PCI Engagement Masterclass - Episode 232

On this week's Compliance Unfiltered, PCI engagement chaos doesn’t have to be the norm. Todd Coshow and Adam Goslin explore how smarter compliance workflows can eliminate repetitive evidence collection, QA bottlenecks, and annual audit scrambles. Learn how request lists, automated evidence mapping, and operational mode streamline PCI and multi-framework compliance while reducing human error. From year-round evidence collection to better assessor workflows, discover how the right platform and processes can save time, improve accountability, and make complex compliance engagements far less painful.

Episode Transcript:

Now, I have to ask, why did this topic speak to you, Adam?

Adam Goslin:
Well, we’re heading toward that time of year where we’re all gonna be heading over to the PCI community meetings, both in the US and the EU.

The reality is a lot of people that are in the compliance arena, a lot of them tend to use a kind of rinse-and-repeat style approach.

It’s almost like you get into your lane, right? I got my thing, and I do it this way, and I’ve always done it that way. For some of these organizations, “We have always done this this way since the dawn of time.”

It’s cool to have a good, rock-solid process you can depend on, right? But in the same sense, I made this company to help people.

I love helping people. I love making their lives better, giving them solutions that’ll actually help, all of that fun stuff.

So we wanted to take the opportunity to go through some of the advanced capabilities that few assessors are really leveraging to their fullest capability.

Hopefully, even if you’re a seasoned Compliance Unfiltered listener, I’d suggest thinking about your process, how you do what you do, some of the stuff we’re gonna bring up, where it could be applicable, and hopefully this particular session turns out to be helpful.

Todd Coshow:
Absolutely. Well, let’s start with telling the listeners more about request lists and some of the benefits when handling multiple certifications.

Adam Goslin:
Sure thing.

I’m sorry, I got completely distracted by a shiny object.

I went and did a quick lookup. “And they tell two friends, and so on.” It was not an STD, fans that are keeping score.

It was a famous phrase from 1970s and ‘80s television commercials for Faberge Organics shampoo. So for those of you keeping score on Adam’s memory card, you can put the red mark on that side of the paper, shall we say.

Anyway, sorry, I’m back now.

Todd Coshow:
So request lists.

Adam Goslin:
Yes, request lists.

A lot of people tend to walk into this notion of the request list as, “My engagements aren’t all that challenging. They’re not all that difficult, so I don’t need a request list. I really only need my request list for these super complicated engagements, etc., and we don’t have engagements like that, so we’re not gonna bother.”

But the reality is, I challenge the listeners to just think about it.

Actually, now that I think of this, I’ll give a pro tip on this one too.

When you go in and do an engagement on the TCT portal, for those that haven’t really inspected what happens, you can hit the full export button, and that will produce kind of a full export of the entire track, all the report texts, explanations, which attachments went where.

One of the files that comes out of that is like a document spreadsheet. Basically, what it is, it’s a unique list of the documents that were leveraged on the engagement, and in the next column over, it tells you how many places was that document used.

As a test, I would just suggest go do that for one of your recent engagements. Go look at that file because what you’re gonna see is that there are single pieces of evidence that are attached to multiple requirements, and in some cases, the evidence is attached to hundreds of items.