Create and evaluate assessments

Compliance officers, DPOs, IT security managers, and risk managers use the Assessments module to send structured questionnaires to the right people, collect responses, and turn those answers into a documented compliance or risk verdict — all without leaving DPMS.

The Assessments module is where structured due-diligence and compliance questionnaires come to life. You pick a template that already contains your questions and scoring logic, attach it to a real deadline and a real set of respondents, and then track everything from sending to evaluation in one place. Assessments can stand alone in the main Assessments section, or they can be anchored directly to a Vendor, ROPA record, Asset, or Organisational Unit — so the evidence always sits next to the object it describes. Two groups of people use this module with very different goals: assessment owners who build and send the questionnaire, and evaluators who read the incoming answers and produce a compliance verdict.

How to open it

From the main menu:
Left sidebar → Assessments (listed under the Compliance or Risk group, depending on your DPMS configuration). This opens the full assessment index showing every assessment across the system.

From a Vendor (or other linked object):
Open any vendor detail view → click the Assessments tab. The list here shows only assessments linked to that vendor. The Send Assessment button in the top right creates a new assessment already associated with this vendor.

Permissions: You need the Assessments edit permission to create or modify assessments. Without it, you can still open and read assessment records, but the Edit button and all save actions are disabled. The Activity Log (clock icon) requires at least read access to the assessment record type.

What you see

The index page gives you a filterable table of all assessments. A row of status tabs at the top — All, Active, Draft, Inactive, and Review — lets you instantly narrow the list to what you care about right now. Each row shows the assessment name, a clickable Results icon (opens the submitted answers in a new tab), the template used, classification tags, when it was sent, its deadline, and who sent it.

The detail view has a three-zone layout. On the far left is a collapsible navigation menu (the ElementMenu) listing every configuration tab for this record: General, Templates, Maturity Goals (when applicable), Recipients & Notifications, Audiences, Workflows, Reviewer Assignment, Responses, Sending Status, and Manage Access. To the right of that menu is the main working area. Across the very top sits a breadcrumb bar showing where you are, with left/right arrows for jumping to the previous or next record without going back to the list. A clock icon floats to the top right — that is the Activity Log, your audit trail.

Above the breadcrumb you will find the sticky action bar: the responsible person selector, a coloured status badge, a priority selector, and an AI assistant button.

Working with this screen

Creating and sending a new assessment (e.g. a vendor due-diligence questionnaire)

Start by navigating to the vendor you want to assess, click the Assessments tab, then click Send Assessment in the top right. If you are creating a standalone assessment instead, go to the Assessments index and click Create.

A creation form opens. Fill in a Name so the assessment is easy to identify later — multi-language entry is available if your DPMS is configured for more than one language. Next, use the Template selector to attach one or more active assessment templates. If a template has pre-loaded linked templates, an information box will list the additional templates that will load automatically. Choose your Assessment Deadline using the date picker — past dates are not selectable. Then decide on a Submission Mode: choose Progressive Rolling Review if respondents should be able to submit each section as they finish it, or All at Once if they must complete the entire questionnaire before submitting. A warning banner next to this field explains the implications; read it carefully because the mode is difficult to change once responses start arriving.

Click Save. DPMS will check whether any of your selected templates include maturity-scored questions. If they do, you land on the Maturity Goals tab next. If not, you go straight to Recipients & Notifications.

On the Recipients & Notifications tab, add the people who will fill in the questionnaire. Type an email address in the input field and click Add Email (or press Enter) to add an individual respondent. To send to a whole group, navigate to the Audiences tab first and link a pre-configured audience — it will then appear in the recipients table under the Audience sub-tab. For each recipient row, click the pen icon in the Notification column to select which workflow events should trigger an email to that person, and adjust the notification language if needed. The Available Sections column lets you restrict a particular recipient to only certain sections of the questionnaire. When you are happy with the list, click Save — this also syncs audience recipients into Manage Access.

After saving recipients, DPMS redirects you to the Workflows tab. Select which workflow(s) should fire for events on this assessment, then click Save to continue to Reviewer Assignment, where you can assign specific people to review each template section's responses.

Finally, go back to the General tab (click it in the ElementMenu), click Edit, and flip the Active toggle to ON. The questionnaire URL shown in the General view is now live — respondents can open it and start filling in their answers. If the toggle is missing, it means you are looking at a brand-new record that has not been saved yet; save it first, then come back to edit.

Setting maturity targets for a compliance framework assessment

If your selected template contains questions marked for maturity scoring (for example, an ISO 27001 or NIST template), DPMS will redirect you to the Maturity Goals tab immediately after you save the General information. This tab lets you declare what capability level you are aiming for — not just "did we do this?" but "how well are we doing it?"

At the top of each template section you will see a dropdown for the whole template. Select a CMMI level (for example, Level 3 — Defined) to apply that target to every question in the template at once. If certain sections need a different bar, use the section-level dropdown below — it overrides the template-level setting for that section only. For surgical control, change individual question rows using the per-question selector on the right. When you adjust a question individually, the template and section aggregate dropdowns clear their value to signal that the questions no longer all share the same target.

Click Save when done. DPMS stores the per-question targets and moves you on to Recipients & Notifications.

Reviewing submitted answers and results

Once respondents have submitted their answers, click the Results icon (the small external-link arrow) in the assessments table — either from the main Assessments index or from the Vendor's Assessments tab. The Answers & Results screen opens in a new browser tab.

