1. GRC Audit Compliance
  2. Features
  3. Assessment planning
Feature · Assessment planning

Assessment planning

Set the scope before work starts.

OverviewAssessment Periods
GRC Audit Compliance · Assessment planning

Assessment Periods

Assessments

New
Record numberSubjectPeriod startPeriod endOwnerStatus
ASS-33179Planned ass-22119 Oct27 OctPlanned
ASS-68779Testing ass-41904 Oct13 OctTesting
ASS-60548Planned ass-95521 Oct28 OctPlanned
ASS-86449Testing ass-25118 Oct26 OctTesting
ASS-78737Planned ass-48222 Oct25 OctPlanned
6 of 6 records
Planned ass-221Assessments · ASS-33179
Planned
Period start19 Oct
Period end27 Oct
Example screen with sample data

What you can do

Set the scope before work starts

An Assessment Owner opens an assessment for a named organization and business unit, enters the period and describes the work to be tested. The record number and revision make later decisions refer to a specific source. Planned tests indicate the intended effort; the team should agree what each planned test represents before assigning work. An assessment can also use the parallel assurance record family, which links to its own organization, team member and counterparty records. Keep one family together for a case so its test lines, decisions and receipts point to the same assessment.

How the work is organized

  • Source record. Start with the assessment, risk or finding that owns the work and follow its references before changing a status.
  • Named responsibility. Use the linked owner or reviewer so the next action is accountable to a person in the organization.
  • Recorded result. Retain the date, status, decision or evidence that explains why the work moved forward.

The Operations Overview helps the team see assessments, tests, decisions and failed operations in one context. Open the underlying record before acting, especially when two assessments have similar subjects. The record number, organization and period should identify the intended case. Decisions and retests should point back to the source they cover.

What to agree during setup

Agree which organization owns each case, who may change scope after planning and what revision must accompany a decision. Choose a consistent period boundary when work spans several business units. For a pilot, use a single assessment and one unit so the owner can check every reference. The team should rehearse these choices with a small, recognizable case before widening access. A named owner should check that a reviewer sees the right case and that a person outside the case cannot change it.

Check the handoff on an actual case

Suppose an internal audit covers access controls for a business unit over the spring period. The Assessment Owner records that unit, period, subject and planned tests, then asks the Control Owner to confirm the controls in scope. A changed scope should be recorded as a new revision with a reason. Reviewers later compare their decision to the revision they actually received. Walk the record from its first entry to the next person’s action. Check that dates, references and status tell the same story, and that evidence is available to the authorized reviewer. If the work is corrected, preserve the earlier result and the reason for the change. The team can then use the same handoff for a second case without relying on a side conversation.

What your team sees

  • Assessment Pipeline — Assessments waiting for scope confirmation or testing.
  • My Staff Profile — The signed-in person’s staff record and organization.
  • Assessment Periods — Period dates and owners for planned or active work.

Each view opens records with the fields needed for that decision. The person working the queue can compare the current status with the linked source, then open the record for its full history. A board or due-date list helps prioritize, while the recorded decision remains on the case.

Follow the work through

Follow assessment preparation, testing and findings, independent review and verified closure. Start with the process that owns the record on this page, then inspect the next handoff before releasing work to another role.

What it keeps track of

Data model
Assessments
Audit and compliance assessments over a defined period and scope.
Assurance assessments
Planned and executed assurance assessments over a control scope and period.
Program organizations
Audited organizations holding the compliance program scope.
Organizations
Audited organizations that own assessments, controls and evidence.
Business units
Units in scope for assessments and risk registers.
Units counterparties
Auditable business units and counterparties inside an organization.
Control test staff
Control owners, testers and independent assurance reviewers.
Team members
Named assurance staff who own assessments, controls and reviews.

Who uses it

Permissions
Assessment Owner
, Control Owner, Admin.
The Assessment Owner coordinates the case, while the Independent Reviewer makes the recorded assurance or retest decision when that stage applies.
Admin
Handles organizational access and receipt reconciliation.

Set up GRC Audit Compliance your way.

Start free, then use Proto to change fields, steps and approvals before your team goes live.

How to get started