Questions, answered

Click Get started, then use Proto to configure Compliance Management for your business. Begin with one organization, one business unit, a scoped assessment and a control whose owner can supply test evidence.

Record the subject, owner, business unit, period, scope statement and planned tests. Link tests, obligations, findings and supporting attachments to that assessment.

A risk belongs to a business unit and has a named owner, likelihood, impact and scale version. A control links to that risk and has its own owner, description and effective date.

The Tester records a control test with sample size, exception count, result and evidence reference. A finding then describes the issue and links to the affected assessment and control.

The Independent Reviewer examines the submitted obligation and records a decision, reason and source revision. The Compliance Lead handles a returned or rejected item.

An Independent Reviewer records a separate retest result and evidence against the finding. The team can then verify a passing correction or continue work after a failed or inconclusive result.

Record attachments belong to assessments and carry a visibility choice. Test and corrective action records can also hold evidence references that the team agrees how to resolve.

Operations Overview shows tests performed, failed tests, pending review decisions and failed operations for the authorized scope. Working lists show submitted obligations, findings and corrective actions.

Yes, review likelihood and impact with the scale version used for each risk. Agree on how to interpret different versions before comparing ratings.

Open its receipt, review the action, expected revision, failure reason and effect references, and compare those with the assessment records before treating the work as complete.