How Much Time Does Evidence Validation Take?

• Validation Process Overview
• Maximum Validation Timeline Policy

Validation Process Overview

For Validated assessments, third parties need to provide evidence to support their answers, and a ProcessUnity GRX analyst will need to evaluate and validate this evidence. Validation turnaround is dependent on how quickly the ProcessUnity GRX Analyst receives the evidence.

(If the third party is completing a standard Tier 2 assessment, evidence is not required and therefore there is no evidence validation.) 

The validation process for Validated assessments involves the following steps:

1. Evidence Request: The controls requiring evidence for validation are found in the Validation Tab of the GRX Dashboard.  
2. Initial Evidence Collection: This vital part of the process is often the most time-consuming for third parties who will need to gather the necessary documentation internally (see policy below). In order to begin the validation process, the questionnaire must first be completed and submitted with evidence uploaded in the ProcessUnity GRX Exchange.
3. Initial Evidence Evaluation: The documentation provided by the third party is reviewed by an analyst at ProcessUnity GRX.
4. Follow-Up Evidence Collection: If the GRX analyst was unable to validate specific controls, we offer a secondary evidence review to the third party to provide additional documentation (see policy below). This is optional but encouraged.
5. Follow-Up Evidence Evaluation: The ProcessUnity GRX Analyst reviews the additional documentation provided by the third party.
6. Report Release: Validation is concluded and the findings are generated into a report. The findings coupled with the questionnaire responses is what comprises the final report that is issued to the customer.

Maximum Validation Timeline Policy (updated Aug 1, 2024)

BACKGROUND: When customers request assessments from their third parties, it’s important to deliver that data in a reasonable amount of time - even when the assessment requires the extra step of validation. However, even though third parties can collect/submit evidence as they move through the questionnaire itself, we still find that many assessments become stalled at this step. (To note, customers can still preview a third party’s attested data as soon as the third party submits their questionnaire - in other words, the evidence collection process does not block that data from being released.) Previously, we gave third parties 60 DAYS to complete this step.

POLICY CHANGE: Starting August 1, 2024, third parties will only have 30 days to collect and submit their initial round of evidence for any validated assessment. After 30 DAYS, ProcessUnity will automatically downgrade the request to a non-validated assessment request and release the data to the customer in full, pending third party authorization. 

For third parties that DO complete the first round of evidence collection and validation, we also offer a follow-up round where we allow third parties a second and final opportunity to provide evidence to validate the requested controls. Unfortunately, this is another area where validated assessments get stalled. Similarly here, assessments that have completed the initial round of evidence collection within 30 days but do not complete the follow-up evidence collection process within an additional 30 days will be automatically released to the customer with the controls we were able to validate in the initial round. Please note that assessments are only eligible for evidence review every 12 months.

Rationale for Policy Change: Mitigate delays during the evidence collection phase and expedite customer access to their third parties’ data.