Does your business know which legal, contractual and regulatory requirements apply to it? 1. Does your business know which legal, contractual and regulatory requirements apply to it?
We have not looked into it. We have a rough idea, but nothing is written down or checked with an adviser. We keep a register with applicability decisions, and uncertain items have been checked with a qualified adviser.
Does each requirement have a named owner? 2. Does each requirement have a named owner?
No, it is assumed that the owner or IT person handles everything. Some requirements have owners, but it is informal. Every requirement in our register has one named owner who reviews it on a set date.
If a customer or auditor asked for evidence tomorrow, how easily could you provide it? 3. If a customer or auditor asked for evidence tomorrow, how easily could you provide it?
We would have to search emails and ask around. We have some records, but they are scattered and not always current. We keep dated evidence in one approved, access-controlled folder linked to our register.
How do you keep up with changes to laws, directions and contracts? 4. How do you keep up with changes to laws, directions and contracts?
We find out only when someone asks or something goes wrong. We occasionally read news or forwarded messages. We review the register on set dates using official sources and take questions to a qualified adviser.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered