What it means
Assessors use examine, interview, and test methods with defined scope, depth, evidence, and sampling. Findings should explain the condition, criteria, cause, risk, and recommended response.
Why it matters
Assessment provides decision makers with evidence about the actual control environment rather than relying on policy statements or self-attestation alone.
Practical focus
- Create an assessment plan before collecting evidence
- Match procedures to the control objective
- Preserve evidence and sampling rationale
- Validate corrective action before closing findings
Common mistakes
- Treating a checklist as an assessment
- Testing only the easiest systems
- Reporting observations with no risk context
- Allowing the control owner to be the sole assessor
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: