External verification.
WHY ORGANISATIONS PURSUE IT
Customer requirements Competitive differentiation Assurance that practice is adequate
WHAT IT INVOLVES
An external assessment against a defined standard.
WHAT ASSESSORS EXAMINE
Documentation Evidence that practices are followed Interviews with staff System configuration
WHY INTERVIEWS MATTER MOST
They reveal whether documentation reflects practice.
WHAT COMMONLY FAILS
Policies nobody has read Access reviews never performed Retention defined but not applied Training recorded but not delivered
WHAT TO DO BEFORE ANY ASSESSMENT
Check that each documented practice actually happens.
HOW
Sample: pick a claim and find the evidence.
WHAT TO PREPARE
The inventory Assessments Agreements Training records Incident register Rights request log Access review records
WHAT TO BE HONEST ABOUT
Gaps, with a plan.
WHY
Assessors respond better to acknowledged gaps than discovered ones.
WHAT TO ASSIGN
An owner for the process.
WHAT TO BUDGET
Time, more than money.
WHAT TO EXPECT
Findings, which is normal.
WHAT MATTERS AFTERWARDS
Whether you act on them.
