Appearance
Status Definitions
Every status value used across OrviQ registers, grouped by what it describes.
Requirements
Demonstration workflow status
Where the work is, not what the outcome is.
| Status | Meaning |
|---|---|
| Not started | No demonstration work has begun |
| In progress | The owner is assembling the compliance position |
| Submitted | Submitted for first-line review |
| L1 approved | First-line review passed |
| Compliance review | With the compliance function for validation |
| Approved | The demonstration has been approved |
Compliance display
The current compliance position shown in the Requirements register.
| Value | Meaning |
|---|---|
| Complied | The obligation is met |
| Partially Complied | Genuine but incomplete compliance |
| Not Complied | The obligation is not met |
| Accepted Risk | A governed acceptance or exception covers the deviation |
| Awaiting Evidence | Waiting for supporting evidence |
| Awaiting Review | Evidence present, awaiting human review |
| In Progress | Assessment underway |
| Invalidated | A previous position has been invalidated |
| Not Applicable | Governed out of scope |
| Not Started | No assessment begun |
| Not assessed | No determination exists |
Each value carries a source: Final, Human review, AI recommendation or Derived.
An AI recommendation is not a determination
Where the source reads AI recommendation, the value is advisory and carries no governance authority.
Workflow status and compliance display are different axes
A requirement can be Approved in workflow terms and Partially Complied in compliance terms. That means the organisation completed and signed off an honest assessment identifying a gap.
Requirement assurance
The five-dimension model behind a determination.
Requirement satisfaction
| Value | Meaning |
|---|---|
satisfied | Controls effective, evidence current, coverage complete |
partially_satisfied | Genuine but incomplete assurance |
not_satisfied | A mapped control is ineffective, or direct evidence failed |
not_assessed | Insufficient evaluated information to conclude |
not_applicable | Governed as excluded through an approved applicability decision |
Governance disposition
| Value | Meaning |
|---|---|
compliant | Satisfaction is satisfied and no deviation applies |
accepted_deviation | An approved exception is in force |
remediation_required | Partially or not satisfied; remediation owed |
unassessed | No determination reached |
Evidence status
| Value | Meaning |
|---|---|
current | All supporting evidence active and fresh |
mixed | Some fresh, some stale or missing |
stale | Beyond the freshness window |
missing | No supporting evidence |
incomplete | Present but inconsistent across supporting controls |
Review state
| Value | Meaning |
|---|---|
reviewed | Signed off, with reviewer, timestamp and notes |
manual_review_required | Partial or negative satisfaction, or an active exception |
automated | Standing on deterministic telemetry, no outstanding review |
Applicability
Two independent states on every applicability record.
Applicability state
| Value | Meaning |
|---|---|
| Applicable | The obligation applies within this scope |
| Not Applicable | Does not apply, for a documented reason |
| Under Review | Determination not reached |
Governance state
| Value | Meaning |
|---|---|
draft | Recorded but not submitted |
pending_review | Awaiting an independent reviewer |
approved | Approved by someone other than the maker |
rejected | Returned by the reviewer |
Only an approved decision is authoritative
A Not Applicable decision in draft has no effect on your compliance position.
Controls
Control effectiveness
| Value | Meaning |
|---|---|
effective | All mandatory indicators pass, complete fresh coverage |
partially_effective | Passing evidence with coverage gaps, staleness, or a non-critical failure |
ineffective | A mandatory or critical indicator failed |
not_assessed | No usable evaluated evidence, or no indicators defined |
Control origin
| Value | Meaning |
|---|---|
organization | A native internal control |
reference_external | Ingested from a standards body |
reference_curated | A curated industry baseline |
reference_scf | From a common controls framework catalogue |
Crosswalk mappings
Mapping status
| Status | Meaning | Blocks a duplicate for the pair? |
|---|---|---|
proposed | Awaiting review | Yes |
review_required | Flagged for re-review | Yes |
approved | Authoritative | Yes |
rejected | Reviewed and declined | No |
retired | Previously valid, now ended | No |
Relationship types
equivalent, subset, superset, intersection, compensating, supporting, related, no_match.
