Appearance
Indicators
Where to find it: Controls & Assurance, then Continuous Assurance (/assurance).
An Indicator (IND-YYYY-NNNN) is a deterministic rule that evaluates evidence assertions against a control and a declared scope. Each evaluation produces an immutable Indicator Result (INR-YYYY-NNNN).
Indicators are where evidence stops being data and becomes an assessment.
Deterministic by design
No AI model determines a pass or a fail
Indicator evaluation is entirely deterministic. It compares observed assertions against a stated rule and a stated denominator, and reports the arithmetic.
AI drafts rationale, suggests mappings and proposes expected evidence. It never decides whether a control passed.
The reason is simple: a pass or fail must be reproducible. Given the same assertions and the same rule, an indicator must produce the same result today, tomorrow and in an audit two years from now.
What an indicator definition carries
| Element | Purpose |
|---|---|
| Control | The control it evaluates |
| Scope | The declared population it evaluates against |
| Evaluation rule | How assertions are turned into a result |
| Criticality | low, medium, high or critical |
| Mandatory flag | Whether failure gates control effectiveness |
| Frequency | How often it evaluates |
| Status | draft, active, paused or retired |
Evaluation rules
| Rule | Passes when | Typical use |
|---|---|---|
all_pass | Every observed subject passes | Configuration that must hold universally, such as disk encryption |
threshold_pct | The pass proportion meets a stated threshold | Where a defined tolerance is legitimate |
exact_match | The observation matches an exact expected value | A specific configuration setting |
qualitative_exists | A valid observation exists at all | Governance facts: a board approval, an annual test |
custom_condition | A defined condition evaluates true | Bespoke logic |
Choose qualitative_exists for governance facts
An annual board approval has no population. Forcing it into a percentage rule produces a meaningless number. qualitative_exists with a qualitative scope evaluates the right question: does a valid, current observation exist?
Mandatory and criticality
Criticality describes how much the indicator matters.
Mandatory is a hard gate: if a mandatory indicator fails, control effectiveness becomes ineffective regardless of how many other indicators pass.
This is the single most important behaviour in the assurance layer.
A control with nine passing indicators and one failing mandatory indicator is
ineffective, not "90% effective".
Averaging is how a critical failure disappears into a comfortable score. Mandatory gating is how it does not.
Mark an indicator mandatory when its failure means the control has not achieved its objective — not merely when it is important.
What a result records
Indicator results are immutable. Each one records:
| Field | Purpose |
|---|---|
| Result status | pass, fail, unknown, not_determined, stale, error or not_applicable |
| Expected count | The denominator from scope membership at the evaluation instant |
| Observed count | Subjects with an assertion |
| Fresh count | Observations within their freshness window |
| Stale count | Observations beyond it |
| Pass count and fail count | The breakdown |
| Coverage percentage | Fresh observed against expected |
| Rule applied | Which rule produced the verdict |
| Freshness status | The freshness picture across the population |
| Explanation | A deterministic plain-language sentence |
| Provenance | How and when it was evaluated |
Result statuses that are not failures
| Status | Meaning |
|---|---|
not_determined | The indicator has not yet been evaluated |
unknown | Evaluation could not reach a verdict |
stale | The underlying observations are beyond their window |
error | Evaluation encountered an error, captured safely |
None of these is a fail, and none is treated as one. An unevaluated indicator produces not_assessed effectiveness, not ineffective.
Explainability
Every result carries a deterministic explanation naming the indicator, the evaluation and as-of timestamps, the expected denominator against observed and fresh counts, the rule executed and the pass, fail and stale breakdown.
This is written to be readable by someone who has never used OrviQ — which is the test that matters, because that person is often the assessor.
Scheduling
| Frequency | Use |
|---|---|
continuous | Event-driven evaluation as assertions arrive |
hourly, daily, weekly, monthly | Scheduled sweeps |
manual | Evaluated on demand only |
A scheduled sweep evaluates indicators that are due. Evaluation can also be triggered for a single control or across the tenant.
Requires indicator.evaluate or assurance.evaluate.
Like collector runs, indicator evaluations are technical schedules and do not appear on the GRC Calendar.
Historical evaluation
Any indicator can be evaluated as of a past timestamp. OrviQ resolves the scope membership effective then and the assertions observed by then, and applies the rule.
This is what makes a past compliance determination reproducible rather than remembered.
Defining an indicator
- Confirm the control exists and the scope is declared with its members.
- Confirm assertions are arriving with subjects that resolve to scope members.
- Create the indicator in
draft. - Choose the rule that matches the control objective.
- Set criticality, and set mandatory only where failure genuinely means the objective is not achieved.
- Set the frequency to match the evidence cadence.
- Evaluate manually and read the explanation — if the expected count is wrong, the scope is wrong; if the observed count is low, subject resolution is wrong.
- Set the status to
active.
Requires indicator.manage.
Permissions
| Action | Permission |
|---|---|
| View indicators, rules and historical results | indicator.read |
| Create, edit and configure indicators | indicator.manage |
| Trigger evaluation | indicator.evaluate |
| Trigger tenant-wide assurance recalculation | assurance.evaluate |
All require the continuous_assurance entitlement.
Example
Control CTL-2026-0041 — Multi-Factor Authentication Standard.
| Indicator | Rule | Mandatory | Frequency | Scope |
|---|---|---|---|---|
IND-2026-0009 MFA enforced on privileged accounts | all_pass | Yes | Daily | SCP-2026-0012, 214 accounts |
IND-2026-0010 MFA enforced on standard remote access | threshold_pct 98% | No | Daily | SCP-2026-0013, 3,104 accounts |
IND-2026-0011 Annual MFA policy review | qualitative_exists | No | Monthly | Qualitative |
Latest results:
| Indicator | Expected | Observed | Fresh | Pass | Fail | Coverage | Status |
|---|---|---|---|---|---|---|---|
IND-2026-0009 | 214 | 214 | 214 | 211 | 3 | 100% | fail |
IND-2026-0010 | 3,104 | 3,104 | 3,098 | 3,081 | 17 | 99.8% | pass |
IND-2026-0011 | 1 | 1 | 1 | 1 | 0 | 100% | pass |
Derived control effectiveness: ineffective.
Two of three indicators pass. Coverage is essentially complete. The average pass rate across all observed subjects is above 99%. And the control is ineffective, because three privileged accounts lack MFA and that indicator is mandatory.
The explanation on IND-2026-0009 names the three accounts. Someone can fix them this afternoon.
This is the behaviour to demonstrate to a sceptical stakeholder
"Three accounts out of 3,318 make the control ineffective" sounds harsh until you ask which three. They are the privileged ones.
Troubleshooting
"The expected count is wrong." The scope has the wrong members, or membership is not effective-dated correctly for the evaluation instant.
"Observed is much lower than expected." Subject resolution between the collector and the scope is not matching. See Collectors.
"The indicator shows not_determined." It has not been evaluated. Trigger an evaluation.
"A passing indicator still reports staleness." Subjects passed, but some observations are beyond their freshness window. Coverage counts fresh observations.
"Effectiveness is ineffective but I only see minor failures." A mandatory indicator failed. Check the mandatory flags.