Assurance philosophy
Evidence before assertion
RiskFlow treats assurance as a disciplined comparison between expected and observed conditions — not as a questionnaire score or an unconstrained language summary. Trust is earned through verification. Assurance explains what the evidence supports, under which conditions, and with what limitations.
Methodology foundations
Governance work begins with objectives and requirements, proceeds through scoped evaluation, and ends in accountable decisions — without collapsing those judgments into one status field.
01 · Criteria
Requirement, applicability, expected state, scope, population, time.
02 · Evidence
Relevance, sufficiency, provenance, freshness, conflicts.
03 · Verification
Compare expected versus observed under defined methods.
04 · Assurance
Structured conclusion with limitations — five canonical states.
05 · Risk
Separate scenario evaluation; Not Rated until inputs exist.
06 · Decision
Authorized human outcome with rationale and ownership.
Primitive distinctions
- Requirement ≠ Observation
- Observation ≠ Evidence
- Evidence ≠ Verification
- Verification ≠ Finding
- Finding ≠ Risk
- Risk ≠ Decision
- Assurance ≠ Compliance
Typed assurance primitives and relationships form the semantic substrate (the Assurance Primitive Library). This page describes public-safe roles and distinctions — not the full internal specification vault.
Assurance Reasoning
Criteria → evidence → verification → reasoned conclusion
The Assurance Reasoning Engine is designed to evaluate structured inputs deterministically and leave uncertainty visible. This page describes the methodology and intended evaluation behavior. It does not imply that all capabilities are currently operational.
Established
Supported evidence shows the expected condition for the scoped population and period.
Partially Established
Material progress toward the expected condition is supported, with a defined shortfall remaining.
Not Established
Supported evidence shows the expected condition is not met — distinct from missing evidence.
Unknown
Evidence is insufficient, inapplicable, or not yet usable to determine the condition. Unknown is not failure.
Conflicting
Credible sources disagree in a material way that has not been resolved. Conflict stays visible.
Scope & time
Conclusions remain qualified by subject, population, assessment boundary, and evidence dates. Reassessment creates a new explainable result rather than rewriting history.
Sufficiency & conflict
Presence of a file is not sufficiency. Material conflicts must be examined; they are not silently averaged into a favorable state.
Finding path
A deviation is not automatically a finding. Significance, extent, and governing criteria determine whether a finding is warranted — and a finding is still not a risk rating.
Unknown is not Not Established
Absence of evidence cannot automatically prove failure. Insufficient evidence is different from an observed violation. Conflicting evidence must remain visible rather than silently resolved. Unknown is not failure — and it is not Not Established.
Assurance Expression
Governed language after structured conclusion
Its Assurance Expression Engine is designed to turn structured findings, evidence, and reasoning into substantive, traceable explanations. Expression communicates supported conclusions; it does not invent them.
Assurance constructs
Controlled construct families (context, requirement, evidence, observation, comparison, assurance, uncertainty, risk condition, decision, limitation, and related slots) compose statements from structured results.
Semantic invariants
Reported is not verified; implementation is not effectiveness; unknown is not failed; remediation is not closure; association is not causation. Audience modes may omit optional detail — never invent missing parts.
Provenance
Material clauses should remain linkable to underlying claims, evidence, and reasoning steps. Style changes must not alter state, scope, or uncertainty.
AI boundary
Optional AI assistance may help parse or phrase proposals, but cannot silently invent evidence, upgrade conclusions, infer risk ratings, or authorize decisions. Deterministic composition remains the methodological baseline.
Assurance Expression — conceptual illustration
Audience changes language and density. It must not change assurance state, scope, uncertainty, or risk status.
- Expected MFA coverage: 100% of 250 privileged accounts
- Observed: 240 enabled (96%) — Partially Established
- Risk condition identified; likelihood and impact not assessed — Not Rated
Decision-oriented language; same facts, less mechanics.
Privileged-account MFA is only partially established for the assessed production population: 240 of 250 accounts meet the required condition. The remaining gap creates a potential unauthorized-access risk condition. Likelihood and impact have not been assessed, so risk remains Not Rated. Remediation and current evidence are needed before the required state can be restored.
Labeled concept only — not output from a live Assurance Expression Engine, and not a published assessment result.
