Quality & freshness

Every registered evidence item gets a quality score when it is registered. SolveGRC re-scores it every night, and again whenever one of its control links changes. Together, quality and age answer the questions an auditor will ask before you do: how strong is this artifact, and is it still current?

Organization administrators read these scores in Evidence Analytics, under Administration in the sidebar. Items in the Evidence Library do not show a score of their own.

The quality tiers

Scores fall into four tiers: Excellent, Good, Fair, and Poor. Read them as a triage signal, not a grade to chase. A freshly registered document that is not linked to any control usually lands in Good. Excellent needs a strong control link that someone has validated.

The Quality Dimensions radar on the Analytics Quality tab: every evidence item is scored across five dimensions — Freshness, Completeness, Specificity, Verifiability, and Authority — with a source-module comparison beside it.

What the five dimensions mean

The Quality tab's Quality Dimensions chart shows your organization's average on each dimension, and the table of weakest items names each one's weakest dimension. Each dimension has its own fix:

• Freshness falls steadily from full marks on the day an item is registered to zero a year later. It counts from registration, not from the date of the activity the file records, so a two-year-old report registered today starts fresh. To renew an aging item, register the newer version of the artifact.
• Completeness is whether the item has a real description and a file attached. Items cannot be edited after registration, so write the description when you register.
• Specificity is the strength you set when you link the evidence to a control. An item with no links gets a middle value.
• Verifiability is whether someone has validated the item's link to a control. A validated link scores much higher. See Validate a link.
• Authority is a fixed weight for the module the evidence came from. You cannot raise it.

Fix the dimension, not the number

The score is a symptom. When an item reads Fair or Poor, find its weakest dimension in the table and act on that: link it with an accurate strength, get the link validated, or register a newer version. The score follows.

Validate a link

Validation is how a person confirms that a piece of evidence really supports the control it is linked to. In Assessments, open the Evidence tab and pick a framework. The Evidence Explorer lists each link between evidence and a control. In a row's menu, or its details drawer, choose Validate, Reject, or Reset to Pending. A rejection needs a reason. You need edit permission on Assessments, and questionnaire answers cannot be validated here.

Staleness

Evidence does not fail loudly; it just gets old. Freshness drops a little every day, which pulls the overall score down. A nightly sweep also flags items registered more than 292 days ago as stale; the flag is recorded, but the Evidence Library does not show it.

The Health tab of Evidence Analytics is where to look. Its Stale Evidence Alert lists up to 10 items whose freshness has fallen below 50%, which happens about six months after registration, each with its freshness percentage. The alert always covers every framework, whatever the header filter says. Rows are labelled by item ID, and View opens the Assessments page rather than the item itself.

The Health tab of Evidence Analytics: the compliance-health gauge beside the Stale Evidence Alert, which lists items approaching staleness with each one's freshness percentage.

Separately, the Assurance Dashboard can check evidence linked to framework requirements against your organization's freshness SLA, 90 days unless you change it, and raise a finding for each item past it. See Assurance & drift.

What stale means for an audit: a stale item still exists, still hashes, and still proves what was true when it was captured — that is exactly what sealed, point-in-time records are for. What it no longer does is demonstrate that a control is operating now. An auditor testing operating effectiveness will ask for evidence from the review period, and a stale artifact invites the follow-up question you were trying to avoid. Treat aging items as a work queue: re-run the underlying activity, register the fresh artifact, link it, and let the old one stand as history.

Watching quality across the whole registry

Evidence Analytics is the organization-level view of the same signals. The Overview tab shows totals for registered, linked, unlinked, and sealed evidence, an Evidence by Source chart, and the quality-tier breakdown. The All Frameworks filter in the header narrows the charts to a single activated framework, so you can see where coverage for that framework is strong or thin.

The Quality tab breaks the registry down across the five dimensions and by source module. Evidence Needing Improvement lists up to 10 Fair or Poor items, by ID, with each one's score, tier, and weakest area — the practical starting point for an improvement pass. Capture Snapshot on the trend chart records today's quality; the 30-day trend fills in only as snapshots are captured.

The Quality tab's Evidence Needing Improvement table: the lowest-scoring items, each with its score, quality tier, and the single weakest dimension dragging it down — your worklist for improving evidence.

Documents have their own quality score

The score in the Documents table measures how cleanly text was extracted from a file; the score in Evidence Analytics measures how strong the item is as proof. A perfectly extracted document can still be weak evidence. Documents can be recalculated from the library header's recalculate button; evidence is re-scored nightly and whenever one of its links changes.

---

Next: putting evidence to work — linking it to controls and releasing it to auditors in Reuse & packs.