QULDEXResources · Worked example
Multi-framework delivery example: how an advisory firm reuses evidence
Why does multi-framework work get duplicated?
An advisory firm supports clients through ISO 27001, SOC 2 and privacy programmes at the same time. Each engagement team sends its own evidence requests and writes its own style of report. Clients are asked for the same access review three times, and partners cannot compare progress across engagements.
Duplicate requests
Each framework team asks the client for the same record.
Instead: map controls across frameworks and request each record once.
Inconsistent handoffs
Every engagement produces a different style of report.
Instead: one reporting format across engagements.
No view of throughput
Partners cannot see which engagements are behind.
Instead: the same measures for every engagement.
How does the team fix it?
- Build the mapping
Agree which client controls satisfy which requirements in each framework, and record how closely.
Mapping - Store evidence against controls
Each record is kept once, linked to the control it supports.
Evidence - Check fit for each audit
Before reuse, confirm the record meets that framework's requirement and period.
Reuse - Standardise the outputs
Use one structure for findings and reports across engagements.
Reporting - Track every engagement the same way
Due dates, open requests and open findings, in one view.
Oversight
What changes for the team?
Before
- A separate evidence request list per framework
- Evidence stored per engagement
- Report format varies by team
- Progress reported by email
After
- One request per record, mapped to all frameworks
- Evidence stored once, linked to its control
- One reporting format
- Every engagement visible in one view
What should you measure?
Three measures show whether the change is working. Set your own baseline before you set a target.
| Measure | How to calculate it | What it tells you |
|---|---|---|
| Duplicate request rate | Evidence requests for a record already held, divided by all requests | Whether mapping is being used |
| Delivery variance | Days between planned and actual report date, per engagement | Whether delivery is predictable |
| Time to close | Days from raising a finding to verified closure, as a median | Whether clients act on findings |
No benchmark figures are given here. Results depend on the organisation, and we publish numbers only when a customer has agreed to share them.
How does QULDEX support this?
One control and one piece of evidence count towards every framework they apply to.
Multi-framework delivery example: common questions
Is this a real customer case study?
No. It is a worked example that shows a method. It names no customer and reports no measured results.
Can the same evidence serve ISO 27001 and SOC 2?
Often, where the same control is being tested and the record falls within each audit's period. Each auditor decides whether it is sufficient.
Does mapping reduce the consultant's independence?
No. Mapping organises the work. Where a firm both advises and audits, its independence rules still apply.
Ask your client once, for every framework
See the workflow with your own frameworks, team and audit calendar.