Can the form be signed electronically?

Yes. Electronic signatures are legally effective in the United States under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted. Ensure the signer’s intent, consent to electronic records, attribution, and reliable retention are documented to satisfy the four-prong test.

Is a paper original required for enforcement?

Generally no. ESIGN and UETA treat electronic records as equivalent to paper when legal requirements are met. Certain narrow exceptions (wills, some court filings) remain excluded from electronic signature coverage — verify applicable exception lists.

Who must sign the form?

An authorized representative with authority to attest for the named legal entity should sign. For corporate attestations attach a delegated authority or board resolution when required to evidence signatory power.

Do I need a notary or witness?

Not usually for routine attestations, but state-specific or document-specific rules may require notarization or witnesses. Use your state rules or counsel to confirm when notarization or witness signatures are mandatory.

How long must completed forms be retained?

Retention depends on industry and legal obligations: e.g., IRS-relevant documents three years (IRC §6501(a)), HIPAA six years (45 CFR §164.530(j)). Retain for the longest applicable period and follow legal hold procedures.

How do I correct an error after signing?

If minor, prepare a signed amendment or correction statement and attach it to the original. For substantive changes, execute a new attestation with a unique ID and reference the superseded form.

Compliance PCAT Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

COMPLIANCE PCAT FORM

RECITALS

WHEREAS, Client Name: is engaged in operations that require periodic compliance assessments and related remedial activities; and

WHEREAS, Service Provider Name: possesses the expertise to perform the Compliance Policy and Control Assessment Tool (PCAT) engagement described below; and

WHEREAS, the parties desire to set forth the terms and conditions under which the PCAT assessment will be performed and delivered.

SCOPE OF WORK

The Provider will perform a Compliance PCAT engagement comprising policy review, control testing, gap analysis and a prioritized remediation plan. Specific components and deliverables are set forth below and in any attached scope addenda.

Describe Scope of Work

COMPLIANCE COMPONENTS & ASSESSMENT CRITERIA

The assessment will evaluate the following domains. Check applicable domains to be included in this engagement.

Data Protection and Privacy

Information Security Controls

Financial and Transaction Controls

Regulatory Reporting & Compliance Processes

Operational Risk & Business Continuity

Assessment Findings Summary

ASSESSMENT SCHEDULE

Assessment Start Date: Assessment End Date:

Assessment Frequency / Milestones

PAYMENT TERMS

Total Fee:

Payment Schedule (installments, milestones)

Invoices shall be due within days of invoice. Late payments shall accrue a late fee of % per month or the maximum permitted by law, whichever is less.

TERM AND TERMINATION

This Agreement commences on Start Date: and continues until End Date: unless earlier terminated in accordance with this section.

Either party may terminate for convenience upon written notice delivered no fewer than days prior to the intended termination date. The Provider may terminate immediately upon written notice if Client fails to pay undisputed fees within the invoice terms or otherwise materially breaches this Agreement and fails to cure within thirty (30) days following written notice.

Termination for Cause - Provider Remedies

CONFIDENTIALITY

Each party (the "Receiving Party") shall hold confidential and not disclose to any third party any Confidential Information disclosed by the other party (the "Disclosing Party") except as required by law or as necessary to perform the Scope of Work. "Confidential Information" includes nonpublic technical, business, operational and financial information, assessment findings, and remediation recommendations. The Receiving Party shall use at least the same degree of care to protect Confidential Information as it uses to protect its own confidential information, but in no event less than reasonable care.

Confidential Information shall not include information that (a) is or becomes publicly known through no breach of this Agreement; (b) is rightfully received from a third party without restriction; (c) is independently developed without use of the Disclosing Party's Confidential Information; or (d) is approved for release by prior written authorization of the Disclosing Party. Upon termination or expiration, the Receiving Party shall return or destroy Confidential Information as directed by the Disclosing Party and certify such return or destruction in writing upon request.

Acknowledgement of Confidentiality:

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified below without regard to conflict-of-law principles.

