TPRM/TPCRM practitioner writing about evidence validation, scope, and assessment judgment.
Assessment History
+3
Sep 23, 2026
•
2 min read
An acquisition may change who owns the company without changing what the previous assessment actually covered.
Validation
Sep 16, 2026
A vendor extension request made me question why evidence-based assessments so often begin with another round of manual questionnaire work.
Data Flow
+2
Sep 9, 2026
No system connection doesn’t mean no data flow. Sometimes the path to the vendor runs through the people using the service.
Assessment Judgement
Sep 2, 2026
A different company name can be a clue, but the assessment still has to establish which entity owns the service and control environment.
+4
Sep 1, 2026
3 min read
I built a validator to see how much of the evidence review can be assisted while keeping the assessment decision with the assessor.
Aug 26, 2026
A completed questionnaire tells you what the third party says is true. Validation determines what you can actually stand behind.
Aug 19, 2026
A deployment label can tell you where software runs without telling you what the service can access, capture, store, or transmit.
Aug 12, 2026
Evidence quality matters. Evidence relevance matters more.
Revalidation
Aug 5, 2026
A prior assessment described a planned implementation. Revalidation showed the service had never actually been introduced.
