Assessments and scope

An Assessment Owner starts with a subject, operating organization, business-unit counterparty and period. The scope statement tells testers which work is in the engagement. A planned test count makes the intended coverage visible before results arrive. A construction project may have several packages underway at once; a named assessment helps the team avoid treating a test from one period or business unit as evidence for another.

The scoping workflow checks that the organization is the authenticated one, that the owner belongs to it and that the revision still matches the caller’s expectation. It then creates or advances the assessment and creates test lines for planned controls in sequence. A repeated operation key resolves to the same work, so an interrupted request should not quietly add a second set of test lines.

• Boundary. Agree the period and scope statement that distinguish this assessment from a later review of the same site.
• Ownership. Identify the person responsible for the assessment and the business unit whose activity is being assessed.
• Coverage. Agree which controls are planned and how to reconcile the planned count to the created test lines.

The Assessment Owner and Compliance Manager should rehearse how this work is assigned and reviewed. Agree which organization and business unit own the first case, who may update it, and where its supporting evidence lives. Set a clear handoff when the person preparing the record is different from the person checking its outcome. Use the same rule for routine work and exceptions so an urgent item does not lose its owner or history.

For the pilot, use an assessment with a defined subject and period, then ask the owner to explain why each control belongs in scope. Check the business unit against the risk register and the planned test count against the created lines. A stale revision should leave the newer scope intact.

Try a single assessment for a defined inspection period. Set its organization, owner and business unit, then select controls tied to the relevant risks. Check that each test line points back to the assessment and the intended control, and that its line number reflects the plan. Repeat the same scoping request to confirm the result is not duplicated. Change the expected revision in a stale request and confirm that the newer assessment is protected.

Open My assessments as the owner and compare the subject, period and business unit with the planned test lines. If a scoping request times out, inspect the assessment and operation receipt before retrying with the same key. The line numbers should still describe one plan.

• My assessments — The owner’s assessments with period and current state.
• Assessment period schedule — Assessments placed against their period start and end dates.

See the related process for the stage-by-stage handoff. Use the data model to inspect the record relationships and implementation to plan the first rehearsal.