Most assessments are more than all or nothing. Responses and attachments are made in a cadence as the respondent prepares the artifact for upload. The assessor does not need or want to wait on a final submission.

The call is for a working relationship between the assessor and the respondent. The assessor needs to get alerts to new responses to review the evidence. The respondent wants to know if the artifact/evidence review and acceptance are done and if it demonstrates compliance in near real-time.

An assessment of 200+ controls can result in 400+ questions. The assessment is more of a mini-project (workflow) than a single event.

I add comments with more details on the concept of assessment workflow.