---
tool_id: WACK-TOOL-0079
concept_id: WACK-CONCEPT-0017
playbook_content_id: WACK-CONTENT-0159
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Assurance Activity Comparison

> Keep scans, penetration tests, control tests, and assessments from becoming interchangeable.

**Expected output:** A four-column comparison of objective, population, method, authority, output, conclusion, and non-claim.  
**Working time:** 35 minutes  
**Derived from:** WACK-CONTENT-0159

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Name each activity

Collect its stated objective and authorization.

- [ ] **What question is asked?**

  Notes: ________________________________________________

- [ ] **Who authorized it?**

  Notes: ________________________________________________

## 02 / Map — Compare coverage

Record population, exclusions, timing, method, and output.

- [ ] **What was covered?**

  Notes: ________________________________________________

- [ ] **What was omitted?**

  Notes: ________________________________________________

## 03 / Explain — Bound conclusions

State what each result does and does not mean.

- [ ] **What is supported?**

  Notes: ________________________________________________

- [ ] **What would overreach?**

  Notes: ________________________________________________

## 04 / Reduce — Remove ambiguous labels

Replace report shorthand with the actual activity.

- [ ] **What does clean mean?**

  Notes: ________________________________________________

- [ ] **Which term misleads?**

  Notes: ________________________________________________

## 05 / Prove — Review the method first

Verify the plan before evaluating the final report.

- [ ] **Was methodology known?**

  Notes: ________________________________________________

- [ ] **Was retest defined?**

  Notes: ________________________________________________

## Completion check

- [ ] Objective and population are explicit.
- [ ] Authorization is preserved.
- [ ] Every activity has a non-claim.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._