What if my compliance manager quit?

Before their last day, transfer ownership of everything only they could touch: GRC platform admin (and add a second admin while you’re at it), the auditor’s portal, evidence folders, the policy repository, and any password-manager vaults. Then run your own offboarding checklist on them, carefully — their departure will sit in the auditor’s next leaver sample, and it would be a bad irony for the compliance manager’s offboarding to become the finding.

Next, reconstruct the calendar. List everything due in the next ninety days: access reviews, vendor reviews, training assignments, evidence requests, questionnaire deadlines, audit milestones, renewals. Compliance programs rarely fail in the week someone leaves; they fail two quarters later, one silently missed cadence at a time.

Then tell the auditor. A named interim contact offered before fieldwork reads as a managed transition; unexplained silence reads as a program adrift. Auditors don’t penalize turnover — they penalize controls that stopped operating while nobody owned them.

The departure exposed the real defect: the program lived in one head. You can rehire — a scarce role, months to fill, and the same single point of failure at the end — or move the function to a standing team, the model described at outsourced compliance team; the full trade-off is worked through in hire versus outsource. Whichever way you go, make the program legible this time: named control owners, shared runbooks, no map that exists only in memory. Managed compliance services can also hold the interim while you decide.