Running an assessment

An engagement is one assessment of one framework over a period. This is the core compliance workflow.

1. Create the engagement

Compliance → Assessments → New Engagement

Field	Notes
Name / Name (Arabic)	What you will recognise it by later, e.g. "2026 Annual Assessment".
Framework	Cannot be changed afterwards — the control set is copied in at creation.
Project	Groups related engagements.
Planned start / end date	The intended window. Actual start and due dates are set on the engagement's Edit page and drive the overdue indicators.
Team	Who prepares, reviews and approves. Sign-off buttons only appear for people holding that role here.

On save, a workpaper is created for every assessable control in the framework. A large framework produces hundreds; this is expected.

Carrying last year's work forward

The wizard can start the engagement from a previous one on the same framework (sometimes called a rollforward). You choose what carries over:

• Maturity ratings (the wizard's wording) — both effectiveness axes, the compliance conclusion and any not-applicable justifications travel with them. A carried grade arrives in progress, ready to review and sign off; a control that was never graded last year arrives ungraded.
• Observations — last cycle's narrative, as a starting point to revise.
• Open findings — carried into the new engagement with a link back to the original and an audit-trail entry. Each carry stamps the finding's period and its repeat count, so a finding that has survived two cycles wears a Repeat ×2 badge wherever it appears. If the source engagement is completed, its copy of the finding is marked superseded — frozen, hidden from the observations list by default, pointing at its successor. If the source is still live, the finding is copied and both stay open: closing the original would remove it from its own engagement's completion gate. A cancelled engagement cannot be rolled forward and is not offered as a source; the wizard defaults to the most recent completed engagement, and says which of the two behaviours the one you pick will have.
• The team — the same preparers, reviewers and approvers.

Nothing else moves. Evidence, sign-offs, review notes, status and dates all start fresh: last year's attestation does not carry into this year's record.

2. Assess each control

From the assessment list, Assess opens the first control; inside an engagement the button reads Continue Engagement and takes you to the next unstarted workpaper. Each control has its own workpaper.

The control list has two views — grouped by domain, or as a hierarchy — plus filters for status and maturity. Use Prev / Next inside a workpaper to walk the framework without going back to the list each time.

Effectiveness is graded on two independent axes, each on a 0–5 scale:

• Design effectiveness — is the control designed to work?
• Operating effectiveness — is it actually operating?

The two scales read left-to-right — 0 to 5 — in both languages, because a scale is a magnitude, not text; the labels around them follow the page direction. Use the arrow keys to move along a scale, Home and End to jump to its ends.

A fresh workpaper shows both scales as not graded. That is a real state, not a zero: nothing is recorded until you choose a level on each axis, and typing an observation does not grade anything. Once both axes are set, the overall maturity is the more conservative of the two — a perfectly designed control that nobody follows is not a mature control, and the platform will not let the design score flatter the result.

A grade can also be withdrawn. Click the level you already chose, or use Clear next to the reading, and the axis goes back to not graded. Doing so withdraws everything derived from the grade: the overall maturity, the date it was graded, and the suggested conclusion if you were still using the suggestion. This is how you correct a grade entered on the wrong row without leaving a judgement behind that nobody made.

Compliance status is your conclusion: compliant, partially compliant, non-compliant, or not applicable. The platform suggests one from the grades (0–1 non-compliant, 2–3 partially compliant, 4–5 compliant) and keeps the suggestion in step as you regrade. The moment you pick a status yourself it becomes your call: the suggestion stops steering, your choice is what is saved, and it stays saved when you or a colleague open the workpaper again. The line under the field says which of the two applies, and offers one click back to the suggestion.

Not applicable needs a justification

Marking a control not applicable requires a written reason. Scoped-out controls are excluded from the compliance rate, so a regulator will ask why — the justification is what you show them.

Observation is your narrative — what you looked at and what you concluded. It supports Markdown, and the word count sits under the box.

Drafting an observation from your evidence

Off until your organisation turns it on

This feature is disabled by default and the button does not appear. An organisation administrator enables it under Settings → AI assistance, where the exact list of what would be sent to the model is shown before the decision is made. Enabling or disabling it is recorded in the audit trail.

If your instance is configured with a local model, that text stays inside your network. With a hosted model it is processed by a third party. The settings page tells you which applies to your instance.

Draft from evidence writes a first draft for you. It reads what the workpaper already holds — the control's requirement, both effectiveness grades, your compliance conclusion, the evidence you attached and any evidence you requested — and produces a paragraph naming what was examined and why the grade follows.

Two things to know about what it can and cannot see:

• It reads the evidence record, not the files. Titles, your descriptions, versions and dates. It cannot open a PDF. If you want the draft to reflect what a document actually says, put that in the evidence description — the draft will use your words and attribute them to you.
• It never saves. The text lands in the box for you to edit, and nothing is written until you save. The observation is your attestation, not the platform's.

The draft is unavailable once the workpaper is signed off or the engagement is closed, for the same reason the other fields are: there would be nowhere to save it.

If nothing is attached

Asked to draft with no evidence on the workpaper, it will say so and describe what would be needed to support the grade you gave, rather than inventing a document.

3. Attach evidence

Upload files against the control. Each is stored with a SHA-256 checksum computed by the platform over the bytes it actually saved, so the file can be verified later against the record.

