How Much Time Does Evidence Validation Take?

• Validation Process Overview
• Maximum Validation Timeline Policy

Validation Phase Overview

For Validated requests, third parties need to provide evidence to support their questionnaire answers. A ProcessUnity Exchange Assessor will review evidence to validate the responses. Validation turnaround is dependent on how quickly evidence is uploaded, linked, and submitted to ProcessUnity.

To begin the validation phase, the 60 control questions included in the Validation Request must first be answered and submitted with evidence uploaded and linked in the ProcessUnity Exchange.

The validation phase for Validated assessments involves the following steps:

1. Evidence Collection (Initial Round): This vital part of the process is often the most time-consuming for third parties who will need to gather the necessary documentation internally (see policy below). In order to begin the validation phase, the 60 control questions included in the Validation Request must first be completed and submitted with evidence uploaded and linked in the ProcessUnity Exchange.
2. Evidence Review (Initial Round): The documentation provided by the third party is reviewed by an analyst at ProcessUnity GRX.
3. Evidence Collection (Follow-Up Round): If the GRX analyst was unable to validate specific controls, we offer a secondary evidence review to the third party to provide additional documentation (see policy below). This is optional but encouraged.
4. Evidence Review (Follow-Up Round): The ProcessUnity GRX Analyst reviews the additional documentation provided by the third party.
5. Validation Phase Complete: Validation is concluded and the results are available to the third party and all relevant companies with access.

 

Maximum Validation Timeline Policy

For third parties that DO complete the first round of evidence collection and review, we also offer a follow-up round where we allow third parties a second and final opportunity to provide evidence for the requested controls. Unfortunately, this is an area where validated assessments get stalled. The Third Party is asked to provide additional evidence for these remaining controls within 30 days. If no addtional evidence is provided in that timeframe, the validation will be closed and results will remain "Not Validated" for those controls. Assessments are only re-validated on an annual basis, if requested by a customer to do so.