A workable calendar has three rhythms: monthly collection, quarterly review and yearly refresh. Monthly tasks export records that expire. Quarterly tasks involve people deciding something, such as access. Yearly tasks renew documents and tests. Assign one owner per row and put it in a shared calendar.
Why a calendar beats good intentions
Most audit pain comes from records that were created but never collected, or reviews that happened but were never written down. A calendar turns "we should" into a dated entry with a named person. This is a suggested pattern, not a requirement from any standard. Adjust it to your controls and your auditor's requests.
The calendar
| Rhythm | Task | Typical owner |
|---|---|---|
| Monthly | Export code host audit log for the prior month | Engineering lead |
| Monthly | Save branch protection and ruleset settings | Engineering lead |
| Monthly | Export code scanning and dependency alert data | Security owner |
| Monthly | Check that collectors ran and retention values are unchanged | Compliance owner |
| Quarterly | Access review of code host, cloud and key SaaS tools | Department heads, signed |
| Quarterly | Review bypass lists and auto-dismiss rules | Engineering lead |
| Quarterly | Sample ten merged changes and check approvals | Someone who did not author them |
| Quarterly | Restore test of a backup | Infrastructure owner |
| Yearly | Policy review and approval | Executive sponsor |
| Yearly | Risk assessment refresh | Compliance owner |
| Yearly | Incident response tabletop | Security owner |
| Yearly | Vendor review of critical suppliers | Procurement or compliance |
| Yearly | Security awareness training for staff | HR |
Why monthly collection
Retention clocks are the reason. GitHub's organization audit log covers 180 days, and Actions artifacts and logs are kept for 90 days by default, with the retention policy applying to checks, workflow runs and commit statuses from 1 October 2026. A monthly export beats every one of those windows with room to spare. See how long GitHub keeps audit events.
How to set it up in an hour
- Copy the table into a spreadsheet and add a due date column for the next twelve months.
- Put recurring events in a shared calendar with the owner invited.
- Create one folder per month and quarter, named in a consistent pattern.
- When a task is done, file the output and tick the row. Keep the tick in the same place as the file.
- In the first week of each quarter, look at overdue rows and fix the process, not just the row.
What to leave out at first
Do not add tasks you cannot staff. A shorter calendar that actually runs gives better evidence than a long one that decays after two months. Add rows when an auditor asks for something new.
Pair this with the monthly evidence health check.
Try it yourself
Click through it at your own pace, or open it full screen. See how scheduled checks keep producing dated results.
Where Safeguard fits
Safeguard offers compliance and evidence automation, continuous SBOM and dependency scanning and a free scan, which cover the scanner rows of this calendar.
Quick check
Is this calendar required by an auditor?
No. It is a practical pattern. Your own controls and your auditor's requests set what you must show.
Who should sample merged changes?
Someone who did not author them, so the check is independent.
Sources
- GitHub Docs: reviewing the audit log for your organization
- GitHub Docs: retention period configuration
Last reviewed: 19 October 2026.