Governing Jurisdiction

ENTIRE AGREEMENT

This document, together with any attached schedules and written scope addenda executed by the parties, constitutes the entire agreement between the parties concerning the PCAT engagement and supersedes all prior and contemporaneous agreements, representations and understandings, whether written or oral, relating to the subject matter hereof. No amendment shall be effective unless in writing and signed by authorized representatives of both parties.

ADDITIONAL PROVISIONS

Data Retention Period (days)

Attachments delivered with final assessment (check all that apply):

Assessment Report Template

Remediation Plan

Scope Addendum

CERTIFICATION

The undersigned individually certify that they are authorized representatives of their respective parties, that the information provided in this Compliance PCAT Form and any attachments is true and complete to the best of their knowledge, and that they agree to be bound by the terms and conditions set forth in this Agreement.

Client Printed Name:

By:

Date:

Service Provider Printed Name:

By:

Date:

What the Compliance PCAT Form Is and when it applies

The Compliance PCAT Form is a standardized U.S.-focused compliance attestation used to record controls, attestations, and verification steps related to a specific policy, contract, or regulatory requirement. Organizations use it to capture respondent details, control references, dates, and a signer’s attestation that stated controls were reviewed or implemented. The form supports audit readiness by creating a reproducible record of who attested to what, when, and under what authority, and it is commonly used in vendor assessments, internal compliance reviews, and contract onboarding.

Why a consistent Compliance PCAT Form matters

A uniform Compliance PCAT Form reduces interpretation gaps, preserves an evidentiary record for audits, and documents remediation timelines and ownership. Properly completed forms streamline reviews, reduce information requests, and create a defensible trail for internal and external examiners while remaining compatible with U.S. e-signature laws.

Who typically completes and relies on the form

Completed forms serve auditors, regulators, and internal stakeholders as a single source of truth for the attestation event.

Compliance teams and GRC managers who need an auditable record of control verification and remediation ownership.
Procurement and vendor risk teams when onboarding suppliers or renewing contractual assurances.
Business unit owners and project leads who must confirm operational readiness or corrective actions.

Essential elements found on a professional Compliance PCAT Form

A well-designed form balances clarity with auditability: it collects identities, control references, factual answers, dates, and a verifiable signature while allowing attachments and reviewer notes for context.

Header

Form title, unique ID, and version number to ensure you use and archive the correct revision and support traceability.

Respondent Details

Name, title, department, organization, and contact information so responses can be attributed and follow-up actions assigned.

Control Reference

Clear mapping to policy clauses, ISO/ NIST controls, or contract sections to tie attestations to specific requirements.

Answer Fields

Structured yes/no/partial fields and commentary areas for evidence links, remediation notes, and dates to document status.

Attachments

Placeholders for supporting artifacts (screenshots, reports, certificates) stored with the signed form to support audit requests.

Signature Block

Signer name, role, date, and e-signature with an audit trail to confirm intent, attribution, and timing of the attestation.

Step-by-step: completing a Compliance PCAT Form

Follow this sequence to collect accurate answers, evidence, and a verifiable signature.

01

Prepare materials: Gather policies, control evidence, and attachment files before starting.
02

Fill identifiers: Enter form ID, respondent, organization, and effective date.
03

Answer and attach: Complete required fields, add comments, and upload supporting documents.
04

Authenticate and sign: Use an eSignature method that records identity, timestamp, and audit details.

Where to file, send, and submit completed forms

Route signed forms to one or more destinations depending on governance and audit needs.

Internal GRC system: Archive signed forms and artifacts in the governance, risk, and compliance repository.
Vendor portal: Return completed attestations to vendor management systems where required.
Legal or contract folder: Attach attestations to contract records to preserve the contractual audit trail.
External regulator: Submit only when specifically requested or required by regulation.

Configuring an online workflow for the Compliance PCAT Form

Key workflow settings define routing, authentication, and retention so forms meet organizational controls and legal requirements.

