PCI compliance is assessed in two ways: Self-Assessment Questionnaires (SAQs) and; Audits Generally, businesses are required to submit SAQs annually and are audited quarterly to ensure compliance. Answering a questionnaire once a year many not sound that complicated, but how your business is structured and the number of credit card transactions you process dictate which of the 8 different SAQs you will have to complete. What might initially seem like a simple checklist of requirements can balloon into over 200 questions examining things like your networks, login systems, and data storage.