Assessment Workflow

Overview

Assessments in Asenion follow a structured workflow that tracks the status of each policy assessment from initial data entry through review, approval, and independent audit. This creates a reproducible, auditable record of who did what and when.

Assessment Statuses

Status Meaning
Not Started Assessment created but no controls answered yet.
In Progress One or more controls have been answered.
In Validation Submitted by a Contributor; awaiting review.
In Review A Reviewer has opened the assessment for structured review.
Waiting for Approval Review complete; awaiting Approver decision.
Approved Assessment approved. Contributes to the AI system’s current risk status.
Rejected Reviewer or Approver rejected the submission. Returned to the submitter for corrections.
Published Assessment made available as a reference version.
Archived Assessment closed and excluded from active reporting.

Workflow Steps

1. Complete controls (Contributor)

A Contributor answers the controls in each control bundle. Progress is shown as a completion percentage per bundle and across the full assessment.

Individual controls can be assigned to specific team members with a due date. Assigned members receive an in-app notification and appear in the task list on the dashboard.

2. Submit for review (Contributor)

When the assessment is ready, the Contributor submits it. The status moves to In Validation.

3. Review (Reviewer)

A Reviewer inspects the answers, evidence attachments, and risk status. They can leave comments on specific controls. The status moves to In Review.

4. Approve or reject (Approver)

The Approver makes the final call:

  • Approved — the assessment is accepted and the risk status it produces becomes the active record.
  • Rejected — the assessment is returned to the submitter with comments. The submitter corrects the answers and resubmits.

5. Independent audit (Auditor)

Separately from the approval workflow, an Auditor can conduct an independent audit against any approved assessment. Audit status is tracked independently and does not affect the review/approval status:

Audit Status Meaning
Not Audited Default; no audit has been initiated.
Under Audit Auditor has opened the assessment for review.
Audited Audit complete and accepted.
Audit Rejected Auditor found issues; flagged for follow-up.

Assignment types

Workflow assignments (who reviews, who approves) can be:

  • Per-assessment — set manually when submitting
  • Global project role slots — pre-configured at the organization level so routing is automatic (see Global Project Roles)

Next review date

Assessments can have a next review date set. This triggers a reminder notification to the Owner and relevant reviewers when the date approaches.