Policy Experts / Assessment

What an assessor is actually testing

Existence, currency, approval, and whether it is followed.

External assessment of policy generally proceeds through four questions, and it is worth knowing them because organisations prepare for the first two and are found on the last. Does the document exist. Is it current and approved. Does it address what it is supposed to address. And is there evidence that it is being followed.

The fourth question is answered from records rather than from the document: completed forms, dated decisions, training records, minutes. An organisation with an excellent policy and no evidence of it operating is in a weaker position than one with a modest policy and a full record.

This suggests where preparation effort should go, which is nearly the opposite of where it usually goes. Rewriting documents before an assessment is comfortable and low yield. Assembling the evidence that they operated, and identifying where that evidence does not exist, is uncomfortable and is what determines the result.

Where evidence is missing for a past period it cannot be created afterwards, and attempting to is a far more serious matter than the original gap. The correct response is to record the gap, state what has changed, and demonstrate the control operating from now.

The order of preparation follows from this and is nearly always reversed. Assembling the evidence first identifies which controls are actually demonstrable, and the documents can then be adjusted to describe what can be shown. Starting with the documents produces a well presented set of claims and a scramble for evidence in the final week, which is when the temptation to create records appears.