How an assessment works in practice
An assessment begins with activating a framework. Sightadel then creates all controls as questions, grouped by the topics of the standard. Before anyone answers the first question, a little planning pays off: who is responsible for the assessment, by when should it be completed, and who contributes answers to which chapters? You enter the responsible person and the due date directly in the assessment so that they are visible to everyone involved.
It has proven useful to proceed chapter by chapter rather than jumping across the standard. Start with the topics that form the foundation, such as policies, roles and responsibilities. Many later controls build on them. Specialist chapters such as access control, operations or suppliers are handled by the people who know them. Through the roles, colleagues and consultants work in the same assessment.
You do not have to finish everything in one go. Progress is saved, and a button takes you to the first unanswered control at any time. For an extensive framework such as ISO 27001, expect weeks rather than days, because many questions require a decision or a conversation within the organisation. Only once all control questions are answered can the assessment be submitted.
Good answers: concrete, evidenced, honest
An answer in the assessment is a statement about your organisation that someone will check later. It should therefore describe what is actually practised, not what is planned or desired. Choose the answer options that apply and use the comment field for context: which process is meant, who is responsible for it, since when it has applied.
Every answer needs evidence. This can be a policy, a record, a screenshot of a setting or an extract from a ticket system. Link the evidence directly to the control from the evidence archive. If it already exists for another framework, link it again instead of uploading a copy.
“None” is a valid answer. It shows a gap, and a gap becomes an action plan with an owner and a deadline. In the audit, that is far better than an embellished answer without proof. For “n/a”, the rule is: only use it if the control genuinely does not apply to you, and always give a reason in the comment. A company without its own software development can, for example, exclude controls on secure development, but must explain how it handles purchased software.
What auditors look for
A certification audit has two stages. In the first, the auditor reviews the documentation: is the management system described, are the scope, roles and the Statement of Applicability in place? In the second, they check whether what is described is actually practised. They talk to employees, look at records and take samples.
For the assessment, this means: the auditor does not read your answers as a self-declaration but as a starting point for questions. They pick a control and want to see the proof, then a second one. The more clearly answer, comment and evidence fit together, the shorter these conversations become.
Pay particular attention to three points. First, currency: evidence from three years ago does not prove today's situation. Second, justifications for exclusions. Third, contradictions, for example when an answer describes a monthly process but the evidence shows only a single date. In Sightadel the auditor gets a role of their own. They see answers and evidence in context, add comments and – once you approve – create or edit entries. They can never delete anything.
Common pitfalls
The most common pitfall is treating the assessment as a form to fill in as quickly as possible. If you choose the best option everywhere, you end up with a good result on screen and a problem in the audit. The value of the assessment lies in spotting gaps early, while there is still time to act.
A second pitfall is a lack of responsibility. An assessment that belongs to everyone gets worked on by no one. Appoint a responsible person, set a realistic due date and assign specialist chapters to the people who know them.
Third, the scope is often clarified too late. Whether a site, a subsidiary or a particular service is included changes the answers to many controls. Clarify this before you start, with advice if in doubt.
Finally, a submitted assessment is a snapshot. Measures change, evidence expires, people move on. Plan the assessment as a recurring task, for example annually before the internal audit, and keep the evidence up to date through its validity dates.
