Assessments

An assessment identifies the organization, operating unit, owner and testing period. The subject and scope statement explain what the team is examining. Planned tests establish a target before the work starts; the revision records which version the reviewer later considers. A dated cycle makes it easier to compare testing evidence with the approved scope.

The Control Owner begins with a draft, names the responsible unit and moves the work into planning. During testing, the assessment gathers test results, findings, attachments and review decisions. Its status gives the team a shared way to see whether the work is being planned, tested, reviewed, remediated or closed. A reviewer should be able to follow the links from the assessment to the individual test and its evidence.

• Scope. Record the organization, unit, period and subject before committing to planned tests.
• Ownership. Assign one accountable team member so a review question has a clear destination.
• Revision. Preserve the revision used for a review decision and link later changes to a new cycle of review.

Choose the naming convention for assessment numbers and the meaning of a testing period. Decide who can move a draft into the planned state, how the planned test count is determined and when a revision is ready for independent review. Agree how approved scope changes are handled so the original accepted record remains understandable.

Use an initial cycle that has a real control owner and a small set of active controls. Set the start and end dates, the unit and the scope statement before entering test results. The schedule should make the work visible to the assigned tester and reviewer. The review queue should identify the exact assessment revision and owner.

Consider a quarterly assessment of one operating unit. The Control Owner records the period, names the unit and owner, and writes the scope. The Assigned Tester adds results for selected controls, including exceptions and evidence references. A failed result leads to a finding linked back to this assessment. The Independent Assurance Reviewer inspects the tested revision and either approves it or returns it with a reason.

If the work enters remediation, the same assessment remains the parent for actions, retests and receipts. The owner can explain what was planned, what was tested and what still needs follow-up without creating a disconnected policy history.

• Assessments by status — Active cycles grouped by their current working state.
• My assessments — The owner’s current assessment scope and dates.
• Assessment schedule — Planned and testing work across start and end dates.

See assessment and testing and independent review.