First Time Doing a Compliance Assessment? Don't Start With the Raw Regulations

I compared a compliance intelligence system with the team's old spreadsheet-plus-manual approach, and actually ran through it once. The main difference is how you get started on the first assessment.

Our business spans several regions, and cross-border data has always been watched by humans. Last week I fired up the compliance intelligence system to see if I could move this thing out of people's heads and into the system. Below is the full path I tested out. Assuming you've never touched this kind of tool, just follow along.

From an empty assessment to a generated checklist

Open the system, and there's an Assessments column on the left. Click in, it's empty. There's an Add Assessment in the top right — that's the starting point.

After you click it, it asks you to pick a regulation template. There's a number here that stuck with me: the system ships with roughly 360+ ready-made templates, covering different industries and regions. A newbie's first instinct is usually to check everything they can. I almost did that too at first.

Ask yourself one question first: if regulators came asking tomorrow, which one item would you be most afraid of not being able to answer? Just pick that one. For us, we chose the one related to cross-border data. After picking, click Next.

Then the system asks you to fill in basic org info — size, industry, main business regions. Fill this in honestly; it's what it uses later to decide which controls apply to you.

Confirm after filling in, and the system starts generating the assessment. About tens of seconds later, a checklist pops up on the page, with anywhere from dozens to over a hundred items depending on template size. Each item is called a control, which in plain language means one thing this regulation requires you to do.

Controls need evidence attached

Open the assessment details and you'll see a column of controls, each with a status hanging off it, defaulting to Not Assessed.

The easiest place for a newbie to go off track is here: you feel like you've done it, so you click Satisfied, then move to the next question. I clicked a few like that at first too, then realized it doesn't work. Click open each control, and besides its description, there's a corresponding remediation action. You need to do three things:

1. Determine status. Satisfied, Partially Satisfied, Not Satisfied, Not Applicable — pick one of four.

2. Attach evidence. Upload your policy docs, process screenshots, config records — the entry point is Add Evidence on the detail page.

3. Assign an owner. Each one can be pinned to a specific person.

The third one is the easiest to overlook, but it's where the whole thing either lands or doesn't. From what I tested, one control done seriously takes about five to ten minutes, so don't pick a big template the first time — a few dozen is enough to fill a whole day.

Once everything's filled in, go back to the assessment overview. The system gives a score based on completion, and pulls out the Not Satisfied and Partially Satisfied ones to form a remediation checklist. This checklist can be exported and assigned by owner. I exported it and sent it to colleagues in security and legal. Their feedback was that it's clearer than the spreadsheet we wrote ourselves, because each item traces back to a specific regulatory requirement.

One colleague said something I quite agree with: the score is secondary — what it really forces you to answer is who did what and when.

Two pits I fell into

First pit was being greedy. The first time I wanted to cover all regions, piled up to hundreds of assessment items, filled for two days without finishing, and the team started getting annoyed. Later I cut it down to one regulation and wrapped it up in three days.

Second pit was nobody claiming anything. The first version of the assessment I filled in myself — looked beautiful, but nothing was pinned to anyone. Later I redid it, pinned an owner to each item. Progress was slower, credibility was higher.

Pinning a person to each item matters more than filling fast.

Next you can try two things. One, make this regulation's assessment a fixed quarterly review action, and see whether the system prompts you to re-assess after the regulation updates. Two, hook the remediation checklist into your existing ticketing system, so remediation items become tasks directly instead of stopping at an exported file.