Uploads & Imports
Bring existing registers in from a spreadsheet and map their columns.
11 min read9 sectionsAll roles (approval is owners and admins only)
The Uploads page brings existing registers into ShelfGRC from a CSV or Excel file, and uploads policy and evidence documents. You match your file's columns to ShelfGRC fields, and the whole import goes to Proposals as one change for an owner or admin to approve.
Open Uploads from the sidebar and pick a card under Select Data Type.
Risks
Spreadsheet import, including inherent and residual ratings.
Controls
Spreadsheet import of your control library.
Policies
Upload a policy document, or import a policy register from a spreadsheet.
Evidence
Document upload only. There is no spreadsheet import for evidence.
Obligations Register
Spreadsheet import of compliance obligations.
Incidents
Spreadsheet import of your incident register.
Treatment Plans
Spreadsheet import with priority, status and due dates.
The Manage taxonomy link at the top right opens your category settings, so you can add missing categories before you import.
A clean file with one heading row maps quickly and imports without surprises.
Spreadsheet limits
- CSV, .xlsx, .xls
The file types the spreadsheet import accepts.
- 10 MB
Largest file you can load.
- 100,000 rows
Most rows one file can hold.
- First visible worksheet
In an Excel workbook, only the first visible sheet is read. Rows hidden or filtered out in Excel are skipped — unhide them to import them.
Put your column headings in one row at the top, with one record per row below. Title is limited to 500 characters and Description to 10,000.
The page walks you through 1. Select Type & Upload, 2. Map Fields and 3. Review & Submit.
- 1
Choose the data type
Click its card. To change type after loading a file, click Upload Different File first.
- 2
Add your file
Drag it onto Drag & drop your file here, or click to browse. The page confirms how many columns and rows it found.
- 3
Click Continue to Field Mapping →
Mapping is filled in automatically. See Map your columns.
- 4
Choose a business unit
The Business unit picker puts every row in one unit. Owners and admins can leave it on Per-row (use the file's column) to use an organisational unit column in your file. Members choose from the units they are assigned to: with one unit it is already chosen, with several you must pick one before submitting, and with none the page says the rows will be placed in the organisation root for an owner to approve.
- 5
Check the Data Preview and the mapping
Data Preview shows the first five rows. Adjust any field in Map Your Columns.
- 6
Add notes for the approver
Optional. Additional Notes (optional) travels with the proposal.
- 7
Click Submit for Review →
The import becomes one proposal. Click Continue to Completion →, then Review Proposals → or Go to … Register.
Each ShelfGRC field has a dropdown where you pick the column from your file that fills it.
When you arrive at this step, AI suggestions and ShelfGRC's own heading matching fill in as many fields as they can, and a message says how many were mapped. The automatic pass uses each column for at most one field. To get the AI suggestions again, click Let AI Map Fields. The AI reads your column headings and the first three rows.
What each field shows
- Tick
A tick beside the field name means a column is mapped.
- Expected:
For risk ratings and categories, the values your organisation uses.
- Will import:
The first three values from the chosen column. An amber line means those rows are empty.
- — Skip field —
Leaves the field unmapped, so it imports blank.
Mapping Summary names every column in your file that is not mapped and will not be imported. Only Title must be mapped; Submit for Review → stays disabled until it is.
The full list for the chosen type also appears under Expected columns before you load a file. That list shows each field by its key, for example likelihood, impact, secondary_category, org_unit and next_review_at.
| Type | Fields |
|---|---|
| Risks | Title, Description, Inherent Likelihood, Inherent Impact, Category, Secondary Category, Causes, Consequences, Owner, Status, Classification, Org Unit, Next Review At, Residual Likelihood, Residual Impact |
| Controls | Title, Description, Type, Owner, Review Frequency, Category, Secondary Category, Org Unit, Implemented At, Next Review At, Classification |
| Policies | Title, Description, Owner, Status, Version, Effective Date, Next Review At, Category, Secondary Category, Approver, Review Frequency, Last Review At, Previous Version, Classification, Privilege, Org Unit |
| Obligations Register | Title, Description, Source, Framework (the register's Reference), Owner, Frequency, Compliance, Due Date, Category, Secondary Category, Classification, Org Unit |
| Incidents | Title, Description, Severity, Status, Taxonomy Code, Secondary Category, Owner, dates, impact, root cause, control failure, notifiable breach details, Classification, Privilege, Org Unit and more |
| Treatment Plans | Title, Description, Priority, Status, Owner, Due Date, Mitigating Actions, Privilege, Classification, Org Unit |
Some cells are matched against your organisation's settings rather than copied as written.
