Appearance
Policy Assessments
Where to find it: Policy Governance, then Existing Policy Assessments (/governance/assessments).
The Policy Assessment module (also known as Upload & Assess) allows organizations to evaluate existing internal policy documents against certified target expectations (such as Content 2.0 governance packs or template versions) to determine structural policy coverage.
Requires the policy_governance entitlement.
The Assessment Pipeline
The assessment engine executes a deterministic, multi-stage evaluation pipeline:
- Source Document: An existing internal policy version or an uploaded external document (
.pdf,.docx,.txt). For uploads, the binary is immutably retained as aDocumentAssetpinned to its SHA-256 hash. - Structural Extraction: The extraction worker decomposes the source text into ordered candidate segments (clauses, paragraphs, and numbered provisions).
- Target Expectation Snapshot: The assessment freezes an immutable snapshot of atomic requirements from a released target template version or pack version. Mutable drafts can never be targets.
- Mapping: Segments are aligned to target expectations. Mapping proposals may be generated manually or via advisory AI assistance.
- Human Review: An authorized reviewer (
policy_assessment.review) evaluates mappings, accepting, rejecting, or modifying alignments. - Result Determination: The reviewer records the authoritative coverage result for each expectation.
- Recommendations: Deficiencies generate actionable gap recommendations that route to the Gap Workbench.
Assessment Lifecycle States
Every assessment moves through four formal lifecycle states:
| Status | Meaning |
|---|---|
draft | Assessment created, source document linked or uploaded, extraction pending |
extracted | Structural extraction complete; candidate segments and target expectations generated |
in_review | Reviewer actively adjudicating mappings and setting coverage results |
completed | Authoritative assessment finalized and sealed; permanently immutable |
Completed assessments are immutable
Once transitioned to completed, an assessment is locked (ASSESSMENT_COMPLETED). Its segments, mappings, results, and summary statistics can never be modified. To evaluate revised policy text or new standards, users must create a new assessment record, preserving a tamper-proof historical audit trail.
Authoritative Coverage Result States
For each individual target expectation, the reviewer assigns one of five authoritative result states:
| Result State | Meaning |
|---|---|
addressed | The source policy contains clear, explicit provisions that fully satisfy the target expectation |
partially_addressed | The source policy references or addresses the intent, but omits key operational criteria or safeguards |
missing | The source policy contains no provisions corresponding to the target expectation |
not_applicable | The expectation does not apply to this organization or operating scope (requires mandatory justification) |
unassessed | Default initial state; pending reviewer evaluation |
Core Evaluation Invariants
- A mapping does NOT imply "addressed": The existence of a mapping between a clause and an expectation merely records semantic proximity. It does not certify that the clause satisfies the expectation.
- Not Applicable requires rationale: An expectation cannot be marked
not_applicablewithout recording a documented business or jurisdictional justification. - AI suggestions are strictly advisory: Machine-learning recommendations are clearly labeled as advisory. Only an authorized human holding
policy_assessment.reviewcan establish an authoritative result.
Candidate Mapping States and Reviewer Decisions
Each expectation-to-segment mapping record carries a canonical stored mapping_state:
Stored mapping_state | Description |
|---|---|
manual | Mapping created manually by a human compliance officer |
ai_suggested | Mapping proposed by the advisory AI extraction worker |
accepted | Candidate mapping reviewed and confirmed by an authorized human reviewer |
rejected | Candidate mapping discarded by reviewer as non-relevant |
During adjudication, reviewers submit explicit API decisions that transition mapping records:
| Reviewer Decision (API) | Resulting Stored State / Action |
|---|---|
accept | Transitions mapping_state to accepted |
reject | Transitions mapping_state to rejected |
modify | Updates mapped segment_id or reviewer rationale without changing state |
reopen | Resets mapping_state to ai_suggested (if AI origin) or manual |
Gap Recommendations
When an expectation is determined to be missing or partially_addressed, the assessment engine generates structured recommendations:
| Recommendation Type | Recommended Remediation Action |
|---|---|
amend_existing_statement | Update existing policy clause to incorporate missing criteria |
add_statement | Insert a new atomic statement into the current policy section |
add_standard / add_procedure | Draft supporting standard operating procedures |
create_new_policy | Create a standalone corporate policy to address systemic deficiency |
mark_na | Formally record a justified out-of-scope determination |
raise_exception | Request a governed, time-bound policy exception |
keep_map_existing | Confirm existing text is sufficient without editorial modification |
These recommendations flow directly into the Gap Workbench for assignment and tracking.
Semantic Doctrine
Semantic Doctrine: Policy Coverage != Compliance
OrviQ enforces strict separation between structural policy coverage and operational compliance:
- Terminology is Policy Coverage: The metric produced by this module is strictly Policy Coverage %, never "Compliance %", "Assurance %", or "Control Effectiveness %".
- Mapping is not compliance: Linking an internal policy clause to a regulatory standard proves design intention; it does not demonstrate operational adherence.
- Coverage is not effectiveness: Demonstrating that 100% of policy expectations exist in written text does not prove that systems enforce the policy or that personnel adhere to it.
Permissions Reference
| Action | Permission Key | Required Role(s) |
|---|---|---|
| View policy assessments, segments, and results | policy_assessment.read | Tenant Admin, Compliance Manager, Compliance Officer, Auditor |
| Create assessment, upload source, run extraction | policy_assessment.run | Tenant Admin, Compliance Manager, Compliance Officer |
| Accept/reject mappings, assign results, complete assessment | policy_assessment.review | Tenant Admin, Compliance Manager |