Back to Assessments & Documents
Technology Governance and Strategy Active

IT Compliance and Control Assurance Maturity Assessment

A 57-question diagnostic across 8 domains that evaluates whether the organization knows every technology obligation, has controls mapped to it and can prove those controls work before an auditor or regulator asks. Writte...

Start Assessment

Overview

A 57-question diagnostic across 8 domains that evaluates whether the organization knows every technology obligation, has controls mapped to it and can prove those controls work before an auditor or regulator asks. Written for the head of IT compliance, the CIO and the audit committee who need to answer: are we compliant, and can we show it?

Detailed Description

Many organizations meet each audit and inspection as a separate event: a scramble for evidence, the same control tested three times by three parties, findings that close on paper and reappear next year, and a board that learns of a significant gap from the regulator. Obligations sit in several registers that disagree, nobody can show which control meets which requirement, and AI tools and agents now act on controlled systems without anyone testing them. This assessment follows the order in which a second-line compliance program is built: the policy, roles, independence, forum, competence, plan and the rules for AI in compliance work; one register of obligations, applicability, risk rating and regulatory change; the map from obligations to controls, key controls, procedures, shared and AI controls, rationalization and exceptions; evidence, the compliance platform, automated evidence, continuous monitoring, self-assessment challenge, monitoring reviews and investigations; risk-based testing, independence, design review, sampling and full-population analytics, reliance on other assurance, reporting, deficiency rating and retest; one coordination procedure for audits and inspections, action plans, regulator commitments and engagement, certifications and audit safeguards; supplier, AI and cloud provider assurance, own assurance reports, customer answers, attestations and outsourced assertions; and submissions, metrics, board reporting, management review, independent review, peer lessons and improvement. It is the compliance deep dive of the Technology Governance family. The hub, Technology Governance and Strategy, sets direction and receives the compliance view; IT Risk Management holds the control library and issues register; Enterprise Risk Management holds the rating method and combined assurance; AI Governance holds AI controls; internal audit keeps its own engagement rules and reviews this program independently.

Assessment Details

Audience

Head of IT compliance, CIO, audit committee. Secondary: control owners, legal and regulatory affairs, vendor management, internal audit, chief risk officer and external auditors.

Purpose

Shows where obligations are unknown or unmapped, where controls are tested twice or not at all, where evidence cannot be produced on demand, where findings close without proof, where AI systems and agents sit outside control testing, where provider assurance is filed but not read, and where the board learns of compliance issues from others. Gives a prioritized path to a program that proves compliance continuously.

Effort

Initial assessment: 5 to 7 hours of facilitated sessions with the head of IT compliance and testers, control owners from operations, security, cloud and AI, legal and regulatory affairs, vendor management, internal audit and an executive sponsor. Evidence gathering: obligations register, control map, testing methodology and workpapers, evidence repository, issue and finding records, audit and inspection logs, certification records, supplier assurance reviews and board reports.

Cadence

Yearly, before the audit and certification cycle, and after a major regulatory change, a significant audit or inspection finding, a new market or legal entity, or the adoption of AI agents that act on controlled systems.

Framework Alignment

ISO 37301:2021 COBIT 2019 COSO Internal Control Integrated Framework (2013) IIA Three Lines Model IIA Global Internal Audit Standards 2024 ISACA ITAF ISO 19011:2026 ISAE 3402 ISAE 3000 (Revised) AICPA Trust Services Criteria NIST SP 800-53 Rev 5 NIST SP 800-53A Rev 5 CSA CCM v4.1 NIST OSCAL v1.2 ISO/IEC 27001:2022 ISO/IEC 42001:2023 NIST AI RMF 1.0 NIST CSF 2.0 COSO ERM 2017 ISO 37002:2021 APQC PCF

KPIs

  • Deficiencies First Raised by Regulators or External Auditors - Share of deficiencies and breaches first raised by a regulator or external auditor rather than by the organization. Target: 10% or fewer (model target).
  • Mapping Accuracy on a Re-performed Sample - Share of sampled obligation-to-control links an independent re-performance confirms. Target: 95% or more (model target).
  • Control Failures First Found by Monitoring - Share of key control failures first detected by monitoring or the owner rather than by testing, audit or a regulator. Target: 70% or more (model target).
  • Closed Deficiencies That Fail Again - Share of deficiencies closed after retest that fail again on the same control within 12 months. Target: 5% or fewer (model target).
  • Audit Actions Overdue without an Approved Extension - Share of audit and inspection actions past their due date at quarter end without an approved extension. Target: 5% or fewer (model target).

