domains

Payroll · GDPR & Data Protection · IR35 & Off-Payroll · Holiday & Working Time · Health & Safety · Financial Controls · IT & Cyber Resilience · HR & People · Vendor & Third-Party · Business Continuity · Compliance & Regulatory · Operational Risk.

Workflow Map Tab

• For each domain, shows the chain SOP → RACI → Risk → Control
• Coverage score (0–100%) based on how many of the 4 layers are populated
• Click any domain card to see the linked items

Gap Plan Tab

• Per-domain readiness score weighting existing items at 100% and template-ready items at 40%
• Lists every required SOP, RACI, risk and control with a status badge: Existing, Template needed, or Missing
• Includes example risk descriptions (impact × likelihood) and control titles you can use as a starting point when building out registers

Where Else You'll See It

• Risks & Controls page — a Domain filter and a "Governance Map" tab let you slice the registers by domain
• Domain badges appear next to each risk and control so you always know which area they belong to

Risk Scoring Model

Inherent Risk is calculated using a weighted 5-dimension model:

Dimension	Weight	Description
Impact	30%	Severity of consequences if the risk materialises
Likelihood	25%	Probability of the risk occurring
Regulatory Sensitivity	20%	Degree of regulatory exposure
Velocity	15%	Speed at which the risk could escalate
Detectability	10%	Ease of detecting the risk before impact

AI Co-Pilot Features

• AI Risk Generator — suggests risks based on process context
• AI Control Recommender — proposes controls mapped to identified risks
• AI Gap Analyser — identifies coverage gaps across the control framework
• AI Template Generator — creates custom governance templates

The IR35 module provides a unified assessment and governance engine using an automated, weighted 10-factor scoring model. It prevents manual manipulation and produces HMRC-ready determination evidence.

Assessment Factors

Factor	Weight
Control	20%
Substitution	20%
Mutuality of Obligation	15%
Financial Risk	10%
Equipment	5%
Part & Parcel	10%
Exclusivity	5%
Intention	5%
Business Structure	5%
Length of Engagement	5%

Contractor Agreement Generator

From any completed IR35 assessment, click Generate Contract in the assessment header to produce a UK contractor agreement that mirrors the determination outcome.

• Built-in 15-clause UK contractor template — no upload required
• Clauses auto-toggle from the assessment: Right of Substitution, No MOO, Worker-controls-method, Worker-provided equipment, Financial risk borne, Outside IR35 statement
• Editable address fields: client name & registered office, worker address, intermediary / PSC address, SDS reference
• Output as Word (.docx) for final edits or PDF for signature
• Custom Word templates can be uploaded later from Settings → Contract Templates

Engagement Lifecycle

• SOW-First intake → 10-factor assessment → Status Determination Statement → Contract → Ongoing governance
• Engagements dashboard tracks status, renewal dates and outstanding actions
• All assessments produce HMRC-ready PDF determinations

The Business Case Builder turns governance findings into structured, board-ready investment cases. Each case captures the problem, options considered, cost / risk / strategic-fit analysis, and a recommended option.

Workflow

1. Open Business Case Builder from the sidebar and create a new case
2. Complete the structured sections: Background, Options, Cost & Risk, Strategic Fit, Recommendation
3. Use the AI suggest wording buttons to draft British-English copy grounded in the case's own fact pack — preambles, buzzwords and invented regulations are filtered out
4. Use the Ask field to query the recommended option, costs or risks in plain English
5. Export as PDF — headings are kept with their following paragraphs so the "Preferred option" header never orphans onto its own page

Quality Guardrails on AI Output

• British English, active voice, no buzzwords (synergies, leverage, holistic)
• No invented regulations, dates or figures
• Output sanitised to strip "Certainly!" / "Here is…" preambles and wrapping quotes

The Dependency Resilience module is a board-ready decision-driving tool designed to transition from descriptive reporting to actionable resilience intelligence. Track external systems, vendors, and process dependencies with structured scoring by likelihood and criticality.

The Systems Resilience module is a 20-question evaluation that scores IT infrastructure maturity across 5 domains: Backup & Recovery, Access & Identity, Monitoring & Alerting, Change Management, and Vendor & Cloud.

