These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Policy Management System
- Process
- Assessment and testing
Assessment and testing
Define the period, select controls and record test evidence.
Step by step
-
Scope assessment Control Owner
The Control Owner names the organization, business unit, period, owner and scope, then plans the testing volume. The assessment starts as a draft and becomes planned when that scope is ready.
- Sets period and planned scope
- Updates Assessments, Organizations, Business units
-
Link risks and controls Control Owner
The Control Owner confirms the unit risk, its scale version and the active control that will be tested. Each control has an owner and effective date.
- Establishes risk, control and ownership
- Updates Risks, Controls, Team members
-
Test controls Assigned Tester
The Assigned Tester records individual results with sample size, exception count, date and evidence reference. The assessment moves into testing while this work is underway.
- Saves results and evidence
- Updates Assessment tests, Record attachments
-
Record findings Control Owner
The Control Owner opens a finding for failed scope, including its severity and a link to the assessment and control. The original test result stays available for review.
- Opens tracked exceptions
- Updates Findings, Assessment tests
Who does what
Roles and permissions- Control Owner
- , Assigned Tester, Independent Assurance Reviewer, Auditor.
Set up Policy Management System your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.