These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- GRC Audit Compliance
- Features
- Assessment planning
Assessment planning
Set the scope before work starts.
OverviewAssessment Periods×
GRC Audit Compliance · Assessment planning
New
Assessment Periods
Assessments
| Record number | Subject | Period start | Period end | Owner | Status | |
|---|---|---|---|---|---|---|
| ASS-33179 | Planned ass-221 | 19 Oct | 27 Oct | Planned | ||
| ASS-68779 | Testing ass-419 | 04 Oct | 13 Oct | Testing | ||
| ASS-60548 | Planned ass-955 | 21 Oct | 28 Oct | Planned | ||
| ASS-86449 | Testing ass-251 | 18 Oct | 26 Oct | Testing | ||
| ASS-78737 | Planned ass-482 | 22 Oct | 25 Oct | Planned |
6 of 6 records
Planned ass-221Assessments · ASS-33179
PlannedPeriod start19 Oct
Period end27 Oct
What you can do
Set the scope before work starts
An Assessment Owner opens an assessment for a named organization and business unit, enters the period and describes the work to be tested. The record number and revision make later decisions refer to a specific source. Planned tests indicate the intended effort; the team should agree what each planned test represents before assigning work. An assessment can also use the parallel assurance record family, which links to its own organization, team member and counterparty records. Keep one family together for a case so its test lines, decisions and receipts point to the same assessment.
How the work is organized
- Source record. Start with the assessment, risk or finding that owns the work and follow its references before changing a status.
- Named responsibility. Use the linked owner or reviewer so the next action is accountable to a person in the organization.
- Recorded result. Retain the date, status, decision or evidence that explains why the work moved forward.
The Operations Overview helps the team see assessments, tests, decisions and failed operations in one context. Open the underlying record before acting, especially when two assessments have similar subjects. The record number, organization and period should identify the intended case. Decisions and retests should point back to the source they cover.
What to agree during setup
Agree which organization owns each case, who may change scope after planning and what revision must accompany a decision. Choose a consistent period boundary when work spans several business units. For a pilot, use a single assessment and one unit so the owner can check every reference. The team should rehearse these choices with a small, recognizable case before widening access. A named owner should check that a reviewer sees the right case and that a person outside the case cannot change it.
Check the handoff on an actual case
Suppose an internal audit covers access controls for a business unit over the spring period. The Assessment Owner records that unit, period, subject and planned tests, then asks the Control Owner to confirm the controls in scope. A changed scope should be recorded as a new revision with a reason. Reviewers later compare their decision to the revision they actually received. Walk the record from its first entry to the next person’s action. Check that dates, references and status tell the same story, and that evidence is available to the authorized reviewer. If the work is corrected, preserve the earlier result and the reason for the change. The team can then use the same handoff for a second case without relying on a side conversation.
What your team sees
- Assessment Pipeline — Assessments waiting for scope confirmation or testing.
- My Staff Profile — The signed-in person’s staff record and organization.
- Assessment Periods — Period dates and owners for planned or active work.
Each view opens records with the fields needed for that decision. The person working the queue can compare the current status with the linked source, then open the record for its full history. A board or due-date list helps prioritize, while the recorded decision remains on the case.
Follow the work through
Follow assessment preparation, testing and findings, independent review and verified closure. Start with the process that owns the record on this page, then inspect the next handoff before releasing work to another role.
What it keeps track of
Data model- Assessments
- Audit and compliance assessments over a defined period and scope.
- Assurance assessments
- Planned and executed assurance assessments over a control scope and period.
- Program organizations
- Audited organizations holding the compliance program scope.
- Organizations
- Audited organizations that own assessments, controls and evidence.
- Business units
- Units in scope for assessments and risk registers.
- Units counterparties
- Auditable business units and counterparties inside an organization.
- Control test staff
- Control owners, testers and independent assurance reviewers.
- Team members
- Named assurance staff who own assessments, controls and reviews.
Who uses it
Permissions- Assessment Owner
- , Control Owner, Admin.
- The Assessment Owner coordinates the case, while the Independent Reviewer makes the recorded assurance or retest decision when that stage applies.
- Admin
- Handles organizational access and receipt reconciliation.
Set up GRC Audit Compliance your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.