Abstract: In one embodiment, a system and method pertain to receiving audit exceptions indicative of instances of noncompliance of an information system under evaluation relative to a policy or standard, identifying remediation recommendations that are relevant to the audit exceptions and that indicate how to correct conditions that caused the noncompliance, and providing the remediation recommendations to an entity responsible for correcting the conditions so as to provide information as to how the information system can be brought into compliance with the policy or standard.

Abstract: In one embodiment, a system or method pertain to accessing a model that comprises a computer-readable version of a standard or policy, identifying rules or requirements specified by the model that pertain to compliance with the standard or policy, and automatically generating questions relevant to the identified rules or requirements, the questions being intended to query intended respondents as to compliance with the identified rules or requirements.