Engineering governance · Template 4

Engineering Practice Assessment

Assess whether engineering controls exist, operate effectively and produce evidence. Record gaps, accountable owners, remediation commitments, approved exceptions and retest outcomes.

Control assuranceExistence + effectiveness

Illustrative starting statuses are unassessed. Select an assessment result for every applicable control.

Controls assessed
0 / 6
Controls with a recorded result
Effective
0
Controls passing assessment
Gaps identified
0
Partial or ineffective controls
High / critical severity
0
Open high-priority findings
Assessment principle: A control is not effective simply because a policy, tool or pipeline exists. Verify that it is applied to the relevant production-bound changes, runs as intended, identifies failures and leads to appropriate action.
01

Assessment context

Identify the scope and accountable assessor.

02

Control assessment register

Record existence and effectiveness separately, then assign severity and remediation where needed.

Control Expectation Evidence source Exists? Effective? Assessment Severity Gap owner Assessment date Remediation target Exception approval Retest result Evidence / notes
Peer review Required changes receive appropriate review before merge. Repository rules and pull requests
Automated testing Critical paths have appropriate automated tests that run on relevant changes. CI and test reports
Security Required scanning and remediation controls operate, with findings handled within agreed timelines. Security platform
Deployment Release and recovery mechanisms are tested and usable. Deployment pipeline
Observability Critical services have actionable telemetry and alerts with appropriate response ownership. Monitoring platform
Incident learning Significant incidents result in tracked, owned and reviewed improvements. Incident management system
03

Assessment guidance

Apply consistent interpretation across teams.

Pass

The control exists, operates on the required scope, and evidence demonstrates that it works.

Partial

The control exists or works inconsistently, has incomplete coverage, or needs material improvement.

Fail

The control is absent, not operating, or cannot demonstrate the required assurance.

Severity

Rate the impact and urgency of the gap using agreed organisational definitions.

Exception approval

Record the authorised approver and reference, plus any expiry or review date in the evidence notes.

Retest

Verify remediation using fresh evidence. A retest pass should not be inferred from a change being marked complete.