Assessment and control testing

Step by step

1. Set scope Compliance Lead

   Compliance Lead identifies the organization, operating unit and assessment owner. The subject and period make the review boundary explicit.

   • Names the period and accountable owner
   • Updates Assessments, Organizations, Business units, Team members

2. Plan assessment Assessment Owner

   Assessment Owner records scope and planned tests, then moves the assessment from draft to planned.

   • Changes Status from Draft to Planned
   • Updates Assessments

3. Test controls Assessment Owner

   The owner records each line under the assessment, linked to a control, with a result, sample size, exception count and evidence reference. The assessment moves into testing.

   • Preserves each result and evidence reference
   • Updates Assessment tests, Controls, Assessments

4. Investigate exceptions Control Owner

   Failed or inconclusive results receive attention from the control owner and compliance lead. Keep the original test outcome intact.

   • Explains failed or inconclusive work
   • Updates Assessment tests, Controls

5. Open finding Compliance Lead

   Compliance Lead records a finding against the assessment and control with severity and a plain description of the issue.

   • Gives the issue a severity and linked source
   • Updates Findings, Assessments, Controls

6. Review the period Assessment Owner

   Assessment Owner checks the planned work against actual tests and sends unresolved issues into corrective action before closure.

   • Separates resolved work from remediation
   • Updates Assessments, Findings

Compliance Lead

, Assessment Owner, Control Owner, Action Owner.