--- title: Assessments and Audits description: Learn what assessments and audits are, how they apply judgment to documentation and evidence, and how they differ from policies, procedures, and artifacts. --- [Skip to content](https://support.futurefeed.co/knowledge-base/assessments-and-audits#main-content) [![FutureFeed-White-Green-SupportCenter](https://support.futurefeed.co/hs-fs/hubfs/FutureFeed-White-Green-SupportCenter.png?width=400&height=99&name=FutureFeed-White-Green-SupportCenter.png)](https://support.futurefeed.co/?hsLang=en) - [HawkAI™ Support Home](https://support.futurefeed.co/) - [Knowledge Base](https://support.futurefeed.co/knowledge-base) - [Submit Ticket](https://support.futurefeed.co/support-forms) - [My Tickets](https://support.futurefeed.co/support?status=all&view=my_tickets&offset=0) Open main navigation Close main navigation - [HawkAI™ Support Home](https://support.futurefeed.co/) - [Knowledge Base](https://support.futurefeed.co/knowledge-base) - [Submit Ticket](https://support.futurefeed.co/support-forms) - [My Tickets](https://support.futurefeed.co/support?status=all&view=my_tickets&offset=0) FutureFeed's Knowledge Base - There are no suggestions because the search field is empty. 1. [FutureFeed Support](https://support.futurefeed.co/knowledge-base?hsLang=en) 2. [Terminology](https://support.futurefeed.co/knowledge-base/terminology?hsLang=en) # Assessments and Audits ## Recognizing and referencing Assessments and Audits in compliance work **What it is** An **Assessment** is an activity used to evaluate the security, risk, or effectiveness of an organization, system, or process. ![Assessment Landscape](https://support.futurefeed.co/hs-fs/hubfs/Assessment%20Landscape.png?width=670&height=447&name=Assessment%20Landscape.png) Assessments can be broad or narrowly focused. They are used every day by IT, security, and risk teams to understand current state and identify weaknesses. An **Audit** is a formal type of assessment performed to determine whether defined requirements are met. In FutureFeed, the outcomes of these activities are organized and tracked as **Assessments and Audits**. **Assessments vs Audits** All audits are assessments. Not all assessments are audits. Assessments vary in scope and purpose. Some are exploratory or operational. Others are formal and authoritative. Audits are distinguished by: - Defined criteria - Formal conclusions - Independence or credentialed authority - Clear consequences or attestations Audits may be performed by credentialed internal resources or by independent third parties. **Types of assessments** Assessments are commonly performed at different levels of scope. **Broad assessments** evaluate overall posture or readiness, such as: - Annual IT or security assessments - Risk assessments - Control or program assessments - Readiness assessments **Focused assessments** evaluate specific areas or controls, such as: - Vulnerability scans - Penetration tests - Configuration reviews - Targeted technical assessments Both broad and focused assessments are valid forms of assessment. They answer different questions and may be performed on different schedules. **Vulnerability scans and penetration tests** Vulnerability scans and penetration tests are **focused security assessments**. - A **vulnerability scan** is typically an automated assessment used to identify potential weaknesses. - A **penetration test** is typically a human-led assessment used to evaluate exploitability and impact. These assessments may stand alone, be repeated regularly, or be included as part of a broader assessment or audit. **How FutureFeed organizes assessment results** In FutureFeed, each assessment or audit is represented as a **documentation item** that describes the activity being performed. The **reports and outputs** generated each time the assessment or audit is completed are treated as **process artifacts**. Those artifacts can be attached to the assessment or audit documentation item and reviewed over time. **Example** An organization may create an assessment called **Annual IT Assessment**. Each year: - The assessment is performed - A report is generated - That report is uploaded as a **process artifact** - When reviewed and accepted, the artifact becomes **evidence** This allows the organization to track the assessment consistently over time while retaining year-by-year results. **Why assessments and audits exist** Organizations use assessments and audits to: - Understand security and risk - Identify gaps and weaknesses - Measure effectiveness - Support decision-making - Demonstrate accountability They support improvement and governance, not just compliance. **What assessments and audits review** Assessments and audits may review: - Policies and plans - Processes and procedures - Configurations - Assessment results (including scans and pen tests) - Artifacts and evidence - Interviews or walkthroughs The purpose is evaluation and understanding. **What assessments and audits produce** Assessments and audits typically produce: - Findings - Identified gaps - Risk statements - Conclusions - Recommendations Their reports are retained as records and reviewed over time. **Common confusion** In practice, people often use the terms *scan*, *assessment*, and *audit* interchangeably. This is common and understandable. In FutureFeed: **Assessments** are the category used to organize evaluation activities **Audits** are formal assessments **Reports** are Process Artifacts attached to assessments or audits **Reviewed Artifacts** (reports) become Evidence The distinction allows results to be tracked clearly and consistently over time.   - [CMMC Program - Regulation Guidance](https://support.futurefeed.co/knowledge-base/cmmc-program-regulation-guidance?hsLang=en#main-content) - [CMMC Program](https://support.futurefeed.co/knowledge-base/cmmc-program-regulation-guidance?hsLang=en#cmmc-program) - [Product Information](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#main-content) - [Basic Pricing](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#basic-pricing) - [Advanced and Volume Pricing](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#advanced-and-volume-pricing) - [Features](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#features) - [Additional Details](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#additional-details) - [CMMC Express Pricing](https://support.futurefeed.co/knowledge-base/product-information?hsLang=en#cmmc-express-pricing) - [How-to's](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#main-content) - [How-to... Build and Manage Projects in "Your FutureFeed"](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-build-and-manage-projects-in-your-futurefeed) - [How-to... Deliverables](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-deliverables) - [Other Features](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#other-features) - [How-to... Manage Tools, Services, and Documentation](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-manage-tools-services-and-documentation) - [How To... Onboarding Rocket](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-onboarding-rocket) - [How-to... Big Picture](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-big-picture) - [How to... Work in the Assess Subway Stop](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-work-in-the-assess-subway-stop) - [How-to.... Manage People and Users](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-manage-people-and-users) - [How To... Complete the SSP](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-complete-the-ssp) - [How to ... Manage a Marketplace Listing](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-manage-a-marketplace-listing) - [How To.... Recurring Tasks](https://support.futurefeed.co/knowledge-base/how-tos?hsLang=en#how-to-recurring-tasks) - [Terminology](https://support.futurefeed.co/knowledge-base/terminology?hsLang=en#main-content) - [Glossary](https://support.futurefeed.co/knowledge-base/terminology?hsLang=en#glossary) - [Getting started](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#main-content) - [Navigation](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#navigation) - [Subscription Management](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#subscription-management) - [Platform Access](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#platform-access) - [Compliance Standards - Background Information](https://support.futurefeed.co/knowledge-base/getting-started?hsLang=en#compliance-standards-background-information) - [Manage Compliantly](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#main-content) - [Technology Subway Stop](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#technology-subway-stop) - [Company Profile](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#company-profile) - [Deliverables Subway Stop](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#deliverables-subway-stop) - [Your FutureFeed Subway Stop](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#your-futurefeed-subway-stop) - [SSP Subway Stop](https://support.futurefeed.co/knowledge-base/manage-compliantly?hsLang=en#ssp-subway-stop) - [Webinars and Features](https://support.futurefeed.co/knowledge-base/webinars-and-features?hsLang=en#main-content) - [NIST SP 800-171 R3](https://support.futurefeed.co/knowledge-base/webinars-and-features?hsLang=en#nist-sp-800-171-r3) - [2023 User Webinars](https://support.futurefeed.co/knowledge-base/webinars-and-features?hsLang=en#2023-user-webinars) - [Features](https://support.futurefeed.co/knowledge-base/webinars-and-features?hsLang=en#features) - [CMMC Program](https://support.futurefeed.co/knowledge-base/cmmc-program?hsLang=en#main-content) - [CMMC Program - Regulation Guidance](https://support.futurefeed.co/knowledge-base/cmmc-program?hsLang=en#cmmc-program-regulation-guidance) - [FutureFeed Support](https://support.futurefeed.co/knowledge-base/futurefeed-support?hsLang=en#main-content) - [Product Information](https://support.futurefeed.co/knowledge-base/futurefeed-support?hsLang=en#product-information) - [Frameworks](https://support.futurefeed.co/knowledge-base/frameworks?hsLang=en) - [Tools and Services](https://support.futurefeed.co/knowledge-base/tools-and-services?hsLang=en) - [Hawk AI](https://support.futurefeed.co/knowledge-base/hawk-ai?hsLang=en) - [CMMC Fundamentals](https://support.futurefeed.co/knowledge-base/cmmc-fundamentals?hsLang=en#main-content) - [SPRS & Compliance Reporting](https://support.futurefeed.co/knowledge-base/cmmc-fundamentals?hsLang=en#sprs-compliance-reporting) [![FutureFeed-White-Green-SupportCenter](https://support.futurefeed.co/hs-fs/hubfs/FutureFeed-White-Green-SupportCenter.png?width=300&height=74&name=FutureFeed-White-Green-SupportCenter.png "FutureFeed-White-Green-SupportCenter")](https://support.futurefeed.co/?hsLang=en) FutureFeed Footer – Newest ## Footer [1-844-725-8252](tel:14105605602) [support@futurefeed.co](mailto:support@futurefeed.co) - [Facebook](http://facebook.com/FutureFeedCompliance/) - [X (Twitter)](https://x.com/futurefeedco/) - [LinkedIn](https://www.linkedin.com/company/futurefeed/) Attain. Maintain. Prove It Anytime. ### Resources - [15-Min with FutureFeed](https://zoom.us/meeting/register/WKkYTumjR6OOUjNRwZi91A#/registration) - [User - Schedule a Training](https://futurefeed.co/schedule-training/) - [Partner - Schedule a Training](https://futurefeed.co/schedule-training/) - [Download the Everything Book](https://futurefeed.co/cmmc_guide/) ### Legal - [Terms of service](https://futurefeed.co/terms/) - [Privacy policy](https://futurefeed.co/privacy/) - [Security](https://futurefeed.co/security/) - [Legal](https://futurefeed.co/legal/) © FutureFeed.co. All rights reserved. Disclaimer: The appearance of U.S. Department of Defense (DoD) visual information does not imply or constitute DoD endorsement.