With the January update of the compliance core solution, Archer introduced several new applications to modernize our compliance data model. The new applications—Citations, Obligations, and Sub-Obligations replace the legacy Authoritative Sources application with a structure that is more scalable, better for reporting, and that can integrate directly with our Evolv products.

While Evolv Compliance will automatically fill these new applications with data based on their work, anyone can use these new applications. Because of this update, many existing clients who have used authoritative sources in the past are now asking the same question:

How do I move my existing Authoritative Source data into Citations and Obligations without starting over?

We want to address that question here.

Why This Migration Matters

While we will always allow existing companies to use authoritative sources, the shift to Citations & Obligations brings several benefits to compliance professionals:

• Citations provides a space for us to put regulatory content that showcase parent and child relationships beyond the rigid four levels of the Authoritative Source application.
• Tracking Obligations in its own app makes it really easy to report and enforce requirements
• Controls and Control Standards map more cleanly to obligations, than at various levels of authoritative sources
• coverage and gaps become significantly easier to spot and remediate

We wanted to keep what worked about our Authoritative Source app and enhance it to be ready for the future. You can find more information about the new applications and the Evolv Compliance Integration on our help site:

·      Archer Compliance User Guide

·      Evolv Compliance Integration Guide

Step 1: Export Authoritative Source Data (With the Right Fields)

Authoritative Sources is a leveled application, with the following levels:

1. Source
2. Topic
3. Section
4. Sub-Section

Use Advanced Search to export each level separately, starting from the source and then down to sub-section. We will use these exports from authoritative sources to import into citations, so make sure to include all the data (fields) you want to bring over.

Fields you should definitely export

At a minimum, each export should include:

• Name / Title
• Description / Regulatory Text
• Parent Authoritative Source
  • This preserves the original hierarchy and will later drive Parent Citation mapping
• Mapped Controls
• Mapped Control Standards

If you have done everything correctly, you should have one file per level, each containing both the regulatory content and its existing control relationships.

Step 2: Prepare Citation Import Files and Set Parent Relationships

Before importing anything into the Citations application, it’s necessary to modify the exported files so they align with the Citation data model.

Important Citation Fields

·      Name – Use Name of Auth Source record

·      Description – Use Description of Auth Source record

·      Reportable Citation – Set to “Yes” if you want this specific record to show on dashboards, otherwise set to “No”. See Compliance user guide for more information

·      Upstream Citation Reference – Set to the parent Auth Source Level (see information below)

Populate the Upstream Citation field

Citations uses a self-referencing hierarchy. Parent-child relationships are defined at import time using the Upstream Citation Reference column in your CSV.

Populate it as follows:

• Topics
  • Parent Citation → corresponding Source record
• Sections
  • Parent Citation → corresponding Topic record
• Sub-Sections
  • Parent Citation → corresponding Section record

This step replaces the old “leveled app” structure with an explicit hierarchy inside a single application.

Step 3: Import Citations in Hierarchical Order

Once your files are prepared, import citations one level at a time.

Required import order

1. Source citations
2. Topic citations
3. Section citations
4. Sub-section citations

Each import builds on the previous one. Because parent records already exist, Archer can correctly resolve Parent Citation relationships and reconstruct the hierarchy.

After this step, your regulatory content should exist entirely in the Citations application, fully structured.

Step 4: Identify Which Records Should Become Obligations

Not every citation represents an enforceable requirement. This is where the exports from Step 1 become useful again.

How to identify obligation candidates

Using your Authoritative Source exports:

1. Filter for records that have:

• Mapped Controls, or
• Mapped Control Standards

1. These records typically indicate that the organization has already interpreted them as requirements

In most implementations, you’ll find that Obligations most commonly come from:

• Section level records
• Sub-Section level records

Higher-level records (Sources and Topics) usually provide context, while the enforceable language lives deeper in the hierarchy.

Create an excel file with these obligatory statements so we can import them into Archer in the next step.

Step 5: Import Obligations and Preserve Existing Mappings

1. Create an Obligation import file using the details in the previous step
2. Convert file to CSV
3. Upload records into obligation application
4. Map each obligation to:

• The same Controls and/or Control Standards
• The appropriate Citation record

Step 6: Review Potential Obligation Gaps

If you haven’t done this already, while reviewing the Authoritative Sources application, you may find records that are not mapped to controls, but should represent obligations

These records should also be added as obligations. You can do this by manually creating the obligation in Archer, or creating another CSV and importing them into the Obligation application. While you may leave these temporarily without mapped controls, we recommend running these unmapped obligations through your normal compliance gap assessment and remediation process.

Conclusion

The January release updates Citations and Obligations to support a more scalable, auditable compliance model, and we hope that migrating your existing work to it will make managing complex regulations easier.

You can find more information about these new applications in our Archer Help Documentation online: https://help.archerirm.cloud/archersolutions/Content/ArcherSolutions/archersolutions_intro.htm.