Appearance
Control Effectiveness
Control effectiveness answers one question: is this control achieving its objective in practice, right now, across everything it is supposed to cover?
The four values
| Value | Meaning |
|---|---|
effective | All mandatory indicators pass, with complete fresh evidence coverage |
partially_effective | Genuine passing evidence with coverage gaps, staleness, or a non-critical failure |
ineffective | One or more mandatory or critical indicators failed |
not_assessed | There is no usable evaluated evidence, or no indicators are defined |
How it is derived
Effectiveness is derived deterministically from the control's active indicator results, in this order:
| Step | Condition | Result |
|---|---|---|
| 1 | No active indicators defined | not_assessed — "no active indicators defined for this control" |
| 2 | Any mandatory indicator failed | ineffective — "one or more critical or mandatory control indicators failed" |
| 3 | No usable evaluated evidence at all | not_assessed — "no usable or current evidence telemetry" |
| 4 | All pass, nothing stale or missing, coverage at least 100% | effective |
| 5 | Any genuine pass exists | partially_effective |
| 6 | A non-critical failure with inconclusive primary evidence | partially_effective |
| 7 | Otherwise | not_assessed — "insufficient indicator evaluation data" |
The order is the whole design. Step 2 sits above every averaging step, which is what makes a mandatory failure impossible to dilute.
Mandatory failure gating
One critical or mandatory failing indicator cannot be hidden by averaging many passing non-critical indicators.
A control with nine passing indicators and one failing mandatory indicator is ineffective. Not 90% effective. Not amber. Ineffective.
This is the rule that separates a compliance platform from a scoreboard. The failure mode it prevents is specific and common: a well-instrumented control accumulates many easy passing checks, one hard check fails, and the aggregate stays comfortably green.
Use the mandatory flag carefully
If everything is mandatory, every minor issue makes every control ineffective and the signal is lost. If nothing is mandatory, the gate never fires.
The test: if this indicator fails, has the control failed to achieve its objective? If yes, mandatory. If it is merely a degradation, not mandatory but perhaps high criticality.
Effectiveness is not coverage
These are separate dimensions, reported separately, and they move independently.
| Coverage | Effectiveness | Situation |
|---|---|---|
| 100% | effective | Everything observed, everything passing |
| 100% | ineffective | Everything observed, mandatory failures found |
| 62% | partially_effective | What was observed passes; 38% unobserved |
| 0% | not_assessed | Nothing observed; no verdict possible |
The second and third rows describe genuinely different problems with genuinely different owners. Collapsing them into one number makes both invisible.
Effectiveness is not requirement satisfaction
An effective control contributes to satisfying an obligation. It does not conclude it.
The requirement level has its own coverage, its own evidence status, and possibly several mapped controls with different relationship types. A control mapped as subset covers part of an obligation by definition — its being effective leaves the rest unaddressed.
Requirement satisfaction is derived separately. See Requirement Assurance.
Evidence status alongside effectiveness
The control also reports an evidence status summarising the health of its telemetry:
| Evidence status | Derived when |
|---|---|
active | At least one indicator has current or mixed freshness |
stale | Indicators exist but all observations are beyond their windows |
missing | No indicators, or no observations at all |
Read effectiveness and evidence status together. not_assessed with evidence status missing means nothing is arriving. not_assessed with evidence status stale means something arrived once and stopped.
Manual assessment alongside continuous evaluation
Continuous indicators are one route to effectiveness. Manual control assessment — design assessment, operating effectiveness testing, control testing — is another, and remains fully available without the Continuous Assurance entitlement.
| Continuous indicators | Manual assessment | |
|---|---|---|
| Cadence | Continuous or scheduled | Periodic |
| Basis | Automated telemetry | Human testing and judgement |
| Best for | Configuration state across populations | Process controls, judgement-based controls |
| Entitlement | continuous_assurance | control_assurance |
Most control environments need both. A quarterly access review is a process a person tests; MFA enforcement is a configuration a collector reads.
Historical effectiveness
Effectiveness can be derived as of any past instant, resolving the indicator results recorded at or before that time and the scope membership effective then.
This is how an audit engagement's frozen report snapshot remains accurate after the live control environment moves on.
Permissions
| Action | Permission |
|---|---|
| View control assurance posture | assurance.read |
| Trigger indicator evaluation | indicator.evaluate |
| Trigger tenant-wide recalculation | assurance.evaluate |
| Run manual control evaluations | control.assess |
Example
Control CTL-2026-0022 — Endpoint Disk Encryption. Scope SCP-2026-0011, 1,240 endpoints.
Quarter 1
| Indicator | Mandatory | Expected | Fresh | Pass | Fail | Coverage | Status |
|---|---|---|---|---|---|---|---|
| Encryption enforced | Yes | 1,240 | 1,240 | 1,240 | 0 | 100% | pass |
| Recovery key escrowed | No | 1,240 | 1,240 | 1,238 | 2 | 100% | fail |
Effectiveness: partially_effective — a non-critical failure on two endpoints. Not ineffective, because escrow failure degrades recoverability rather than defeating encryption.
Quarter 2 — a subsidiary is acquired and 180 endpoints are added to scope. The collector does not yet reach them.
| Indicator | Expected | Fresh | Pass | Fail | Coverage | Status |
|---|---|---|---|---|---|---|
| Encryption enforced | 1,420 | 1,240 | 1,240 | 0 | 87.3% | pass |
| Recovery key escrowed | 1,420 | 1,240 | 1,238 | 2 | 87.3% | fail |
Effectiveness: partially_effective — same value, different reason. Nothing failed that did not fail before; 180 endpoints are simply unobserved.
Quarter 3 — the collector reaches the new endpoints and finds 31 unencrypted.
| Indicator | Expected | Fresh | Pass | Fail | Coverage | Status |
|---|---|---|---|---|---|---|
| Encryption enforced | 1,420 | 1,420 | 1,389 | 31 | 100% | fail |
| Recovery key escrowed | 1,420 | 1,420 | 1,387 | 33 | 100% | fail |
Effectiveness: ineffective — the mandatory indicator failed.
Read across the three quarters, the story is legible: the control was always fine on the original estate; the acquisition introduced a gap; the gap was invisible until coverage caught up; then it was measured. At no point did the platform report a number that concealed the situation.
Troubleshooting
"Effectiveness is not_assessed but the control has evidence." Evidence that no indicator evaluates does not produce effectiveness. Define an indicator.
"Effectiveness is ineffective but the failures look minor." A mandatory indicator failed. Review whether that indicator should be mandatory — but change the flag deliberately, not to make a number look better.
"Effectiveness moved without any test result changing." Coverage moved. Either scope members were added or assertions went stale.
"Effectiveness is effective but the requirement is only partially satisfied." The requirement has its own coverage and evidence status, and may have other mapped controls. See Requirement Assurance.