Engagement reports
Both Compliance and Risk produce a per-engagement report on screen, with Excel and PDF export of the same numbers.
- Compliance → Reports
- Risk Management → Reports → Engagement
Pick an engagement from the selector; the report loads beneath it.
What a compliance report shows
Assessment status — controls done, in review, not started, and coverage percentage. Completion counts controls signed off by both preparer and reviewer.
Compliance profile — the compliance rate, status distribution and maturity.
Sign-off chain — how many controls have been prepared, reviewed, approved.
Evidence — files held and how many controls carry any.
Domain breakdown — weakest domains first.
Findings — everything raised, with overdue flagged.
What a risk report shows
Identity and scope, assessment coverage, the risk profile (average inherent, assessed and residual, plus the reduction), appetite breaches, response mix, the full risk table, control coverage, treatments and scoped assets.
Reading the numbers honestly
Two conventions matter, and both exist to stop the report flattering you.
The compliance rate is over controls actually assessed — not over the whole framework. Assessing one control, finding it compliant, gives 100% at 1% coverage. The rate is always shown next to coverage for this reason: a high rate over a thin sample is not an achievement.
Averages skip what has not been scored. An unassessed control is not counted as zero maturity, because "not looked at" and "looked at, found nothing" are different findings. The number of controls behind each average is printed alongside it.
Excel and PDF exports are generated from the same data as the on-screen report, so a figure you quote from the screen will match the file you attach to it.