RLCM: every screen, column and action¶
The module has a three-role review model that nothing else in the product uses, and most of its screens are shaped around it.
POC, Reviewer, Auditor — the three inputs¶
A control is answered three times, by three roles, and all three answers are kept:
| Role | Provides |
|---|---|
| POC | The point of contact for the control — the person who owns the process being assessed |
| Reviewer | An internal check of that answer |
| Auditor | The independent conclusion |
The control screens carry a column per role: POC Input, Rev Input, Auditor Input,
and a Control status details view showing POC, REVIEWER, AUDITOR side by side.
Disagreement between the three is the point, not a fault
A control where the POC says compliant and the auditor says not is exactly what the model is for. The three columns preserve that disagreement rather than overwriting it, which is what makes the assessment defensible later.
NA on the control-management table marks a control the POC has declared not
applicable — which the reviewer and auditor can still disagree with.
Assessments¶
| Screen | Columns |
|---|---|
| Assessment list | Audit ID, Audit Details, Status, Last Status Update, Control Status |
| Assessment detail | Sections, Control Details, POC response, Control Status |
| Assessment detail (v2) | Sections, Control Details, Current Level, User Input, and the AI Evidence Analysis Status with its AI Score where AI evidence analysis is switched on |
| Audited controls | Section, Control, Current Level, POC Input, Rev Input, Auditor Input |
| Control management | Sections, Control Details, Status, POC, Reviewer, Auditor, NA |
Current Level is the maturity or compliance level currently claimed for the control, as distinct from pass/fail — RLCM assesses degree rather than a binary.
Row action: View Audit Finding.
Control Details carries what used to be two columns — the control's reference ID and its name — in one cell, reference first. Sorting and searching still work on either part.
AI evidence analysis¶
Where an administrator has enabled it, the assessment detail carries two extra cells per control: AI Evidence Analysis Status and AI Score. The platform reads the evidence uploaded against a control and suggests a compliance finding with a confidence score out of 100. The status is pending until that run completes, and shows failed — with the reason on hover — if the evidence could not be read.
Clicking the status opens the AI Evaluation: the AI Confidence Score, an AI Summary of what the evidence shows, and the AI Finding it suggests. The auditor's own form shows the same panel beside the answer, so the suggestion is read alongside the evidence rather than instead of it.
The AI evaluation is a suggestion to the auditor, not an answer
Nothing here records a result. The auditor's input is still the auditor's — the evaluation is there to make reading a large evidence pack faster, and a confidence score is a statement about how clearly the evidence supports the finding, not about whether the control is met. An auditor who disagrees with it should simply answer differently; the disagreement is preserved like every other disagreement in this module.
Evidence analysis runs on a schedule and within a per-audit spending cap that the administrator sets. A control that stays pending for a long time has usually run into that cap — see System: AI configuration.
Save response against Submit response¶
The assessment screen offers both, and they are not the same action:
| Button | Effect |
|---|---|
| Save response | Records the answer and leaves the control where it is |
| Submit response | Records it and advances the control to the next person |
| Reject | Sends the control back for rework, with the reason |
Saving is how a long questionnaire is worked over several sittings. Nothing moves, nobody is notified, and the answer is not visible as complete.
A saved response has not been submitted
This is the most common reason an assessment appears stalled with every control apparently answered. The answers exist; they were never submitted, so the control is still pending on the person who wrote them.
Pending On is the column that settles it — it still names the author rather than the next reviewer.
Where a screen offers a bulk submit, it applies the same advance to every selected control at once. Use it after working through a section; it does not save unsaved edits for you.
Audits¶
| Column | What it holds |
|---|---|
| Audit Information | The assessment |
| Status | Where it is |
| Progress | How much has been answered |
| Findings | How many failures it produced |
| Assessment Summary | The rolled-up result |
| Audit Score | The weighted score |
Progress and Audit Score answer different questions. Progress is how much of the work is done; score is how well it went. An assessment at 40% progress has a score computed from 40% of the controls, and it will move as the rest are answered — which is why an in-flight score should not be reported.
Findings and the risk register¶
Both share a shape:
| Column | What it holds |
|---|---|
| Finding ID / Audit & Finding Info | Identity and provenance |
| Control Details | Which control failed |
| Risk & Observations | What the failure means and what was observed |
| Status | Where the finding has got to |
Actions: Add Risk, Map Existing Risk, Status History, View Audit Finding History.
