1. Professional Services GRC
  2. Features
  3. Testing and Evidence
Feature · Testing and Evidence

Testing and Evidence

Record samples, exceptions, outcomes and assessment evidence.

OverviewFailed Control Tests
Professional Services GRC · Testing and Evidence

Failed Control Tests

Assessment tests

New
ParentControlControl codeTested atSample sizeException count
ASS-24797CNT-5607CC-19507 Oct703
ASS-99795CNT-2572CC-34110 Oct704
ASS-13464CNT-3701CC-21521 Oct32016
ASS-82955CNT-1307CC-94522 Oct9404
ASS-37239CNT-3156CC-93504 Oct8009
6 of 6 records
CC-195Assessment tests · AT-30762
Fail
ParentASS-24797
ControlCNT-5607
Tested at07 Oct
Sample size70
Exception count3
Example screen with sample data

What you can do

Keep the work connected

Assessment Tester records a result on a linked test line: test date, sample size, exception count, evidence reference and Pending, Pass, Fail or Inconclusive outcome. The control link and revision identify the work being tested. A pass requires an evidence reference, and the exception count cannot exceed the sample size. Attachments on the assessment carry a title, type, upload date, uploading person and Internal or Shared visibility.

Test lines keep the sample and result together. Attachments preserve files at the assessment level. The Operations Overview gives the team an exception queue for failed tests and failed operations.

How the work is organized

  • Ownership. The named person on a record is responsible for its next operational step.
  • Working state. The recorded state tells colleagues whether preparation, review or follow-up is due.
  • Evidence trail. Related records remain attached to the assessment or control that explains them.

What to agree during setup

Agree how evidence references are named and which files can be marked Shared. Define when a result is Inconclusive, so missing evidence is not recorded as Pass. Review what a tester may correct after submission and how the original operation is recognized on retry. Before sharing client material, confirm that attached files match the intended visibility.

In the pilot, choose a real operating period and a small set of named people. Check their membership and duties before entering historical material. Review who may see Internal evidence and who makes the independent decision. Agree how corrections are explained so the next reviewer can follow the record without relying on a private conversation.

Check the handoff on an actual case

Assessment Tester samples project access removals. One account remained active, so the tester records the sample, one exception, a Fail result and its evidence reference. The related file stays Internal until Assessment Owner reviews it for sharing. The failed result appears in the exception list and can lead to a finding. Rehearse a pass with no evidence and an exception count above the sample; both must be refused.

Have the receiving role open the record rather than relying on a summary sent outside the app. Check the selected organization, owner, dates and links to related work. If the case is returned, record a reason and leave the next action visible. This rehearsal should expose unclear authority before the team uses the same pattern across more engagements.

What your team sees

  • Failed Control Tests — Review failed and inconclusive samples with their exception counts and references.
  • Evidence by Visibility — Check which assessment files are Internal or Shared before delivery.

Follow the work through

Follow the related process and use roles to check the handoff between people.

What it keeps track of

Data model
Assessment tests
Individual control tests executed under an assessment.
Record attachments
Evidence files attached to an assessment with a visibility scope.
Assessments
Scoped assessment engagements driven through a status lifecycle.
Controls
Controls that mitigate a risk and are executed by a named owner.
Operation receipts
Idempotent execution receipts for guarded operations on assessments.

Who uses it

Permissions
Assessment Tester
, Assessment Owner, Independent Reviewer

Set up Professional Services GRC your way.

Start free, then use Proto to change fields, steps and approvals before your team goes live.

How to get started