Risk Evaluation Methodology
Scenario, inherent and residual risk, treatment
A missing safeguard alone does not determine likelihood, impact, or risk level. RiskFlow constructs risk scenarios and evaluates them separately from assurance conclusions.
01
Risk scenario
Subject, exposure, threat or trigger, adverse event, consequence, and assessment horizon — a gap alone is not a rating.
02
Inherent risk
Explicit counterfactual baseline with named controls excluded and conditions retained. Requires its own likelihood and impact rationale.
03
Controls & effectiveness
Design, implementation, and operating effectiveness are separate inputs. Enablement is not enforcement; implemented is not verified.
04
Residual risk
Separately supported reassessment considering current controls and actual effectiveness — never a silent automatic discount.
05
Treatment & decision
Mitigate, avoid, transfer/share, accept, monitor, or investigate. Acceptance and escalation require recorded authority.
Qualitative 5×5 direction
RiskFlow’s approved prototype direction uses ordinal likelihood and impact on a qualitative 5×5 model (RF-RISK-5X5). Scores are prioritization indices — not calibrated probabilities or expected loss. Production calibration remains a separate governance decision.
Missing required inputs yield Not Rated— never zero, Moderate-by-default, or an invented score. Assurance state does not set likelihood, impact, or rating.
Conceptual matrix
Likelihood × Impact — cells intentionally unlabeled
Visual orientation only. Band labels and calibration are not asserted as live product behavior on this website.
What enters a scenario
Subject and exposure, threat or trigger, adverse event, credible consequence, assessment horizon, and control assumptions. Impact dimensions may include financial, operational, data protection, legal, reputational, and safety considerations when applicable.
History and reassessment
Model version, assumptions, factors, and rationale are retained. New evidence, scope change, control change, incidents, or decision expiry create versioned reassessments without erasing prior evaluations.
Governance decision methodology
Proposed recommendations are not authorized decisions. Risk acceptance, exceptions, escalation, and formal closure require recorded authority, rationale, scope, conditions, and review expectations.
Authority
Decision responsibility sits with the appropriate governance role — not with an automated score or assistant suggestion.
Treatment ownership
Mitigate, avoid, transfer/share, accept, monitor, or investigate — with owners, dates, and required new evidence when remediation is chosen.
Proposed vs approved vs done
Keep proposed decisions, approved decisions, completed actions, and verified outcomes distinct so activity is never mistaken for closure.
Relationships & Continuous Compliance
Connected records without false certainty
Typed relationships help people review dependencies across objectives, programs, assessments, subjects, controls, findings, risks, treatments, and decisions. Connections support interpretation — they do not prove causation or auto-propagate scores.
Relationship & impact review
Cross-domain dependencies and shared controls should be visible for human review. Evidence reuse does not imply conclusion reuse: the same artifact can inform multiple assessments, each with its own scope and sufficiency judgment.
Continuous Compliance
Requirement/control mappings, evidence freshness, derived evaluations, exceptions, and reevaluation when circumstances change. Continuous Compliance is cross-domain oversight — not a fourth disconnected evidence silo. Established is not Compliant.
Stakeholder presentation
The same records can support different organizational perspectives. The Stakeholder Pyramid is a presentation and governance model — not a replacement for methodology, permissions, or evaluation substance.
- Governance authority remains with authorized roles and recorded decisions.
- Information presentation may vary in density and language across the organization.
- Permission enforcement is a separate authentication and authorization concern.
- Assurance and risk substance stays grounded in shared evidence and evaluation records.
Many perspectives. Shared understanding. Trusted decisions.
Methodological invariants
These rules must hold across product storytelling, portfolio narrative, and implementation claims.
- Unknown is not Not Established
- Assurance is not risk — state does not set likelihood, impact, or rating.
- Risk is not compliance — a score is not an obligation determination.
- Established is not Compliant — compliance needs applicable obligation interpretation.
- Unknown is not failure — preserve Unknown and Conflicting.
- Enablement is not enforcement — configuration is not operating effectiveness.
- Inherent and residual risk are distinct evaluations with their own rationale.
- Not Rated is valid when required risk inputs are missing.
- Reasoning precedes governed expression — language does not invent conclusions.
- Audience changes do not change facts.
- Relationships do not prove causality or auto-change ratings.
- Automation does not replace decision authority.
- Time and scope qualify every conclusion.