Assessment independence policy

QCI publishes QCI-QS1 and also provides advisory services. A different QCI employee is not, by itself, an answer to the conflict created when QCI reviews work QCI helped produce.

Readiness and implementation teams may help build inventories, evidence records, controls, remediation plans or self-assessed scores. They cannot select samples, evaluate evidence, recommend a finding or sign an independent determination for that same work. Assessment personnel must not design, implement or operate the controls they review. A separate reporting line cannot cure a firm-level self-review conflict.

If QCI designed, built, operated or materially remediated controls within the proposed assessment boundary, QCI will not issue an independently assessed determination on that boundary. The client may self-assess, or engage an assessor outside QCI who is free of that conflict. QCI may supply records to that assessor but does not direct their findings or sign their statement.

QCI will not accept an independent assessment of a client until at least 12 months after QCI's last Readiness, implementation or operational advisory work for that client. The period runs from completion of the last such engagement, not from contract signature. Current advisory work makes the client ineligible for a QCI-authored independent determination.

The passage of 12 months does not remove a self-review conflict. If QCI's work falls within the boundary or evidence under review, an outside assessor is required even after the cooling-off period. QCI may assess a separately declared boundary only when a documented conflict review finds no material overlap or other threat to independence.

At scoping, QCI asks the client to identify prior and current QCI engagements, relevant contractors and the proposed assessment boundary. Everyone proposed for the assessment declares financial, employment, personal and prior-work interests; the assessment lead records those declarations, the boundary, any recusals and the eligibility decision before evidence review begins.

A conflict discovered later pauses the review. The assessment lead records the issue, removes affected personnel and decides whether a defensible reassignment is possible. Firm-level self-review cannot be solved by changing personnel: QCI declines the determination and directs the client to an assessor outside QCI. The client is told why an independent QCI determination cannot be issued.

For an eligible QCI assessment, a designated assessment lead who did not work on the client's readiness or implementation signs the dated written determination after an independence check and a second review of the evidence and findings by a different qualified reviewer. The statement identifies the signatory, declared boundary, assessment type, applicable edition, limitations and unresolved exceptions.

When an outside assessor conducts the independent review, that assessor signs and owns the determination. QCI does not countersign it as an independent QCI finding. A QCI-supported self-assessment remains labeled self-assessed, and no result is QCI certification.