The formula
Three weighted components:
| Component | Weight |
|---|---|
| Control implementation | 50% |
| Approved policies | 25% |
| Live evidence pass rate | 25% |
Control component
Each applicable control contributes based on status:
| Status | Weight |
|---|---|
| Implemented | 1.0 |
| In progress | 0.4 |
| Contested | 0.2 |
| Not started | 0 |
| N/A | excluded from the denominator |
Contested means you marked it implemented but your latest evidence run has failing tests mapped to it. It scores below "in progress" on purpose — an unverifiable claim is worth less than an honest admission, because it costs you credibility on everything else.
Policy component
Approved policies ÷ 5. Drafts count zero. Generating all five and approving none scores 0% here.
Evidence component
Passing tests ÷ total tests, from your most recent run. No evidence run means 0% for this component — which is why a brand-new agent with everything implemented still won't show 100%.
Why you can't easily hit 100%
That's intended. A perfect score with no evidence and unapproved policies would be exactly the kind of number a reviewer learns to ignore. The score is built so that moving it requires doing the work.