Assurance & drift
Your compliance score answers "is this control met?" Assurance answers a different question: "how much should we trust that answer?"
Both matter, and they can disagree. A control marked compliant on the strength of a screenshot somebody took eleven months ago is compliant and barely assured. A control with three current, verified pieces of evidence is compliant and well assured. The compliance score alone can't tell those apart — which is exactly the gap an auditor walks into.
Open it from Assurance in the Frameworks page header. The Assurance Dashboard lists your defined controls from the Controls module, not framework requirements.
Read the dashboard
A KPI row shows Total controls, Scored, Below 0.50, and Awaiting baseline, and three widgets sit below it: Stale evidence, Assurance drift, and Trending down. Controls by assurance lists controls with the weakest first, because the bottom of a program is your work queue.
Each control's assurance score combines evidence freshness against your freshness SLA, the test pass rate over the last 90 days, attestation recency, monitoring coverage, and inheritance confidence, minus penalties for unacknowledged drift and open findings. Open a control and its Assurance score card shows each part's weight and contribution. Administrators can change the weights and the Default freshness SLA (days) in Scoring rule set.
Controls with no score yet are counted separately, as Awaiting baseline. They aren't scored badly — they aren't scored at all, and that distinction is deliberate. An unmeasured control should never be mistaken for a confident one.
The interesting controls are the ones where compliance is high and assurance is low. That combination is where a clean-looking program is resting on evidence that won't survive being asked about.
Drift is what erodes a score
Compliance is a decision made at a point in time, and assurance scores keep moving after it. SolveGRC looks for six patterns in them, called drift events: Sudden drop, Sustained decline, Recurring failure, Dimension collapse, Bulk N/A spike, and Exception surge. Each event's drawer shows the threshold that triggered it. A Bulk N/A spike also opens a finding, "Unusual applicability pattern detected".
Drift detection runs when someone clicks Run drift detection now on the Assurance drift widget. It needs assurance scores from the last day or so, so run it after the nightly recompute.
Every unacknowledged drift event on a control carries a penalty against its assurance score, whatever the event's age, up to a cap. The dashboard's Active drift events list shows the last 30 days. That is the mechanism by which a program that stops being maintained visibly decays, rather than quietly going stale while its dashboard still reads green.
Acknowledging drift
Acknowledge an event with Ack in the list or Acknowledge in its drawer, optionally with notes. That removes it from the penalty calculation on the next assurance compute. Acknowledgement means "I've seen this and it doesn't change the verdict" — not "make the warning go away."
If the signal does change the verdict, the honest move is to reassess the control and refresh its evidence. The evidence part of the score recovers on the nightly recompute, but the drift penalty stays until someone acknowledges the event.
An acknowledgement is an assertion by a named person that the drift doesn't undermine the control. It's part of the trail. Clearing a backlog of drift events without reading them produces a confident-looking score with nothing behind it — the precise failure this dashboard exists to make visible.
Where the score moves on its own
You don't have to compute assurance by hand. A nightly recompute covers controls with a new evidence link, test run, attestation, responsibility record, or drift acknowledgement, plus any score more than a day old. A compliance status change does not trigger it. Recompute on one control's Assurance score card computes it immediately; Recompute all queues every control for the next run.
The Trending down widget ranks controls by the total severity of their unacknowledged drift events in the last 30 days, which is usually a better place to start than the absolute worst score: a control that has always been weak is a known gap, while one that is becoming weak is a new one.
How this connects
- Evidence quality and freshness drive most of the score — see Evidence quality & freshness.
- Stale evidence. The Stale evidence widget's refresh button (Run stale-evidence detection now) checks evidence linked to framework requirements against your Default freshness SLA (days), 90 unless you change it. Each item past it is marked stale and gets a Medium finding titled "Stale evidence: title" on the Frameworks Findings tab.
- Cloud posture findings. Failing posture checks open "Posture: …" findings, which lower assurance on the control they are tied to — see Findings to frameworks.
- Compliance scoring itself is covered in Assess controls.