The 109-Practice Question and the Double Role
During a CCI workshop on assessment fundamentals, a learner who works for a Registered Provider Organization says their client completed a mock Level 2 assessment and met 109 of 110 practices. The only miss is a practice in the Access Control family about controlling the flow of CUI. The learner asks, 'Can they still be certified if we write a POA&M for that one practice? And since I'm helping them fix it, can I also sign off as the assessor to save time?' Another learner asks whether the client can just self-assess and skip the C3PAO. You have 10 minutes before the next module and must decide what to teach, what to defer, and what to correct.
1. How should you answer the certification and POA&M question without overstepping the CCI role?
Read the worked answer
Do not answer 'yes' or 'no' for the client. Teach the decision framework instead: certification depends on the assessment type required for that contract, the current CMMC program rules, whether the unmet practice is eligible for a POA&M (if POA&Ms are allowed at all for that assessment), and whether the C3PAO or CCA accepts the evidence. A 109/110 mock result is only a gap analysis, not a certification. The learner should read the current CMMC documentation and get a determination from the assessing organization; the CCI should not invent a POA&M rule or promise an outcome. If the practice is ineligible or the POA&M is not accepted, the client must remediate and provide evidence before certification. If the contract requires a third-party assessment, self-assessment is not a substitute just because it is faster.
2. What is wrong with the learner's plan to remediate and assess the same client?
Read the worked answer
It is a conflict of interest and an independence failure. The same person or organization should not both help design or implement remediations and then objectively assess the same client's compliance. The assessor must evaluate evidence without having created it or having a stake in the outcome. The CCI should explain separation of roles, tell the learner not to sign as assessor, and refer the client to an independent C3PAO or CCA. If the learner's RPO also has a C3PAO affiliate, the conflict must be screened and disclosed under the provider's ethics rules. Saving time is not a justification; it undermines the credibility of the certificate and can invalidate the assessment.
3. What should the CCI teach about evidence and scoring so learners can reason about the 109/110 situation?
Read the worked answer
Teach that an assessment is objective-based: each practice has assessment objectives, and the assessor gathers sufficient evidence through interview, examine, and test. A practice is met only when the evidence supports the objective in the client's scoped environment. One unmet practice is still a gap; scoring is not a participation trophy. A POA&M, if allowed, is a documented remediation plan with milestones and evidence-not a substitute for meeting the practice. Learners should map evidence to objectives, test samples, and record deviations. The CCI can walk through a hypothetical practice and show what weak versus strong evidence looks like, but must not evaluate the learner's actual client.