Add Risk and Map Existing Risk are the module's central decision
A control failure is not itself a risk — it becomes one when someone decides it matters. Add Risk creates a new entry in the register. Map Existing Risk attaches the failure to a risk already recorded.
Mapping is nearly always the right answer when the same weakness has been found before: one risk with six contributing findings is a register an executive can read, where six separate risks saying the same thing is not.
The control library¶
| Screen | Columns |
|---|---|
| Controls | Control Details, Answer & Comments, Process Groups / Standards, Priority |
| Master library | Control Details, Process Groups / Standards, Justification & Evidence |
| Library map | Control Details, Process Groups / Standards |
| Assessed controls | Name, Type, No. of Controls Mapped, Passed Controls, Failed Controls, Failed Control Severity Wise |
Justification & Evidence on the master library is what makes a control reusable. The evidence recorded once against the master answers the same control wherever it appears — which is the whole economics of the unified control framework.
Standards, sections and templates¶
| Screen | Columns |
|---|---|
| Standards | Standard Name, Created By |
| Sections | Reference ID, Section Name, Section Description, Total Controls, Total Sub Sections, Sequence |
| Section controls | Control Details, Answer & Comments, Process Groups / Standards, Skip Rule, Sequence |
| Templates | Template Details, Category Name, Total Controls, Total Sections, Organization, Created By |
| Audit categories | Category Name, Template Count, Audit Type, Created By |
| Domains | Domain Name, Created By |
| Process groups | Process Name, Created By |
| UCF | UCF, Control Count, Created By |
Template actions: View Template Details, Edit Template Details, Clone Template, Export Template, Delete Template.
Clone Template is how a standard gets tailored without losing the original. An organisation adapting ISO 27001 to its own scope clones the template and edits the copy; editing the original changes every assessment that uses it.
Sequence on sections and controls sets reading order in the assessment and the report. It is not cosmetic — an assessment presented out of order is materially harder to review.
Template Details and Control Details each fold a reference ID and a name into one cell. Answer & Comments on a section's controls shows what kind of answer the control demands and whether a comment is mandatory; Process Groups / Standards shows what the control is tagged with, collapsing to a count when there are many. Skip Rule marks a control that a skip rule can hide from an assessment — either because the rule is defined on this control, or because this control is one the rule hides — so a control that is "missing" from an assessment can be checked here before anyone assumes it was deleted.
Common control framework (CCF)¶
Three screens, reached in sequence: a framework, its requirements, and the control map for one requirement. Their purpose is explained in the overview; this is what is on them.
Frameworks¶
| Column | What it holds |
|---|---|
| Framework | The standard's name and your reference ID for it |
| Ver. | Which edition or year |
| Type | The kind of standard |
| Authority | Who issues it — ISO, NIST, a regulator |
| Req. | How many requirements it has |
| Compliance % | The proportion of requirements mapped to at least one control |
| Status | Active or inactive |
| Actions | View the requirements, Edit, Delete |
Add Framework asks for the framework name, a reference ID, the authority, type,
version, a description, an Initial status, and two periods: the Validity period in
months (12 by default) and the Warning period in days before expiry (30 by default).
The reference ID accepts letters, numbers and . _ - only.
Frameworks marked as a System Framework ship with the product and cannot be edited or deleted; their requirements are likewise marked System Requirement. Everything you add yourself can be.
Requirements¶
One framework's clauses. The header cards give the framework's shape at a glance: Total requirements, Mapped to controls, Unmapped (gaps) and Avg controls / req.
| Column | What it holds |
|---|---|
| Ref. Code | The standard's own numbering for the clause |
| Section | Which part of the standard it sits in |
| Requirement | The clause, with its full description on the detail |
| Mapped Controls | How many controls satisfy it |
| Coverage | Whether it is mapped at all |
| Actions | Open the control map, Edit, Delete |
Add Requirement takes the reference ID (the standard's own code, such as a clause number), a requirement name, its section, a group, and the description. Upload CSV loads many at once — Download Sample gives the accepted layout, and the upload keeps Requirement Upload Logs recording what each run accepted and rejected. Export Requirements downloads the list.
Unmapped (gaps) is the number to work down. Every requirement in it is a clause you are held to and have no control for. It is also the number an external assessor will ask about first, because it is the one that cannot be argued.
