Skip to main content

How scoring works

A compliance score is the number the whole platform exists to produce: where do we stand against this framework? SolveGRC is deliberate about that number in two ways — it counts only what you've genuinely earned, and it shows enough of its own arithmetic that you can reproduce it. A score you can't explain is a score you can't defend to an auditor, so the design goal is a number that explains itself.

What the score measures​

The score is the fraction of the framework's in-scope requirements you've satisfied. Two things make that honest:

  • The denominator is in-scope only. Requirements with an approved not applicable, scoped out, or retired decision on the Applicability tab are removed from the denominator, not silently counted as passing or failing. Setting a requirement's status to Not Applicable does not remove it. The count excluded for each reason is shown, so the denominator is reproducible — you can see exactly what the percentage is of.
  • The numerator is the parts on screen. The headline is the sum of the credited buckets divided by that denominator. You can add up what's displayed and arrive at the same percentage, with no hidden term.

That reproducibility is a property we test for, not a nicety: if the headline ever stopped equalling its own disclosed fraction, that's a bug.

Earned versus provisional — the honesty rule​

Not every signal that a requirement might be met is allowed to move the number. SolveGRC splits credit into two buckets and only counts one:

  • Earned — counts toward the score. A requirement you've assessed as Compliant or Likely Compliant, and a requirement you haven't assessed directly that is satisfied through an approved crosswalk mapping: one of your controls is Implemented or Monitored, and SolveGRC's crosswalk reviewers have approved the mapping from it to this requirement. This is what the percentage is built from.
  • Provisional — shown, never counted. Credit that would come only from an unapproved, AI-suggested mapping. The score card shows it as n via unreviewed AI mapping · not counted, and it contributes exactly zero to the score until the mapping is approved.

This is the platform's design law made arithmetic: credit is earned, never assumed. A machine noticing a possible connection is a helpful lead; it is not a compliance claim. Mappings are shared by every SolveGRC customer, so SolveGRC's reviewers approve them; you can't approve a mapping from your own workspace.

Coverage and assurance are two different questions​

The score answers are the requirements satisfied? — call that coverage. It does not by itself answer how strong is the proof behind them? — that's assurance, and SolveGRC tracks it separately. A requirement can be credited toward coverage while the evidence under it is thin or aging.

That's why the Compliance Hub shows both, side by side. A high coverage number with weak assurance is a real state the product will not hide from you — it means "you've claimed these, now make the proof hold up." Reading coverage without assurance is how green numbers become audit surprises; showing both is how they don't.

What moves the score​

  • Assessing requirements moves coverage directly.
  • An approved suggested mapping flips its credit from provisional to earned — the score goes up by exactly what was being withheld.
  • Approved scope decisions move the denominator: excluding a requirement removes it from the fraction (with the reason recorded), so the number reflects your real obligations, not a padded list.
  • Freshness and exceptions do not change the percentage. They feed the assurance score and the exception burden badge shown beside it, so a position that was solid last quarter honestly shows proof that has since aged.

A score is a point in time, and it says so​

Every score is a snapshot: computed from your assessments and scope decisions as of a moment and stamped with when it was calculated. It recomputes nightly and whenever an assessment status or applicability decision changes, and once a snapshot is more than a day old, the Stale button beside the headline recomputes it on the spot. Compliance reports read the latest snapshot, so the number in a report and the number in the product come from the same computation.

What this means for you​

  • Trust the fraction, then check it. The headline is derivable from the counts on screen — if a number ever surprises you, the parts that make it are right there.
  • Read the provisional count as a lead. It shows where AI-suggested mappings might add credit once SolveGRC's reviewers approve them. It never counts until then.
  • Read coverage and assurance together. A high score with weak proof is a prompt, not a victory — shore up the evidence before someone tests it.
What we don't expose

You can see what the score counts, what it excludes, and the parts it's built from. The assurance weights are shown too, on each control's Assurance score card, and administrators can adjust them in Scoring rule set. What stays internal is the analysis behind a "likely" judgment, so the signal is consistent across every tenant and can't be gamed.