How It Works

• Complete the 20-question assessment with weighted answers per domain
• Each domain produces a 0–100 maturity score that rolls up into an overall IT Resilience tier
• Results integrate with the IT & Cyber Resilience SOPs in the Governance Map
• Gaps surface as remediation items with linked control suggestions
• Export the assessment as a board-ready PDF

The Holiday Compliance module is a 7-tab governance tool for the UK Employment Rights Act 2025/2026 holiday rules. It does not store, calculate or process pay or salary data — it is a compliance framework, not a payroll engine.

The 7 Tabs

1. Overview — current ERA 2025/2026 obligations and your readiness score
2. Entitlement Rules — statutory minimums, bank holidays, and contractual top-ups
3. Accrual Methods — fixed-hours, irregular-hours and part-year worker rules
4. Carry-Over — sickness, family leave and Covid-style carry-over provisions
5. Records & Evidence — what to keep and for how long
6. Communication — manager and worker briefing checklists
7. Audit Pack — exportable PDF/CSV evidence pack

Holiday Compliance never reads or writes employee pay data. All calculations are illustrative governance examples only.

The Payroll Value Map shows the human, operational and financial impact of how payroll is run. It combines a live KPI & Financial Value dashboard, transformation snapshots, and a People Health tile sourced from real DuraGuide Team Pulse activity for any employee tagged with the payroll scope tag in DuraGuide.

KPI & Financial Value Dashboard

• Headline KPIs are computed live from the configured process steps — total annual hours, estimated annual operating cost band (from configured role rate bands — no salary data is stored), highest automation opportunity, total hire-to-retire steps
• Transformation snapshots compare baseline vs. current to surface hours released, cost saved, efficiency uplift and re-deployable FTE capacity
• Snapshot data is reconciled to the live process — the headline KPIs and the Transformation card always tell one consistent story
• Export the dashboard as CSV or PDF

What's Pulled From DuraGuide

DuraShield Metric	DuraGuide Source	Formula (28-day window)
Wellbeing Index	wellbeing_checkins.mood + energy	(((avg(mood) + avg(energy)) / 2) − 1) / 4 × 100
Workload Score	wellbeing_checkins.workload	(1 − (avg(workload) − 1) / 4) × 100 — inverted: high pressure = low score
Recognition Rate	recognitions.recipient_id	distinct recipients in scope ÷ scope size × 100
Participation Rate	wellbeing_checkins.user_id	distinct respondents in scope ÷ scope size × 100

Privacy & Refresh

• If fewer than 5 employees respond in a period, all scores are suppressed in the UI
• Only aggregates are exposed in DuraShield — no individual responses are visible
• A nightly cron refresh runs at 02:15 UTC; you can also trigger a manual refresh from the People Health details page
• Every sync (cron, manual, or edge) is recorded in the Sync Audit Trail on the People Health details page, including who triggered it, the parameters, row counts and duration

Why Both DuraGuide and DuraShield

DuraGuide captures the signal (Team Pulse, recognition, workload). DuraShield turns that signal into governance evidence alongside risk, controls and SOPs — so the wellbeing of the payroll team becomes a board-visible operational resilience metric.

The Resilience Score maps to a 5-tier maturity model:

Tier	Name	Score Range
5	Optimised	90+
4	Managed	75–89
3	Defined	55–74
2	Developing	35–54
1	Initial	0–34

The Reports module provides six board-ready and export-friendly document types:

• Board Summary Report — executive resilience overview
• Gap Analysis Report — coverage gaps and remediation priorities
• Compliance Pack — combined evidence for auditors
• IR35 Determination Report — per-worker assessment evidence
• RACI Governance Report — accountability matrix exports
• SOP Export Pack — complete procedure library

Export Formats

Format	Use Case
PDF	Board presentations, audit evidence, formal documentation
CSV	Data analysis, integration with other systems, bulk review
JSON	API integration and programmatic access

The Dashboard provides a real-time governance overview including resilience scores, risk heatmaps, control effectiveness trends, and maturity tier progress.