Control map¶
Two lists for one requirement: Mapped Controls and Unmapped Controls, with Map and Unmap to move a control between them and Select All for bulk moves. The unmapped list can be filtered by the control's priority and domain, so a requirement about access control can be mapped from the access-control controls without scrolling the whole library.
Mapping is reversible and does not touch the control or any assessment of it. What it changes is the framework's Compliance % and the requirement's Coverage, both of which update as soon as the map is saved.
Risk configuration¶
| Screen | Columns |
|---|---|
| Risk master | Risk Details, Status, Likelihood, Impact, Risk Level, Risk Score, Created By |
| Risk levels | Risk, Min Risk Score, Max Risk Score, Created By |
| Risk rules | Risk, Priority, Audit Property, Status, Created By |
| Risk score config | Risk Property, Risk Property Value, Status, Created By |
| Risk properties | Property Name, Property Type, Order, Required, Created By |
| Risk rating master | Risk, Colour, Risk Order |
| Risk master status | Risk Master Status, Colour, Status Order, Comment Required, Evidence Required, Closed Type |
| Score weighting | level, Current Score, Status, Created By, Created On |
Likelihood × Impact produces Risk Score, and Risk Levels turn that score into a band. Changing the band boundaries re-rates every existing risk immediately, with no assessment activity — the same trap as the CVSS mapping elsewhere in the product.
Evidence Required is enforced, and is the one that blocks people
A risk status flagged Evidence Required cannot be selected without an attachment. A user reporting that a status "does nothing" when clicked is usually hitting this, because the requirement is not stated until the save is attempted.
Comment Required behaves the same way, and Closed Type decides which statuses stop a risk counting as open.
The configuration viewers show the rules as they will evaluate: Audit Property,
Condition, Value for risk rules, and Value, Risk Score for scoring.
History and evidence¶
| Screen | Columns |
|---|---|
| Risk history | Auditor, Update On, Status |
| Risk master status history | Auditor, Status, Comments and Attachments |
| Closure document | Auditor, Status, Comments and Attachments |
| Finding summary | Status, Count |
Comments and Attachments is the audit trail an assessor is judged on. A risk closed with no attachment has no evidence that it was closed for a reason, and that is precisely what an external auditor samples.
Reporting from an assessment¶
Download Xls Report exports the assessment as a spreadsheet — the form compliance teams work in, because they annotate it and send it back to control owners.
Request New PDF queues a fresh PDF. It is a request rather than a download because the document is rendered in the background: the existing PDF stays available while the new one builds, and a report that "has not updated" is usually one whose regeneration has not finished.
Recurring assessments¶
Configuration, Client, Default Assignees (POC, Reviewer, Auditor), Frequency,
Starts From, Next Audit, Status, and a history of Raised On, Audit,
Raise Result, Audit Status.
Each row is a standing instruction to raise an assessment automatically on a frequency — annually, half-yearly or quarterly — against a chosen template and category, for a vendor or for the organisation itself. When the date arrives the audit is created with the default POC, reviewer and auditor already assigned, and appears in the audit list like any other.
The four figures across the top answer whether the schedule is actually working:
| Figure | What it tells you |
|---|---|
| Active Configurations | How many schedules are switched on, out of the total defined |
| Next Scheduled Audit | The date and configuration that will fire next |
| Last Auto-Created Audit | The most recent audit this screen produced |
| Pending First Cycle | Active configurations that have never yet run — the ones worth checking |
| Vendors Configured | How many of the vendors you can see have a schedule at all |
Raise Result in the history is the one to read after a date passes: a configuration can be active, reach its date, and still fail to raise — a deleted template or an assignee who has left will do it — and nothing else on the screen shows that.
The panel is titled Purging Configurations
It does not purge anything. Nothing on this screen deletes data — every control on it creates or schedules an assessment. The heading is misleading rather than a hidden behaviour, but it is alarming enough to be worth saying plainly.
Control similarity¶
Control Name, Broad Match, Precision Match, with a sync state showing when the index
was last refreshed.
Compares a new questionnaire against controls already assessed. Broad Match catches controls covering the same ground in different words; Precision Match is a close textual correspondence. A high broad match with a low precision match usually means the same requirement worded for a different framework — reusable evidence, different phrasing.
The Needs sync state means the index has not been rebuilt since controls changed, so matches will be stale.