Assess controls

Assessing is the core loop: for each control in an activated framework, you record a compliance status, attach the evidence behind it, and move on. The Assessments module is built around that loop, with AI assistance that suggests verdicts and a score that always shows its arithmetic.

Pick a framework

On the Assessments page, open the Assessments tab and its Controls sub-tab, then use the Select Framework dropdown. Only frameworks you have activated in the Frameworks module appear here. Once you choose one, the control worklist loads along with four stat cards: Total controls, Assessment coverage, Compliance rate, and Control-backed.

The Assessments Controls sub-tab: the Select Framework dropdown above the four stat cards (Total controls, Assessment coverage, Compliance rate, Control-backed), and the control worklist grouped by requirement section.

The worklist is grouped by framework section. Expand a section to see its control cards, use the search box and the status filter to narrow the list, or Expand All / Collapse All to move quickly.

Set each control's status

Every control card carries a status you set from a fixed vocabulary:

• Not Assessed — the starting state; nobody has looked yet.
• Not Applicable — the control does not apply to your organization. This status does not take the control out of the score; record an approved disposition on the Applicability tab for that (see Activate & scope).
• Not Compliant and Likely Not Compliant — the control fails, or the evidence points that way.
• Partially Compliant — some of the requirement is met.
• Likely Compliant and Compliant — the evidence supports the control, or confirms it outright.

Alongside the status you can add assessment notes. Every status change lands in an immutable assessment history that records who decided what, when, and by which method, so an auditor can replay how a verdict came to be.

Gaps become risk signals when you escalate them

To track a gap as a risk, use the escalate button on a control marked Not Compliant or Likely Not Compliant (its tooltip reads "Escalate code to the Risk Register for tracking", and you need permission to create risks). It opens Escalate to Risk Register and sends a signal to the Risks Signals tab, where someone links it to a risk or creates one. Setting the status alone does not create a signal.

Link the evidence

A verdict without evidence is an opinion. There are three ways to attach proof to a control:

• On the control card, click the area that reads Click to link evidence or drag here. Link Evidence to Control opens with two tabs: Pick existing to choose evidence you already hold, and Upload new to add a file. Set the Link Type and Evidence Strength (Weak to Definitive), then click Link Evidence.
• Drop a file onto a control card. The same dialog opens on Upload new with the file filled in; confirm to upload and link it.
• On the Evidence tab, use Link to Control in a row's menu to link one item to several controls of a framework at once.

Linking evidence does not change a control's status. After a manual link, SolveGRC re-checks the control with AI (the card shows "Reassessing based on new evidence…") and stores the result as a suggestion for you to accept or override.

When evidence is linked after a verdict was recorded, the card shows a Stale badge so you know to re-check it. The badge compares when evidence was linked with when the control was last assessed, not the age of the evidence, and it clears the next time the assessment is updated, including by an automatic AI re-check.

Let AI suggest a verdict

Click the sparkle button on a control (tooltip AI Analyze Control) and SolveGRC evaluates it against your evidence, then presents a suggested status with its reasoning. The suggestion is advisory: it is never applied automatically. Click Accept suggestion, or override it from the status dropdown, and if you override a differing AI suggestion you record a reason that goes into the same immutable history.

To get AI suggestions for many controls at once, use Bulk Analysis, and track runs under Job History. Skip already assessed controls is on by default. A bulk run only stores suggestions: nothing changes until someone accepts each one on its control.

An expanded control card: the control text, the status dropdown you set (Not Assessed here), the AI-analyze action beside it, and sections for implementation guidance, linked evidence, and assessment notes.

Feed the AI before you ask it

The analysis reasons from the evidence linked to your organization. On a control with nothing attached, the honest suggestion is usually that there is nothing to support compliance, so link the obvious evidence first and let the AI do the reading.

How the compliance score reads

Back on the Frameworks page, each active framework shows a compliance score card built for full transparency. Reading top to bottom:

• The headline is the percent of in-scope controls marked Compliant or Likely Compliant, plus controls satisfied through an approved crosswalk mapping. If the number is out of date, a Stale button appears next to it for recomputing on the spot.
• The progress bar shows the same fraction visually, with the counts spelled out beneath it as "n of m in scope", plus how many controls were excluded.
• The exclusion breakdown, behind the info popover, itemizes the scoring denominator: the total assessable controls, minus those with approved not applicable, scoped out, or retired decisions, with special dispositions (inherited, partially inherited, compensating) listed separately, and the date the snapshot was computed.
• The exception burden badge summarizes open and expired exceptions weighing on the framework.
• A crosswalk chip appears when controls are satisfied through cross-framework mappings — see Crosswalks.
• A sparkline traces the score's recent trend.

The compliance score card: the percent-compliant headline, the 'n of m in scope' progress bar, the 'satisfied via crosswalk / evidenced' chip, and the trend sparkline — above the Framework Controls tree that lists every requirement.

The point of all this disclosure is that the score is never a bare number. You can always answer "out of what?" and "what was left out, and why?"

The dashboards around the worklist

The Assessments page carries more than the worklist. The Compliance Hub tab gives the cross-framework overview, Coverage rolls up how much of each framework is assessed and compliant, Gap Intelligence surfaces your biggest gaps so you can prioritize, and Evidence is the explorer for everything linked to the selected framework's controls, with export.

Track what falls short

Marking a control non-compliant records a verdict. It doesn't record what's wrong, how bad it is, or who is fixing it — that's what the Findings tab on the Frameworks page is for.

A finding is a control deficiency, gap, or non-compliance observation, carrying:

• a severity, so a missing log retention policy and an unencrypted database aren't treated as equals,
• and a lifecycle, so it moves from open through remediation to closed rather than living forever in someone's spreadsheet.

Create Finding asks for a title, description, severity, due date, and root cause. SolveGRC also opens findings on its own for failing cloud posture checks and for stale evidence. The findings overview shows Active, Overdue, Closed, and average days open, with counts by severity, which is the fastest read on whether your open gaps are getting older or getting handled.

A finding is a good sign, not a bad one

An auditor is far more reassured by "we found it, rated it, and here's the remediation" than by a control sheet with nothing on it. A program with zero findings is usually a program that isn't looking — a clean sheet and an unexamined one are indistinguishable from outside.

---

One control satisfied in one framework can count in others too. Continue to Crosswalks.