Dashboard Widgets

• Resilience Score gauge with maturity tier indicator
• Risk heatmap showing distribution by severity and likelihood
• Control effectiveness trend chart
• SOP review status tracker
• Upcoming compliance deadlines
• Recent activity feed

Question	Answer
Can I customise SOPs?	Yes — use the Customise button to create an editable copy of any SOP
How is the risk score calculated?	Using a weighted 5-dimension model: Impact (30%), Likelihood (25%), Regulatory Sensitivity (20%), Velocity (15%), Detectability (10%)
Can I export reports?	Yes — all modules support PDF and/or CSV export
What AI features are available?	Risk Generator, Control Recommender, Gap Analyser, and Template Generator
Is my data secure?	Yes — all data is protected by Row Level Security (RLS) with company-level isolation
How often should I review SOPs?	At minimum quarterly; more frequently for high-risk processes

Symptom	Likely Cause	Resolution
Blank dashboard after login	No organisation assigned	Contact administrator to assign your account
Cannot access a module	Insufficient permissions	Request role upgrade from your admin
PDF export fails	Browser popup blocker	Allow popups for the platform domain
AI features not responding	Edge function timeout	Retry; if persistent, contact support
Data not saving	Session expired	Refresh the page and re-authenticate

Channel	Details
Support Email	catey@durasuite.co.uk
Platform	shield.durasuite.co.uk
Documentation	Available within the platform and via PDF download
Response Time	Within 24 hours for standard queries

Data Protection

• All data encrypted in transit (TLS 1.2+) and at rest
• Row Level Security (RLS) enforced on all database tables
• Company-level data isolation — users can only access their organisation's data
• Authentication via Supabase Auth with session management
• All administrative actions verified via the system-wide admin role

Compliance

• Infrastructure certified for ISO 27001 and SOC 2 Type II
• GDPR-aligned data processing and storage
• Audit logging for all significant system actions

Do's

• Review SOPs quarterly and update governance metadata
• Keep RACI matrices current as roles and responsibilities change
• Log risks early and assign controls promptly
• Use the AI Co-Pilot to identify gaps you may have missed
• Generate board reports monthly for governance oversight
• Complete IR35 assessments before engagement commencement

Don'ts

• Don't skip control testing — untested controls provide false assurance
• Don't modify system templates directly — always clone first
• Don't ignore the Remediation queue — unresolved gaps accumulate risk

Version	Date	Changes
1.0	April 2026	Initial release — SOP Library, RACI Engine, Risk & Controls, IR35, Dependencies, Reports
1.1	April 2026	Unified Governance Workflow — Governance Map, Gap Plan, 12 governance domains, domain badges and filters across Risks & Controls
1.2	May 2026	Systems & IT Resilience module, Holiday Compliance (ERA 2025/2026), Payroll Value Map with People Health sourced from DuraGuide Team Pulse, nightly sync cron and visible Sync Audit Trail
1.3	June 2026	SOP Governance Hub with deterministic health scoring; Guide / Control / People / Value / Flow visual modes per SOP; React Flow workflow canvas; health-badge PDF & CSV export with weakness remediation; per-SOP PDF export options (Full + Workflow, SOP only, Workflow only); Approver Roster & group sign-off; IR35 Contractor Agreement Generator (Word + PDF) driven by assessment outcome; Business Case Builder with grounded AI wording & keep-with-next PDF layout; KPI & Financial Value dashboard on Payroll Value Map; 12 RACI templates fully populated; RACI grid page made naturally scrollable; safer SOP date editing

Roadmap

• Enhanced AI capabilities with natural language governance queries
• Cross-pillar data integration with DuraScale and DuraScope
• Advanced benchmarking against industry peers
• Automated compliance calendar and deadline management

Term	Definition
DuraSuite	The connected platform of seven specialist pillars
DuraShield	The operational resilience and governance pillar (this platform)
DuraScale	The execution and delivery pillar
DuraScope	The scoping and vendor evaluation pillar
DuraChoice	The maturity assessment and audit readiness pillar
DuraPulse	The market intelligence and benchmarking pillar
DuraVoice	The employee and stakeholder communications pillar
DuraGuide	The policy management and governance pillar
RLS	Row Level Security — database-level access control
HMRC	Her Majesty's Revenue and Customs
EAS	Employment Agency Standards
SPA	Single Page Application