3 Assessing Compliance Free Online FlashCards

What information belongs in an obligations register?

An obligations register records applicable requirements, their sources and scope, responsible owners, related processes, and the date each was last reviewed.

How should an assessor handle an uncertain requirement interpretation?

Confirm uncertain interpretations with appropriate legal or subject-matter experts; do not present an uncertain interpretation as settled fact.

What is a compliance control?

A control is a policy, procedure, activity, or mechanism that helps prevent, detect, or correct noncompliance.

What factors help prioritize obligations and controls by risk?

Consider likelihood and impact of noncompliance, organizational exposure, past incidents, changes in operations or requirements, and the strength of existing controls.

What are NIST’s three assessment methods?

NIST groups assessment methods into examine, interview, and test. A sound conclusion often uses more than one method.

What makes evidence suitable for a compliance assessment?

Evidence should be relevant to the assessment question, reliable enough for its intended use, and sufficient to support the conclusion.

How should an assessor address limited or uncertain evidence?

Compare records with underlying records or observations where practical. If important evidence is limited or uncertain, do more work or clearly qualify the conclusion.

What can an interview establish—and what can’t it prove alone?

Interviews show how people understand a process and can identify records or risks to investigate, but a person’s account alone does not prove consistent control operation.

How do control design and control operation differ?

Design asks whether the control could address the risk if performed as intended; operation asks whether it was actually performed by the right person, at the right time, with appropriate follow-up.

What is a key limitation of a targeted sample?

A targeted sample can help identify weaknesses, but it should not automatically be treated as representative of the whole population. Statistical conclusions require an appropriate sampling design.

What should an assessor establish and document when sampling?

Define the population and period, check that the population listing is sufficiently complete, and document the selection method, sample size, coverage, and limitations.

When is “unable to conclude / not assessed” appropriate?

Use “unable to conclude / not assessed” when evidence or access is insufficient, or when the item is outside the assessment scope.