Evaluating the Control Assessment

There are two evaluation considerations that a Control Assessor needs to determine within a Control Assessment.

The outcomes of the Control Assessment directly impact the Audit Dashboard and Audit Overview reports within ZenComply.

The two considerations within a Control Assessment are:

CONTROL DESIGN EFFECTIVENESS

The Design effectiveness validates whether or not the control that is being assessed can fulfill the organization’s objectives for related requirements.

It is a determination of the organization to validate whether or not these controls are meeting the requirements.

For a Control Assessor, the design of a control can either be deemed Ineffective or Effective given the context of the Audit and Control Assessment in question.

CONTROL OPERATING EFFECTIVENESS

The Operating effectiveness validates whether or not the control that is being assessed is operating effectively by taking into account the design and the supporting evidence that was provided from the Evidence Request records.

For a Control Assessor, the operations of a control can either be deemed Ineffective or Effective given the context of the Audit and the Control Assessment in question.

OBSERVATIONS

In the event that either the design or operations of the control are ineffective, the system automatically shows a field called Observations.

The Control Assessor here provides a high-level summary on the issues identified from the ineffectiveness of the controls.

This field is not mandatory to be populated but gives a summarized view of the gaps identified from Control Assessment.

Control Assessors can go into further detail with Findings.

How do I Create Findings from Control Assessments?

Findings are record types that detail the specific gaps or inefficiencies identified from the Control Assessment, and also:

are mapped directly to Control Assessment records
are created from a related Control Assessment by the Control Assessor

Findings are managed by Control Assessors, who are required to complete the title, description, due date fields (expected review date).

To create a Finding, navigate to an assigned Control Assessment and click on the Create a finding button on the footer of the Control Assessment flyout.

After creating the first Finding, the related Finding table in the Control Assessment flyout is made available along with the plus ”+” button next to the Related findings records.

Insight & Helpful Tips

Program Managers and Control Assessors may monitor the status of Findings in ZenComply. To do so:

See the Audit Dashboard and Audit Overview reports.

What am I Viewing?

When a Control assessment is activated, the status will move to In Progress

The Control Assessor evaluates the effectiveness of the control in the Control Assessment

If a Finding needs to be created from this Control Assessment, it may be done from within the Control assessment flyout card and choosing the “Create a finding button” at the bottom

ZenGRC Wiki

Control Assessments: In Progress

Analytics

Glossary