At the top you will see three summary cards: Answers To Be Reviewed, Answers To Be Resubmitted, and Reviewed Answers. These give you an instant health check before you dive into the detail. Below the cards, a row of three filter switches lets you show or hide Questions & Answers, Intermediary Results, and Final Results — all are on by default. If the screen feels overwhelming, switch off the types you do not need right now.

Questions are grouped by template and then by section, each in a collapsible accordion. Click a section header to expand it. Each question card shows the question on the left and the submitted answer on the right — whether it is free text, a selected option, a table, or a computed risk score. Below the answer you may see attached files (click the PDF icon to preview or the download icon to save) and any reviewer comments in grey cards. When you are ready to go deeper, click Go to Response at the top of the screen — this takes you to the Responses tab of the assessment detail, where you can open individual response reviews question-by-question in a new tab.

Checking the audit trail with the Activity Log

At any point while inside an assessment detail view, click the clock icon in the top-right corner of the screen. A slide-in panel opens on the right side — the Activity Log — without navigating you away from the current tab.

The log lists every change to this assessment in reverse chronological order: who changed the status and when, who updated the responsible person, when the template was swapped, and so on. This is the evidence you hand to an auditor when they ask "who approved this, and when?" Close the drawer by clicking the X and continue working on the assessment.

Evaluating results and exporting a conclusion

After reviewing submitted answers, open the assessment detail view and navigate to the Evaluation tab (if shown in the ElementMenu). Here you will see a score or risk-level badge summarising the overall result, a rich-text Conclusions field where you can write up your findings in full, an AI assistant button that can draft an initial conclusions text based on the responses, and an Export to PDF option to produce a shareable report.

Type your conclusions directly in the rich-text field. When AI is configured in your DPMS, the AI assistant button will propose a draft — you can accept it, edit it, or discard it. Once you are satisfied, use Export to PDF to download the evaluation for sign-off or archiving.

Field reference

Name — the display name of the assessment. Supports multiple languages. Shown in the index table and all linked-object tabs. A clear, descriptive name (e.g. "Q3 2025 — Vendor X GDPR Due Diligence") saves confusion later.

Priority — Low / Medium / High / Critical. Defaults to Medium. Visible to the whole team in the assessment list and the detail header; use it to signal urgency.

Classification — one or more tags that categorise the assessment (e.g. "ISO 27001", "GDPR", "SOC 2"). Used for filtering and reporting. Tags can be created on the fly by typing a new value.

Template — the assessment template(s) that define the questions and scoring. Only active templates appear. Selecting a template with pre-loaded linked templates will automatically attach those linked templates too. Required for the assessment to do anything meaningful.

Assessment Deadline — the date and time by which respondents must submit. Past dates cannot be selected. Shown to respondents in the questionnaire interface.

Submission Mode — controls the submission flow. Progressive Rolling Review lets respondents submit completed sections individually; All at Once requires all sections to be complete before submission. This should be decided before you activate the assessment, as changing it after responses arrive can produce inconsistent results.

Activate Assessment — the master on/off switch for the questionnaire URL. Only visible in edit mode (not during initial creation). When OFF, the link in the General tab is greyed out and respondents cannot access the form. Flip it ON when you are ready to go live.

Show Contact Details — when enabled, the responsible person's contact information is visible to respondents inside the questionnaire.

How this connects to the rest of DPMS

The Assessments module draws on, and feeds into, several other parts of DPMS:

Assessment Templates are the prerequisite. Without at least one active template, the template selector is empty and the assessment cannot be configured. If you cannot find the template you need, ask an administrator to check the Templates module.
Audiences (Compliance Settings) power the audience-based recipient model. If the Audiences tab looks empty, audiences need to be set up first under Compliance Settings.
Workflows need to exist system-wide before the Workflows tab can do anything. An empty workflow selector means no workflow templates have been created.
Vendor, ROPA, Assets, and Projects modules can all embed an Assessments tab, giving context-anchored due diligence directly within those records.
AI Settings (IT Settings) must be configured before the AI assistant button is active. If the button is greyed out with a tooltip, ask your IT administrator to set up the AI provider.
After finishing an assessment, the natural next step is to review individual responses via the Responses tab, then complete the Evaluation tab, and finally export the PDF conclusion for sign-off or filing.

Tips & common pitfalls

Heads up: The Activate Assessment toggle does not appear when you first create an assessment. Save the record first, then open it in edit mode — the toggle will be there.

Heads up: Saving on the Recipients & Notifications tab always redirects you to the Workflows tab. If you want to double-check your recipients list, use the ElementMenu on the left to navigate back to Recipients & Notifications manually.

Maturity Goals tab missing? It only appears when the selected template has questions configured to allow maturity scoring. If you expect it and it is not there, check the template definition with whoever manages your template library.
The "+ Add Audience" link in the Recipients tab is a navigation hint, not a functional button. It signals that you should go to the Audiences tab to link an audience. Navigate there using the ElementMenu instead.
Individual email recipients do not get automatic portal access. Adding an email address in the Recipients tab sends that person the questionnaire link by email, but it does not grant them a login to the DPMS portal. If you also need them to see the assessment in the portal, add them explicitly in the Manage Access tab.
The filter switches on the Answers & Results screen reset when you reload the page. If you have configured a specific view (e.g. Final Results only), note that reloading the tab will show all question types again.
Don't change the Submission Mode once responses are in. The UI does not block you from doing so, but switching mode on a partially completed assessment can cause confusing behaviour for respondents who have already submitted some sections. Set it once, before you activate.
Use the Previous / Next arrows in the breadcrumb for batch review. When working through a set of assessments (e.g. all Active ones), the left and right chevrons in the breadcrumb let you move between records without returning to the list, keeping your place in the filtered view.