Quick Tips for Assessments

Overview

This documentation covers the basic activities that assessors and verifiers need to do in order to complete their part of the assessment workflow.

Evaluating Assessments

Assessors evaluate the design and operating effectiveness of controls. Verifiers review the judgment of the assessors. Both see the same information with the exception of the buttons to complete their roles in the control assessment process. The next two sections describe the two views.

The Assessor's View

The person who performs the assessment is the assessor. It is mandatory to select at least one user for this role. It is possible to have multiple assessors, but any of these assessors can complete the assessment on their own.

The Verifier's View

If your workflow requires, you can assign a user to the optional Verifier field. This user reviews the assessment after the assessor clicks Complete Assessment. It is also possible to have multiple verifiers, but any of them can complete the analysis on their own.

View Control Information

Any assessment conducted on the control being assessed is available for view, no matter the audit. By reviewing conclusions made and evidence provided in other audits, an assessor can make a more informed decision on the effectiveness of the control.

The information is provided on a tab on the control itself. To access the information from an assessment, complete the following steps:

1. Click the linked control name. This opens the control.
   
   
   
   
2. On the control, click the Assessments tab. This provides a comprehensive list of active and completed assessments conducted on the control.
   
   
   
   
3. Click any Title link to open an assessment and view findings.
   
   

View All Other Information

To examine all applicable evidence and information located on the assessment card, complete the following steps:

1. Review the associated control's information.
   
   
   
   

2. Click the Design tab for a list of all objectives to which the control is mapped.
   
   

   TIP

   Only one control can be mapped to one assessment, but that one control can be mapped to objectives in multiple programs. The Design tab shows all the objectives to which the control being assessed is mapped. Reviewing that information allows you to compare the control against other regulatory requirements and may help with decision making.

   
   
   
   

3. Click the Operational Effectiveness tab to display all requests mapped to the assessed control.
   
   

   TIP

   The information in Operational Effectiveness makes it easy to review whether the evidence provided for other audit requests was satisfactory.

   
   
   
   

4. Click the Attachments tab to attach or review files. This is useful to attach any document during the assessment, such as workpapers.
   
   
   
   

5. To add hyperlinks to the request, click Click here to attach links.
   
   
   
   

6. Enter the URL in the Link text box and the name in the Title text box.

7. Click Add link.

8. Click the Comments tab to review or add information pertinent to the assessment.
   
   
      

Finishing the Assessment

1. After reviewing all available information, make selections in the two dropdowns with definitions as follows:
   1. Conclusion: Design – Control language is appropriate and satisfies the objective.
      1. --- - No rating. The control has not been rated. The page defaults to this.
      2. Effective - The control's design works as intended.
      3. Ineffective - The control's design does not work as intended.
      4. N/A - Rating the design is not applicable or can't be done.
   2. Conclusion: Operational - Control is working effectively. If ineffective, create an issue and report finding that you can work on.
      1. --- - No rating. The control has not been rated. The page defaults to this.
      2. Effective - The control is operating as intended.
      3. Ineffective - The control is not operating as intended.
      4. N/A - Rating the operational effectiveness is not applicable.
         
         
         
         
2. Complete the assessment in one of the following ways:
   1. For an assessor, click Complete Assessment. This is the selection even if the conclusion for the design and/or operation is deemed ineffective. This sets the status to Submitted if there is a verifier or Completed if there is no verifier.
      
      
      
      
   2. For a verifier, click Verify Assessment. This is the selection even if the conclusion for the design and/or operation is deemed ineffective. This sets the status to Completed and shows that the control either is or is not effective. 
      
      
      
      
   3. Alternatively, click Decline Assessment to set the status back to Open. This notes that the information is incomplete and sends it back to the assessor. It does not close or complete the assessment.