Dependencies

Technology Governance and Strategy (v10.9.6): Technology Policy Framework, Governance Decision Log, Technology Decision Rights Matrix, Board Technology Report (1.1, 1.4, 3.7, 8.3). Enterprise Risk Management (v7.9.6): Risk Roles and Accountability Matrix, Risk Assessment and Response Standard, Enterprise Risk Taxonomy, Key Controls Register, Combined Assurance Map (1.2, 2.3, 3.2, 4.5, 5.5, 8.5). AI Governance (v11.9.6): AI Policy and Responsible AI Principles, AI Regulatory Obligations Register, AI Control Framework and Statement of Applicability, AI Agent Governance Standard, AI Governance Assurance Program (1.7, 2.1, 3.5, 4.4, 6.6, 7.2). Security Operations Center Cyber and Incident Response (v8.9.6): Security Regulatory Obligations Register (2.1, 8.1). Data Governance and Management (v1.9.6): Data Obligations Register (2.2). IT Risk Management (v7.9.6): IT Control Framework, IT Issue and Exception Register (3.1, 3.3, 3.6, 3.7, 4.6, 5.6, 5.7, 5.8, 6.3, 7.5, 8.2, 8.5). Hire to Retire (H2R) End-to-End HR (v9.9.6): Speak-Up Procedure (4.7). Service Integration and Management (SIAM) (v6.9.6): Supplier Risk and Compliance Register, Supplier Management Policy (7.1). IT Performance Management (v6.9.6): KPI Catalog (8.2). Continual Service Improvement (v8.9.6): Continual Improvement Register (8.4, 8.7).

Assessment Outline

(8 domains · 57 questions)
  1. 1

    1 Compliance Mandate and Governance

    The IT compliance policy and scope, compliance roles across the three lines, independence and resourcing of the compliance function, the IT compliance forum, compliance competence, compliance objectives and the annual plan, and AI used in compliance and assurance work

    • 1.1 IT Compliance Policy (Bridge) 1 questions
    • 1.2 Compliance Roles and Lines (Bridge) 1 questions
    • 1.3 Compliance Function Independence and Resourcing 1 questions
    • 1.4 IT Compliance Forum (Bridge) 1 questions
    • 1.5 Compliance Competence 1 questions
    • 1.6 Compliance Objectives and Annual Plan 1 questions
    • 1.7 AI in Compliance and Assurance Work (Bridge) 1 questions
  2. 2

    2 Obligations and Regulatory Change

    The consolidated obligations register and its feeder registers, applicability by entity and jurisdiction, compliance risk rating, horizon scanning, change impact assessment, implementation to effective dates and the regulatory interpretation record

    • 2.1 Consolidated Obligations Register (Bridge) 1 questions
    • 2.2 Applicability and Entity Scoping (Bridge) 1 questions
    • 2.3 Compliance Risk Assessment (Bridge) 1 questions
    • 2.4 Regulatory Horizon Scanning 1 questions
    • 2.5 Change Impact Assessment 1 questions
    • 2.6 Implementation to Effective Dates 1 questions
    • 2.7 Regulatory Interpretation Record 1 questions
  3. 3

    3 Control Mapping and Design

    The obligation-to-control map over the IT control library, key control scoping including technology general controls, control operating procedures, inherited and shared controls, AI systems and agents in control scope, control rationalization and compliance exceptions

