Assessments

An assessment holds the subject, organization, business unit, owner and period for a piece of compliance work. Its scope statement explains the question the team intends to answer. Planned tests make the expected testing effort visible before results begin to arrive. The assessment’s status shows whether the work is being drafted, planned, tested, reviewed, remediated or closed.

For a quarterly control review, the Compliance Lead chooses the organization and business unit, states the period and names the owner. The team should recognize the subject from its working language. A clear scope helps the Tester know which controls belong in the review and helps the Independent Reviewer judge whether a later decision covers the right material.

• Plan. The Compliance Lead sets the period, scope statement, planned tests and assessment owner.
• Execute. Test results, findings, attachments and obligation reviews connect back to the assessment.
• Close. The lead checks open corrective work and operation outcomes before recording the final status.

Decide how assessments are divided by organization, business unit and period. A business unit that operates across several jurisdictions may need a scope statement that calls out the relevant boundary. Agree who can change a scope after testing has started and how a revision is explained to the people reviewing it.

Set a consistent record number convention and make the period start and end dates meaningful to the team. Planned tests should reflect an actual testing plan, not a target entered solely for reporting. Identify the person accountable for decisions when a finding is found late in the period. The assessment owner is the first person who should be able to explain the current state.

Take a current assessment and ask the Compliance Lead to explain its subject, period and scoped business unit. Ask the Tester to open the same record and identify the controls being checked. Enter one test result and one supporting attachment. Confirm that each is tied to the intended assessment and that the evidence can be found from the working record.

Then introduce a failed test. The resulting finding should refer to both the assessment and control. The lead can review its severity and decide what corrective work is required. If the scope changes, the revision and operation receipt provide a trail for comparing the earlier and corrected work. Before closure, inspect decisions, findings and any failed operations together.

• Assessments in progress — Active assessment work by status, owner and period.
• Assessment schedule — Planned and testing work across its start and end dates.
• My assessments — The signed-in owner’s assigned assessments.

See assessment cycle and testing and remediation.