Open methodology · The five bands and sixty page rule book
We publish the rules before we score, so nobody gets to argue with the referee.
Every finding in an AuditTrax report is scored against a published rubric band. If a finding is awarded Band 2, the exact criteria that put it there are printed next to it. Here are the five bands we use across all three assessment lines.
5
Bands, from evidenced to could not be evidenced
6
Pillars, each with its own criteria set
v4.2
Current version, changes published with dates
Never
Do we convert an absence of evidence into a pass
The five bands
What each band means, and what we have to see to award it.
4
Evidenced and maintained
The control exists, it is documented, a named person owns it, and we were shown it working rather than told about it.
We must see
- The artefact itself, current within the review period
- A named owner who can describe how it is kept working
- Evidence it has been exercised, not only written
3
In place, thinly evidenced
The control exists and the team can demonstrate it, but the record is incomplete or nobody is formally accountable for keeping it working.
We must see
- A working demonstration in the live environment
- Partial documentation, or documentation out of date
2
Informal or partial
Practices are understood within the team but not written down, or written down but not followed consistently across all projects.
We must see
- Team testimony describing the practice
- Proof it works in at least one repository or environment
1
Planned or promised
The control is on a roadmap, in a policy draft or promised by a vendor, but does not operate in production today.
We must see
- A ticket, design document or vendor contract commitment
- A costed remediation line in the worklist
0
Could not be evidenced
Access was refused, the data did not exist, or the timeline did not allow it. This is the band clients argue about most, and the one we never move on.
We must see
- Exactly what we asked for and did not receive
- Who declined, or why it was unavailable
- What the gap means for confidence in that pillar