Three Requests in One Afternoon
You are a C3PAO assessor finishing a Level 2 assessment of a 400-employee electronics firm. Three things happen the same afternoon. (1) The client's VP of sales asks you to hold the draft findings for 48 hours so he can 'get the story straight' with the prime before anything is written down. (2) Your firm's consulting arm sends a remediation proposal to the same client covering the five unmet practices, and the sales lead asks you to 'warm them up' during the closing meeting. (3) While reviewing evidence, you find a folder containing roughly 400 employee HR records, including SSNs, on the same share as the CUI - unrelated to the assessment. Your assessment manager says findings must go out Friday to hit the quarterly target.
1. Analyze each of the three situations and state what you do.
Read the worked answer
1. Delay request from the VP of sales. Decline. The reporting timeline is set by the assessment agreement and program requirements, not by the client's messaging strategy. Holding findings so the client can 'get the story straight' with a prime is a request to soften the record; even a benign delay creates the appearance of client control over the outcome. Offer what is legitimate: a factual debrief at the closing meeting, and the client's right to respond to draft findings through the defined comment process.
2. Consulting arm cross-sell. Decline to participate, and say so in the room if asked. Selling remediation to an organization you are assessing - and soliciting on the strength of findings you produced - is a direct conflict: the assessor's income would depend on there being findings, and the assessor would be positioned to grade their own firm's fix. Program rules restrict consulting to assessed organizations; regardless of the exact boundary, do not advocate, do not 'warm them up,' and route the proposal to a separately managed, firewalled part of the firm with disclosure to the client.
3. HR records on the CUI share. Do not copy, do not retain, do not browse. Note in the record only that unrelated PII was observed in the assessed environment and where. Report it privately to the client's authorized representative and per your firm's incident/PII procedure, since it may be a reportable exposure. It is also legitimate assessment evidence of access-control weakness, but it must be described minimally - you do not paste SSNs into a workpaper.
2. Your assessment manager pressures you to deliver Friday regardless. How do you handle that, and what documentation standards govern the report?
Read the worked answer
Handling the pressure
- Separate the deadline from the content. Ask what is actually at risk: the report can be delivered Friday if the work is complete; if it is not, the correct escalation is a quality issue, not a personal one.
- Escalate through the C3PAO's quality or ethics channel, not sideways to the client. Document the instruction and your response.
- Note the structural risk: an assessor's performance metrics should never be report turnaround at the expense of accuracy. If Friday delivery would mean trimming evidence review or omitting the PII observation, the answer is no, in writing.
Documentation standards for the report
- Accuracy and traceability: every finding ties to a specific requirement, the evidence examined, and the method used (examine, interview, test). No finding without an evidence trail.
- Completeness: the record reflects the assessment as it actually occurred, including the scope as assessed, personnel interviewed, sampling performed, and anything that changed mid-assessment.
- Neutrality of language: describe the condition and the evidence, not the client's intent or your opinion of their competence.
- Confidentiality and minimization: CUI and PII are described, not reproduced. Workpapers are stored and transmitted per the firm's handling rules.
- Version control: draft vs. final is explicit; the client's response is captured; the final record is the one that stands.
A report delivered Friday but incomplete is not a faster report - it is a defective one that the organization may rely on for three years.