    • 3.1 Obligation-to-Control Map (Bridge) 1 questions
    • 3.2 Key Control Scoping (Bridge) 1 questions
    • 3.3 Control Operating Procedures (Bridge) 1 questions
    • 3.4 Inherited and Shared Controls 1 questions
    • 3.5 AI Systems and Agents in Control Scope (Bridge) 1 questions
    • 3.6 Control Rationalization 1 questions
    • 3.7 Compliance Exceptions (Bridge) 1 questions
  4. 4

    4 Evidence and Continuous Monitoring

    The evidence standard and repository, the compliance platform and control data, automated evidence integrity, continuous control monitoring including agent actions, challenge of control self-assessments, compliance monitoring reviews and noncompliance investigation

    • 4.1 Evidence Standard and Repository 1 questions
    • 4.2 Compliance Platform and Control Data 1 questions
    • 4.3 Automated Evidence Integrity 1 questions
    • 4.4 Continuous Control Monitoring (Bridge) 1 questions
    • 4.5 Control Self-Assessment Challenge (Bridge) 1 questions
    • 4.6 Compliance Monitoring Reviews (Bridge) 1 questions
    • 4.7 Noncompliance Investigation (Bridge) 1 questions
  5. 5

    5 Control Testing

    The risk-based testing plan, tester independence and competence, control design review, test procedures, sampling and full-population analytics, reliance on other assurance, test results reporting, deficiency rating, aggregation and escalation, and remediation with retest before closure

    • 5.1 Risk-Based Testing Plan 1 questions
    • 5.2 Tester Independence and Competence 1 questions
    • 5.3 Control Design Review 1 questions
    • 5.4 Test Procedures, Sampling and Full-Population Analytics 1 questions
    • 5.5 Reliance on Other Assurance (Bridge) 1 questions
    • 5.6 Test Results Reporting (Bridge) 1 questions
    • 5.7 Deficiency Rating, Aggregation and Escalation 1 questions
    • 5.8 Remediation and Retest (Bridge) 1 questions
  6. 6

    6 Audits, Inspections and Certifications

    One coordination procedure for internal audits, external audits and regulatory inspections with hand-offs to internal audit, inspection readiness, management action plans, regulator commitments, regulator engagement, the certification portfolio, surveillance and recertification readiness and safeguards during audit testing

    • 6.1 Audit and Inspection Coordination 1 questions
    • 6.2 Inspection Readiness 1 questions
    • 6.3 Management Action Plans (Bridge) 1 questions
    • 6.4 Regulator Commitments 1 questions
    • 6.5 Regulator Engagement 1 questions
    • 6.6 Certification Portfolio (Bridge) 1 questions
    • 6.7 Surveillance and Recertification Readiness 1 questions
    • 6.8 Audit Testing Safeguards 1 questions
  7. 7

    7 Third-Party and Customer Assurance

    Review of supplier assurance reports, AI and cloud provider assurance, the organization's own assurance reports, the customer assurance program, management control attestations and outsourced compliance assertions

    • 7.1 Supplier Assurance Report Review (Bridge) 1 questions
    • 7.2 AI and Cloud Provider Assurance (Bridge) 1 questions
    • 7.3 Own Assurance Reports 1 questions
    • 7.4 Customer Assurance Program 1 questions
    • 7.5 Management Control Attestations (Bridge) 1 questions
    • 7.6 Outsourced Compliance Assertions 1 questions
  8. 8

    8 Compliance Reporting and Improvement

    Periodic regulatory submissions, compliance indicators, executive and board reporting, management review, independent program review by internal audit, lessons from peer enforcement and compliance improvement

    • 8.1 Regulatory Submissions (Bridge) 1 questions
    • 8.2 Compliance Indicators (Bridge) 1 questions
    • 8.3 Executive and Board Reporting (Bridge) 1 questions
    • 8.4 Compliance Management Review (Bridge) 1 questions
    • 8.5 Independent Program Review (Bridge) 1 questions
    • 8.6 Peer Enforcement and Lessons 1 questions
    • 8.7 Compliance Improvement (Bridge) 1 questions

At a Glance

Category Technology Governance and Strategy
Type Free
Roles 6
Domains 8
Questions 57
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance