Review reports

Entry: Compliance overview > Compliance position for evidence-backed assessment and audit packs; Proof > Reports for operational summaries. Before starting: Confirm the organisation, access, scope and period. The reporting workspace was deployed to JPWTech on 26 October 2026; runtime reads and database evidence restrictions were verified. Assessment and pack workflows passed local tests; this release did not create production assessments or issue audit packs.

Assess a framework and issue an audit pack

1. Maintain the intended framework/version and requirements using E03. An internal policy set can be its own framework. Open Compliance position > Create a reporting cycle and select the framework, title, period and accountable owner. Describe sites, services, exclusions and sampling boundaries. This scope is an assessor declaration, not an automatic business-unit filter. The cycle pins the entire requirement set and definition; subsequent framework changes require a new cycle.
2. Open Assess / review beside each requirement. Enter criteria, a reasoned conclusion, owner and review date. Select relevant controls, policy versions, evidence files and follow-up actions. Latest control tests on or before period end and policy source documents are included automatically. A mapping belongs to this cycle's assessment; it does not change master coverage links or a source record.
3. Record the finding and next action for partial/unmet conclusions and flag critical findings. An accepted-risk explanation does not turn an exception into compliance. Save an assessment draft. A new draft makes the live requirement Not assessed until reviewed; earlier revisions remain in history.
4. An authorised reviewer opens the saved draft, checks its evidence and records a decision note before Approve saved assessment. This approves the saved revision, not unsaved form changes. The system records the reviewer; it does not enforce an independent second person. A Met conclusion needs evidence and a current policy or active control. Selected controls need passing, evidenced tests within the period and declared validity window; every test on the latest eligible date counts, including a conflicting failure. Current policies need approval by period end, an original source document and an unexpired review date. These checks support the human decision, rather than judging evidence quality automatically.
5. Read the summary and requirement matrix. The percentage is assessed-met requirements / all requirements other than currently approved not-applicable requirements. Partial, unmet, unassessed and review-needed items stay in the denominator. An all-not-applicable cycle shows no percentage. Critical findings remain prominent. This is a scoped assessment result, separate from maturity, coverage and certification.
6. Use Policies & controls to inspect recorded source versions and download accessible originals. Use Refresh position after maintaining sources. Changed source metadata, an overdue assessment, failed tests or a changed framework invalidate a current conclusion. File contents are hashed at approval and rechecked on pack issuance; the live screen does not continuously rescan file bytes. Refreshing or leaving the form discards unsaved entries, so save a draft first. Concurrent saves return a refresh/reassess error.
7. Open Audit packs & history, review the scope and gaps, enter the report review note, acknowledge the selected contents and choose Issue audit pack. Gaps do not prevent a transparent report; missing files and changed approved file contents block issuance. Download the ZIP and extract it before opening index.html. It contains an executive summary, detailed assessments, tests, policies, actions, revision history, a JSON manifest and the latest selected original evidence files with SHA-256 hashes. Print the HTML through the browser if PDF is needed; check print layout. Earlier assessment metadata is retained, but earlier original file versions are not reconstructed.
8. Retain the issued pack under the organisation's information policy. Later record edits do not rewrite it. Downloads recheck current permissions and source access and verify the archive hash; issue/download events are audited. Already downloaded copies cannot be recalled. Hashes detect integrity changes; they are not digital signatures, WORM storage or certification.

Access and limits: Organisation-wide assurance, policy, document, follow-up and people read access is required; otherwise the view explicitly withholds results rather than showing partial totals. Drafting requires assurance write, approval requires assurance approve, issuance additionally requires reports read, and downloads require reports read. Scope-limited reporting is not included in this increment. Missing or revoked historical sources withhold the report and block pack download; ask an administrator to investigate access/retention rather than deleting history. The reporting workspace supports up to 500 requirements per cycle, 50 sources per selector, 2,000 records per catalogue and 20 MiB of selected originals per pack. The selector shows the latest 100 cycles; saved links retain access to older cycles. No automatic notifications, regulatory submission, AI compliance decision or new paid reporting service runs.

Read existing operational summaries

1. Open the report and note its scope/window. Training compliance is reviewed on the Training page.
2. Follow maintenance links to investigate exceptions. Correct the underlying record and refresh the report.
3. Explain missing evidence, incomplete fields and relevant access limitations in any management summary.
4. Record the review date and reviewer in the organisation's review evidence. If printing through the browser, check the output; do not assume a complete application-wide export function.

Complete when: The reviewer understands what the figures count and each material exception has a next action. An empty authorised view can reflect access scope or missing data rather than absence of obligations.