Model 01
Questionnaire-based compliance platforms
A questionnaire-based compliance platform stores control status as human attestations: an owner answers that a control operates, the answer is retained, and it is revisited on a review cycle. DECIMA stores control status as observations read from the live system and evaluated against a published rule.
The distinction matters on the day something drifts. An attestation stays true in the record until someone updates it; an observation changes the moment the system does.
What each model produces
Five dimensions that decide how much work sits between you and a defensible answer.
- Source of control status
- Questionnaire platformA person answers a question about the control.
- DECIMAThe control state is read from the system that operates it.
- How current the record is
- Questionnaire platformAs current as the last review cycle — typically quarterly or annual.
- DECIMAAs current as the last scheduled read, with the read time on the record.
- Answering a second framework
- Questionnaire platformA new questionnaire set is completed against the new mandate.
- DECIMAThe same evidence is evaluated against the second rule set; only genuinely new controls are added.
- What the assessor receives
- Questionnaire platformAttestations, plus supporting files gathered before fieldwork.
- DECIMAA dated record for the whole period, with the rule version applied to each verdict.
- Failure mode
- Questionnaire platformThe record says compliant while the system has drifted.
- DECIMAA read fails or a source is unreachable, and the gap is visible as a gap.
Where this model is the better fit
Honest limits, so the comparison is usable.
- Controls that are genuinely procedural — training acknowledgement, policy sign-off, physical processes — have no live system to read, and an attestation is the correct record.
- An organization with no integrated systems yet will get further faster with a questionnaire baseline than with an evidence pipeline that has nothing to ingest.
See it against a real mandate
Each console shows the evidence model applied to one rule set.
04
Questions about this comparison
Answers written to be quoted.
Compare against your own control set
Bring one framework and one system, and we will show the same control as an attestation and as an observation.
Talk to us