Review a rule change

Step by step

1. Register rule change Control Owner

   The Control Owner records the organization, linked assessment, authority and source publication while the change is in draft.

   • Create a draft against an organization
   • Updates Rule changes 2, Organizations 2

2. Scope assessment Control Owner

   The owner confirms the business unit, assessment period and controls relevant to the publication.

   • Set owner, period and scope
   • Updates Assessments 2, Business units 2

3. Test controls Control Owner

   The team records test results, evidence references and any findings for the assessment.

   • Record results and issues
   • Updates Assessment tests 2, Findings 2

4. Review revision Independent Assurance Reviewer

   The Independent Assurance Reviewer examines the submitted revision and the supporting record.

   • Check the submitted revision
   • Updates Rule changes 2, Review decisions 2
   ApprovalA person approves before the work moves on.

5. Record decision Independent Assurance Reviewer

   The reviewer decides whether to approve, reject or return the revision. Check that the decision and reason are recorded against the assessment; inspect any operation result.

   • Preserve outcome and operation state
   • Updates Review decisions 2, Operation receipts 2

6. Complete implementation Control Owner

   The Control Owner records completion after the approved plan's work is finished.

   • Mark finished implementation
   • Updates Rule changes 2

Control Owner

Prepares and completes the case; Independent Assurance Reviewer makes the revision decision; Auditor reads the retained history.