Field	Configuration
Routing rules	Sequential or parallel signer order with conditional branches.
Authentication	Email link, SMS code, KBA, or advanced verifier depending on risk.
Conditional fields	Show or hide questions based on prior answers to reduce signer friction.
Retention settings	Automated archival and retention schedule to meet legal holds.

Technical considerations for digital completion and storage

Confirm the chosen platform meets encryption, audit log, and retention requirements before using it for official attestations.

File formats: PDF, DOCX, and fillable form templates supported.
Integrations: Connectors for Salesforce, NetSuite, Microsoft 365, Google Workspace.
Authentication: Supports email, SMS, SSO, and advanced signer verification.

Typical timelines and processing expectations

Establish clear deadlines to ensure timely attestations and to meet audit or contractual milestones.

Initial submission:

Due on request or by specified onboarding deadline; often within 7–14 days.

Internal review window:

Compliance review typically completes within 5–10 business days of receipt.

Remediation timeline:

Corrective actions commonly tracked with 30-, 60-, or 90-day deadlines.

Periodic re-attestation:

Annual or event-triggered attestations are standard for control assurance.

Audit production:

Provide signed forms and evidence within auditor-requested timelines, often 10–30 days.

Common mistakes to avoid when preparing the form

Incomplete control references that force auditors to ask follow-up questions and delay validation by several days.
Uploading unsupported file types or missing attachments that are referenced in answers but not archived with the form.
Using informal signer identifiers (initials, alias) instead of legal names, which complicates attribution and dispute resolution.
Failing to set retention or legal hold flags, causing required records to be deleted before an audit completes.

Penalties and risks of incorrect or missing attestations

Audit findings: May result in corrective action plans and increased oversight.

Regulatory fines: Potential administrative penalties where regulated requirements are unmet.

Contract breach: Incomplete attestations can trigger termination or indemnity clauses.

Data breach exposure: Poor controls increase likelihood and scope of incidents.

Reputational harm: Public or client loss of trust following compliance lapses.

Operational delays: Onboarding or go-live timelines may be extended for remediation.

Security and compliance controls to look for in an eSignature platform

Transport Encryption: TLS 1.2/1.3

Data at Rest: AES-256 encryption

Regulatory Certifications: SOC 2 Type II and ISO 27001

Healthcare Compliance: HIPAA with BAA available

Legal Framework: ESIGN and UETA compliance

FDA / Audit Support: 21 CFR Part 11 controls

Vendor pricing and capability snapshot for eSigning the Compliance PCAT Form

Compare starting price, trial availability, bulk send, audit trail, HIPAA support, and envelope caps when selecting an eSignature vendor for attestations.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes (Business Premium)	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA available)	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently asked questions about the Compliance PCAT Form

Answers to common procedural and legal questions to help you execute, archive, and defend completed attestations.

Need help? Contact support

Can the form be signed electronically?
Yes. Electronic signatures are legally effective in the United States under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted. Ensure the signer’s intent, consent to electronic records, attribution, and reliable retention are documented to satisfy the four-prong test.
Is a paper original required for enforcement?
Generally no. ESIGN and UETA treat electronic records as equivalent to paper when legal requirements are met. Certain narrow exceptions (wills, some court filings) remain excluded from electronic signature coverage — verify applicable exception lists.
Who must sign the form?
An authorized representative with authority to attest for the named legal entity should sign. For corporate attestations attach a delegated authority or board resolution when required to evidence signatory power.
Do I need a notary or witness?
Not usually for routine attestations, but state-specific or document-specific rules may require notarization or witnesses. Use your state rules or counsel to confirm when notarization or witness signatures are mandatory.
How long must completed forms be retained?
Retention depends on industry and legal obligations: e.g., IRS-relevant documents three years (IRC §6501(a)), HIPAA six years (45 CFR §164.530(j)). Retain for the longest applicable period and follow legal hold procedures.
How do I correct an error after signing?
If minor, prepare a signed amendment or correction statement and attach it to the original. For substantive changes, execute a new attestation with a unique ID and reference the superseded form.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now