3 Assessing Compliance

Purpose and assessment basis

A compliance assessment determines whether an organization has identified applicable obligations, designed controls to address them, and followed those controls in practice. It should produce evidence-based conclusions that help decision-makers understand gaps and prioritize corrective action. Control assessment also asks whether controls are correctly implemented, operating as intended, and producing the desired results.

Define obligations, scope, and priorities

Start by identifying the requirements that apply and establishing what the assessment will evaluate. Requirements may arise from laws, regulations, contracts, licenses, internal policies, or other commitments. An obligations register can record each requirement’s source, who or what it applies to, its responsible owner, related processes, and the date it was last reviewed. Confirm applicability with appropriate legal or subject-matter experts; do not treat an uncertain interpretation as settled fact.

For each obligation, identify the expected outcome and map it to the controls intended to achieve it. For example, if high-risk vendors must be screened before onboarding, relevant controls could include a screening procedure, a system block that prevents approval before screening, and periodic review of completed vendor files.

Set the assessment’s purpose, period, organizational and operational boundaries, locations or systems in scope, and reporting audience. State exclusions and limitations. Prioritize obligations and controls using risk: consider the likelihood and potential impact of noncompliance, organizational exposure, past incidents, changes in operations or requirements, and the strength of existing controls. Higher-risk areas generally warrant more extensive testing. Tailor the assessment plan to the organization’s risk-management needs and desired assurance.

Plan questions, procedures, and evidence

Translate each obligation into testable questions. For a vendor-screening requirement, questions might ask whether the control is appropriately designed to prevent onboarding before screening, assigned to a responsible role and supported by clear procedures, performed for applicable vendors during the assessment period, and supported by a process for identifying, reviewing, and resolving exceptions.

Build an assessment plan that links each question to the relevant control, procedure, evidence needed, responsible contact, and planned coverage. The assessment methods are examine, interview, and test. Examine documents or activities; interview people to clarify how a process works or locate evidence; and test a control by exercising it or comparing actual results with expected results. A sound conclusion often draws on more than one method.

Evidence should be relevant to the assessment question, reliable enough for its intended use, and sufficient to support the conclusion. Consider whether records are complete, accurate, current, and traceable to their source. For significant findings, corroborate evidence where practical, such as by comparing a system report with underlying records or observations. If important evidence is limited or uncertain, perform additional procedures or clearly qualify the conclusion. Assess evidence collectively, consider corroboration and assessment risk, and document the basis for findings and conclusions.

Examine, interview, and test

Review obligation descriptions, policies, procedures, training materials, system configurations, logs, approvals, exception records, and monitoring reports. Check whether documents are approved, current, consistent with actual practice, and specific enough to guide staff. Where possible, inspect original records or reliable system-generated evidence rather than relying only on summaries prepared for the assessment.

Speak with control owners, process operators, managers, and, when useful, people affected by the process. Ask open, neutral questions—for example, “Walk me through how a vendor is approved”—then follow up on roles, timing, exceptions, and evidence. Interviews can reveal how a process is understood and identify records or risks to investigate. A person’s description is evidence of their understanding, but does not by itself prove that the control operated consistently. Corroborate important claims with records, observation, or testing.

Choose a procedure that can establish whether the control worked during the period under review. Depending on the control, this could involve tracing a transaction from initiation through approval, reperforming a calculation, checking access settings, observing an activity, or examining exception handling. Test both control design and operation: determine whether the control could address the risk if performed as intended, and whether it was actually performed by the right person, at the right time, with appropriate follow-up.

Sample with clear limits

When a population is too large to inspect in full, define the population and period, verify that the population listing is sufficiently complete, and select items that address the assessment objective. Risk-based sampling may focus on higher-risk transactions, locations, time periods, or exception cases. Document the selection method, sample size, coverage, and limitations.

A targeted sample can help find weaknesses but should not automatically be treated as representative of the entire population. Statistical conclusions require an appropriate sampling design. Otherwise, describe results as applying to the items tested and consider whether more testing is needed.

For example, an assessor examining vendor screening might obtain the complete list of vendors onboarded during the period, verify its completeness, and select items across business units, months, and risk categories. For each item, the assessor could check screening evidence and approval dates, then compare those records with the system’s onboarding history. Investigate and evaluate any missing screening, late completion, or unexplained record difference against the control’s requirements.

Evaluate findings and follow through

Compare observed conditions with the stated obligation and control criteria. Classify the result for the assessed scope and period:

• Compliant: Evidence supports that the requirement was met.

• Noncompliant: Evidence establishes a failure to meet a requirement.

• Partially compliant: Some elements were met, but a material gap remains.

• Unable to conclude / not assessed: Evidence or access was insufficient, or the item was outside scope.

For each finding, document the criterion, condition, evidence, affected scope, and any known cause or contributing factor. Explain the risk or consequence without overstating what the evidence shows. A missing record may demonstrate a documentation weakness, but does not necessarily prove that the underlying activity never occurred. Record conflicting evidence and how it was resolved. Organize workpapers so another qualified reviewer can understand the procedures performed and the reasoning behind the conclusion.

Discuss factual accuracy with responsible personnel while preserving the assessor’s independent judgment. Report significant gaps promptly through the organization’s escalation process. Recommendations should address the underlying cause where possible and identify an accountable owner, planned action, and target date. Management should track corrective action and, for important findings, verify that it was implemented and effective. Compliance programs should be periodically tested, reviewed, and updated as risks change.

Connect the assessment steps

A reliable compliance assessment connects obligations to risks, controls, procedures, evidence, and conclusions. Define scope and criteria, prioritize testing by risk, combine document review, interviews, and control tests, and use sampling with clear limits. Document evidence and reasoning, report uncertainty honestly, and follow through to confirm that corrective actions work.