Article
Contrata Assessments: separate suggested, saved and reviewed answers
Understand the documented assessment actions, inspect evidence behind a suggested response, and keep saving an answer separate from approving the risk.
Contrata editorial team ·
Product feature. A response can look complete while the evidence behind it covers only part of the question. If a reviewer treats a saved answer as an approved conclusion, that limitation can disappear from the handover.
Contrata's documented assessment workspace separates the section navigator, questions and evidence/context pane. Suggest answers, Check responses and Assess responses are distinct actions. Accepting a suggestion does not itself save or approve the answer; Save section and internal review remain separate.
This article explains those documented distinctions using a fictional example. It draws on the maintained product reference and the frontend review recorded there. It is not a fresh end-to-end test of the live application. The original media illustrates a review discipline rather than reproducing a product screen or promising an enforced sequence of buttons. Explore Contrata's product.
Inspect the answer and its evidence together
Imagine a fictional supplier assessment asks whether privileged support access is controlled. A suggested response refers to a report describing customer-user authentication. That report could be relevant background, but it does not establish how the supplier's own support accounts are authorised, used or reviewed.
The reviewer needs to compare the claim with the question and the evidence population. Does the evidence concern customer users or supplier support staff? What period does it cover? Which accounts or services are excluded? A confident sentence cannot answer those questions on its own.
The inherent and residual-risk guide works through that evidence-boundary problem. Evidence about one access route should receive credit only within its demonstrated scope.
Keep the actions distinct
The product reference supports the named actions below. It does not establish that every organisation uses the same review policy, or that these actions form a mandatory linear workflow.
| Documented action or stage | What the reviewer needs to keep separate |
|---|---|
| Suggest answers | A proposed response still needs to be checked against the question and its supporting material. |
| Check responses | This is a distinct action from suggesting or assessing responses; do not treat its use as a risk decision. |
| Assess responses | Assessment does not remove the organisation's responsibility for the resulting judgement. |
| Accept a suggestion | Acceptance does not itself save the answer or approve it. |
| Save section | Saving and internal review are separate. A saved record can contain an unresolved question. |
| Internal review | Apply the organisation's authority, evidence and decision requirements. |
These are boundaries for interpreting the workflow, not claims about detection accuracy, automatic risk closure or behaviour verified in a tenant during this editorial run.
Preserve the unresolved part of the answer
In the fictional example, the reviewer rewrites the response to say what the evidence establishes: the report covers customer-user authentication for its stated period. Evidence for privileged supplier support accounts remains outstanding.
That narrower response is more useful than a general “access controls are adequate”. It lets the next reviewer see what was examined and what still needs work. The service owner can request support-account authorisation, logging and review evidence without repeating the entire questionnaire.
A suggested follow-up record includes the missing population, the evidence requested, its owner, a due date and the decision that depends on it. These fields describe the team's review practice; this article does not claim that Contrata creates or enforces every field automatically. The Engage feature describes the documented supplier-conversation workflow separately.
If a response is saved before that evidence arrives, the unresolved question should remain visible in the team's record and handover. Saving preserves work. It does not establish that the supplier's controls operate or that the organisation accepts the exposure.
Review the conclusion under your own authority
Before treating the assessment as ready for a decision, confirm that the response answers the actual question, the sources support its scope, and any exclusions remain explicit. Record who can decide on the remaining exposure and what would reopen the assessment.
The organisation retains responsibility for risk decisions and compliance. Contrata's current TPRM module is described through assessments, monitoring, engagement and reporting; completing an administrative action in one area does not prove the underlying risk is resolved. The decision-record guide provides a practical structure for the human judgement that follows.