Assessment Reporting, Findings, and Post-Assessment Activities
What goes in the report
The final assessment report states the scope, the practice-by-practice determinations, the objectives that failed, the evidence relied upon, and the overall result. Findings are written factually: practice ID, the objective not satisfied, the evidence observed, and the gap. The assessor reports; the OSC owns the remediation plan.
Before it is final
The C3PAO performs quality review, then the OSC reviews the draft for factual accuracy - factual corrections, not negotiation of determinations. Disagreements follow the formal dispute process with the accreditation body; pressure applied to an assessor is itself a conduct issue.
After the assessment
Certifications are valid for three years with annual affirmations by the OSC's senior official. Where the program allows, an organization may receive conditional status with a POA&M that must be closed within the stated window (180 days for Level 2 certification assessments) and that is limited to eligible requirements. Scores and status are recorded in DoD systems so contracting officers can verify them. A false affirmation carries consequences under the rule and potentially under the False Claims Act.
Traps
Do not confuse the score with the determination - a qualifying score does not produce certification while a non-POA&M-eligible requirement remains unmet. Do not promise timelines you do not control, and do not write the OSC's POA&M (that is consulting). Be precise about "closed": closure means evidence of implementation, not a promise to implement.
Rule of thumb: report what you saw, when, and where; let the OSC decide how to fix it.