Score your own environment before anyone audits it

How these assessments work

Each assessment asks what your process actually does, not what a policy says it should do. Every question is answered Yes, Partial or No, and the score builds as you go: Yes earns full credit, Partial earns half, No earns none.

Some questions are marked critical. A critical question scored No is not just a lost point — it undermines the questions around it, so critical gaps are counted separately from the percentage. A respectable score with critical gaps still describes a process that cannot be relied on.

What you get at the end

The result names a band, the percentage behind it, and how many critical questions you scored zero on. It then lists the questions to fix first, ordered so the largest reduction in risk comes earliest rather than the easiest fix.

The assessment runs entirely in your browser. Nothing is sent anywhere while you answer, and nothing is kept when you close the tab — there is no form in front of the result.

Who they are for

Internal Audit and SOX owners testing whether a control operates the way it was designed. Application, security and ERP owners deciding where the next quarter of effort should go. Teams preparing for an external audit who would rather find the gaps themselves first.

Using the result

A score is a starting point, not a verdict. Separate the questions you scored Partial or No into risk you have consciously accepted and risk that is simply unowned, then give the unowned ones a name and a date.

If you would rather see the same review run against your environment than against your recollection of it, bring the scorecard to a working session and we will walk it line by line.