Worked examples · What a number is actually made of · COV-001
What is your compliance score made of?
One control estate of 164 controls, read four defensible ways. All four are arguably correct and they are 61 points apart. The gap is the point.
OpenSynthetic dataFixed seed
This run
164 controls · fixed seed · 4 readings
What the simulation shows
Count everything asserted or stale100%
As a governance tool usually reports it87%
Evidence only, over what was assessed54%
Evidence only, over the whole estate39%
Every figure here is generated from a fixed seed, so the numbers on this page are the numbers in the simulation.
The entry
The problem
A board is shown one coverage percentage. Nobody in the room can say which of four possible questions it answers, and the four answers are 61 points apart.
Why it matters
The number drives budget and audit scope. A figure that cannot be traced back to a definition is not a measurement.
The approach
Generate a control estate from a fixed seed. Compute coverage four ways. Show all four together with the rule that produced each, rather than selecting one and defending it.
Judgement calls
Stale evidence counts as present under one rule and absent under another. Both readings are shown rather than resolved. Controls that were never assessed are never quietly removed from a denominator.
Where else it applies
Any argument about a denominator: patch compliance, training completion, asset inventory, vendor coverage. The estate changes and the four readings do not.
The data
Entirely synthetic, generated from a fixed seed, identical on every rebuild. A demonstration that shows different numbers on each run cannot be discussed.
Open the simulation
It asks for your name and email, then opens. The page carries a watermark with the name of whoever opened it.