Executables (.exe, .dll, .msi, scripts, .jar, batch files) are refused at upload. HTML, XML and SVG are accepted — a scanner export or an architecture diagram is legitimate evidence — and every download is served as an attachment rather than rendered in the browser, which is what makes stored content safe regardless of its type. On every download the platform re-hashes the bytes it serves and compares them with the stored checksum; a mismatch is refused and recorded in the audit trail.

Upload once, link many

An artefact rarely evidences a single control — a SOC 2 report or a penetration test speaks to a dozen. Link existing on a workpaper searches the organisation's evidence library (every upload, across every engagement) and attaches the chosen file to this control without copying it. A linked item shows where it lives (Linked from A.5.1) and can be unlinked; the original stays where it was uploaded. Linking is subject to the same locks as uploading: the engagement must be open and the workpaper not signed off.

Freshness and versions

When you upload, you can record when the evidence was collected and until when it is valid (a report's period end, a certificate's expiry). Once the validity date passes, the nightly job flags the item stale and the workpaper shows it with an amber badge — the file is neither hidden nor removed. Upload a new version from the item's row to replace it: the earlier file is retired from the library and the version chain stays visible from either end.

Version history on the item's row opens the whole chain — every version, who uploaded it, when, its size and its integrity hash — and any version can be downloaded. This is the answer to an auditor's usual question: what did this document say at the time it was signed off? The history is read-only. A superseded document is a point-in-time record, so it can be read but never edited or reinstated; to go back to an earlier document, upload it as a new version.

Asking someone else for evidence

You will not hold every document yourself. Evidence requests put the ask on the person who does:

1. On the engagement, open Evidence requests and raise one: what you need, who owns it, and by when.
2. That person sees it under My Evidence Requests on their My Findings page and attaches a file or a link — they do not need permission to edit the engagement itself.
3. You review the submission and mark it received, or cancel the request with a reason if you no longer need it. The person the evidence was asked from never judges it: if an assessor is themselves the assignee, another assessor marks it received or rejected.
4. Reject appears once a request has been received. If the document turns out to be the wrong one, reject it with a reason the assessee will see — the request goes back to them rather than being quietly reopened. A pending request is received first, then rejected; there is no way to reject something that has not arrived.

Requests go overdue on their own, remind the assignee before the date, and appear in the daily digest. Send reminder chases an outstanding request now (once an hour at most). Extending a request's date un-lapses it.

4. Raise findings

Where a control falls short, Add Finding. Record severity, root cause, risk and recommendation. Findings have their own remediation lifecycle and appear under Observations — see Findings and remediation.

Raising a finding requires the manager role; analysts assess controls and attach evidence but do not open findings.

5. Sign off

See Sign-off. A control is only complete once it has been prepared and reviewed.

Measuring against a target

Grading maturity tells you where you are. Gap analysis tells you how far that is from where you need to be — see Gap analysis and snapshots.

Finishing the engagement

Complete closes the engagement, but only when four things hold:

1. At least half the in-scope controls are done. Not-applicable controls are out of scope and are not counted against you.
2. Every control marked priority 1 in the linked target profile is done.
3. No review notes are still open.
4. No critical findings are still open.

If any fail, the platform lists exactly which — completion is never refused without saying why.

Completing writes a gap-analysis snapshot in the same moment, and the engagement becomes a closed record: its workpapers, evidence, findings, team and dates stop accepting changes, and it cannot be deleted.

On hold pauses an engagement without closing it. Cancel ends one that will not be finished; a cancelled engagement is closed in exactly the same way as a completed one, and can be restarted as a draft. Cancelling needs a manager — it freezes every workpaper, finding and evidence request without the completion gate, so the analyst working the engagement cannot end it alone.

Reopen returns a completed engagement to in progress when something has to change, and Restart returns a cancelled one to draft. Both need a manager: they unlock every workpaper, finding and review note on an attested record, which is a bigger decision than the forward path an analyst drives. Reopening is recorded, the completion date is cleared, and the snapshot taken at completion stays — you can always see what the engagement said when it was closed.

Status, and why you cannot set it

A workpaper's status moves by itself:

Status	Set when
Not started	Created with the engagement.
In progress	You save any content on it.
In review	The preparer signs off.
Done	The reviewer signs off.

There is no status dropdown, deliberately. Status reflects what has actually happened in the sign-off chain, so it cannot be set to "done" by hand without the review really occurring.

Once a workpaper reaches in review or done it is closed to edits. A reviewer's name sits against specific content, so changing that content needs the workpaper returned for rework first. The same applies to the Excel import, which skips signed-off rows and tells you how many it skipped.

Importing from Excel

Import accepts the same workbook the export produces, matching rows by control reference. It fills the two effectiveness axes (columns named Design and Operating), the compliance status, and observations. A sheet that carries only a single Maturity column grades both axes the same. Status stays server-owned, so a spreadsheet cannot sign anything off — a graded row starts its workpaper, nothing more.

Two rules the import applies exactly as the screen does:

• Not applicable needs a justification. A row marked N/A without at least ten characters in a Justification column is refused, and the import report names the row. Every scoped-out control leaves the completion and compliance denominators, so none may leave them silently.
• Signed-off rows are skipped, and the report says how many.