PRACTICAL GUIDE · DRAFT FOR REVIEW
Preparing for your first assessment
Use these questions to structure an initial conversation. The right approach depends on your organisation and the engagement.
What is the assessment for?
Start with the business requirement and the intended audience for the result. Customer assurance, contractual obligations and certification can lead to different scopes.
What is included?
Map the services, systems, people and suppliers that may need to be considered. Ask the assessor to explain boundaries and dependencies.
Who owns the evidence?
Identify the colleagues who understand each process. Assign responsibility for gathering and reviewing documentation.
What is the starting point?
Share previous findings, open risks and recent changes. A realistic view helps define a useful engagement.
What happens afterwards?
Agree how findings will be explained, who will own remediation and what further review may be needed.