- Category and Secondary Category
Matched to your taxonomy by code or name, ignoring case. Controls use the control taxonomy, incidents the incident taxonomy, and risks, policies and obligations the risk taxonomy. Importing never creates a category: an unmatched value imports uncategorised, and an unmatched secondary keeps the primary.
- Org Unit
Matched to a unit by name, ignoring case. A blank or unmatched cell uses the business unit you chose, or the organisation root if you did not choose one.
- Owner
Stored as written. It is not linked to a user account.
- Likelihood and Impact
A number from 1 to 5 or one of your organisation's labels. A missing or unrecognised inherent rating uses the middle level. A residual rating needs both columns, and is skipped if it is unrecognised or higher than the inherent rating.
- Status
A value the register doesn't use is replaced with its default. For policies, Published becomes Active, Under Review becomes In Review and Archived becomes Retired; these three are mapped silently, without a warning.
- Classification and Privilege
Public and Confidential are kept. Internal, Restricted, Private and Highly sensitive all import as Confidential, and nothing ever imports as Highly sensitive. Any other value imports as Public. Anything other than Privileged/Non-privileged imports as Non-privileged.
- Dates
Common date formats are accepted. A date that can't be read imports blank.
Each of these substitutions is flagged on the proposal before anyone approves it. For risks that covers an unrecognised status, a missing or unrecognised rating, a residual rating that is skipped, a category or secondary category that does not resolve (including a secondary under the wrong primary), an organisational unit that does not match, and a date that can't be read. For every register, a classification that changes is flagged too, for example "Internal" will import as Confidential. Policy status aliases are the exception: they map without a warning.
Nothing reaches a register until an owner or admin approves the import in Proposals.
The proposal lists every row with its mapped values. A value that will be changed on approval carries an amber warning, and a row with no title is marked Unlabeled record and will be skipped. Approvers can remove individual rows before approving. Rows marked Confidential or Privileged can only be approved by someone with that access. Approvers without it do not see the proposal at all (it shows as not found), and a direct approval is refused with "This proposal contains Confidential or Privileged content outside your access. Ask a user with that access to review it."
After approval, the proposal shows an Import outcome card with the number of rows created, skipped, coerced and uncategorised; click Details for each row's reason. If no rows were created, the proposal stays pending so the problem rows can be removed and the import approved again. See the Proposals guide.
The Policies and Evidence cards also open a document form that needs no column mapping.
Choosing Policies shows two panels: the first is the document form, the same as Upload Policy on the Policies register; the second, with Expected columns, is the spreadsheet import. Choosing Evidence shows the document form only. Each document upload takes one file and creates a proposal for that record. See the Policies guide and Evidence guide for the fields.
Document limits
- PDF, .docx, .xlsx, .pptx, CSV, TXT
Accepted document formats. Older .doc, .xls and .ppt files are not accepted as documents.
- PNG, JPEG, GIF, WebP
Accepted image formats.
- 4 MB
Largest document you can upload.
What common errors mean and how to fix them.
| Message | What to do |
|---|---|
| File is too large (or Spreadsheet is too large) … Maximum allowed size is 10 MB. | Remove unused columns, or split the file. |
| … too many rows … Maximum allowed is 100000. | Split the file into smaller imports. |
| No headers found in file / No data rows found in file | Put headings in the first row and at least one record below them. |
| Excel file contains no sheets / Excel file is empty | Check the first visible worksheet holds your data, and that its rows aren't all hidden or filtered out. |
| Cannot change data type | Click Upload Different File, then choose the new type. |
| "title" field must be mapped before submitting | Map a column to Title. |
| Title must be 500 characters or fewer. | Shorten the long titles, or map a shorter column to Title. |
| No rows were created from this import. Review the skipped rows below, fix the field mapping or remove the bad rows, then approve again. | Open Details on the Import outcome card to see why each row was skipped, fix the mapping or remove those rows, then approve again. |
| Error parsing file / Invalid file format. Please check your file. | The file is not a real .xlsx or .xls workbook (for example a renamed document, or an old .xls that is really HTML or XML). Re-save it from Excel as .xlsx or CSV. |