Assessment history and delta tracking
Assessment History, Assessment Baselines & Delta Tracking and Automated Gap Narratives answer a different question from the live assessment: what changed since the selected baseline, why did it change and does the earlier conclusion remain defensible?
Assessment History
Section titled “Assessment History”Use history to locate prior assessment states, dates, systems, frameworks and conclusions. Confirm that two records refer to the same system boundary and comparable framework version before drawing a trend. A higher score can reflect real improvement, increased assessment completion or changed applicability; these are not the same outcome.
Assessment Baselines & Delta Tracking
Section titled “Assessment Baselines & Delta Tracking”A baseline should have a clear purpose, such as pre-deployment approval, annual assurance, post-incident state or certification-readiness review. Record its scope, cutoff date, framework version, assessor and known limitations.
Do not move the baseline merely to improve the reported trend. Create a new baseline when a major system boundary or methodology change makes direct comparison misleading.
Delta interpretation
Section titled “Delta interpretation”Review changes in:
- system scope, purpose, data, supplier, geography or autonomy;
- routing and control applicability;
- assessment status and assurance depth;
- evidence freshness and test results;
- findings, accepted risks and remediation;
- human conclusions and review dates.
Automated Gap Narratives
Section titled “Automated Gap Narratives”An Automated Gap Narrative can summarise recorded changes, but it cannot determine whether the business accepted the change, whether evidence is credible or whether a legal conclusion is valid. Require assessor review and retain material caveats.
Defensible comparison checklist
Section titled “Defensible comparison checklist”- Same system identity or an explained boundary change.
- Comparable framework and methodology versions.
- Applicability changes separated from control improvement.
- Completion changes separated from assurance changes.
- Evidence period and freshness considered.
- Material regressions have an owner and treatment.
- The new conclusion records the decision basis and reassessment trigger.