See Relationship Types.
Mapping sources
manual, curated, scf, regulator, framework_crosswalk, imported, ai_suggested.
Confidence states
unspecified, low, medium, high, verified.
Evidence Fabric
Connection status
| Status | Meaning |
|---|---|
active | Operating normally |
inactive | Configured but not in use |
degraded | Reachable but not performing correctly |
error | Failing |
Collector status
draft, active, paused, retired.
Collector run status
| Status | Meaning |
|---|---|
queued | Waiting to execute |
running | In progress |
succeeded | Completed, produced assertions |
partial_success | Completed with some subjects unresolved |
failed | Did not complete |
Assertion observed state
| State | Meaning |
|---|---|
pass | The expected condition was met |
fail | It was not |
partial | Partially met |
info | Informational, no pass or fail judgement |
inconclusive | Could not be determined |
Assertion status
active, superseded, disputed, invalidated, archived.
Source origins
collector_run, manual_evidence, attestation, governed_test, push_api, webhook_push, trusted_integration.
Indicators
Indicator status
draft, active, paused, retired.
Evaluation rules
all_pass, threshold_pct, exact_match, qualitative_exists, custom_condition.
Criticality
low, medium, high, critical.
Frequency
continuous, hourly, daily, weekly, monthly, manual.
Result status
| Status | Meaning |
|---|---|
pass | The rule was satisfied |
fail | It was not |
unknown | Evaluation could not reach a verdict |
not_determined | Not yet evaluated |
stale | Underlying observations beyond their window |
error | Evaluation encountered an error, captured safely |
not_applicable | The indicator did not apply |
Only fail is a failure
not_determined, unknown, stale and error are information gaps. None is treated as a failing control.
Risks
Risk status
candidate, open, mitigating, accepted, closed, dismissed.
Treatment strategy
mitigate, avoid, transfer, accept.
Acceptance status
not_requested, requested, in_review, accepted, rejected, expired.
Treatment strategy accept is not acceptance status accepted
Setting the strategy to accept is planning intent. Governed acceptance requires a request, a justification, an expiry and independent approval.
Findings
Status vocabularies differ by source and are deliberately kept distinct.
RCSA / Control Assessment
| Status | Label |
|---|---|
open | Open |
remediating | Remediating |
closed | Closed |
Terminal: closed.
Regulatory / Requirement Assessment, and Third-Party Risk
| Status | Label |
|---|---|
open | Open |
assigned | Assigned |
in_remediation | In remediation |
under_review | Under review |
accepted | Accepted |
closed | Closed |
dismissed | Dismissed |
escalated | Escalated |
candidate | Risk candidate |
Terminal: closed, accepted, dismissed.
Audit validation status
pending_validation, validated_closed, reopened_failed_retest.
RCSA remediating and governed in_remediation are different states
They belong to different engines and must not be read as one. A merged filter would imply a state a source does not have.
Action plans
draft, pending, active, blocked, done, completed, overdue, retired.
done is not completed
done means work reported complete. completed means independently verified.
Exceptions
draft, requested, in_review, approved, rejected, active, expired, closed, revoked.
An exception is effective only when approved or active and the current time is within its validity window.
Policies
Draft, In Review, Under Revision, Published, Expired, Archived.
Attestation campaigns: draft, active, closed.
Audit
Audit plan status
draft, in_review, approved, rejected, archived.
Engagement status
draft, planning, scheduled, fieldwork, review, reporting, finalized, closed.
Engagement type
internal, regulatory, third_party, special.
Opinion
unqualified, qualified, adverse, disclaimer, generally_satisfactory, needs_improvement, unsatisfactory.
Sign-off status
draft, in_review, approved, rejected.
Procedure test result
| Result | Meaning |
|---|---|
not_tested | Not yet performed |
satisfactory | Operated as expected |
exceptions_noted | Operated, with exceptions identified |
unsatisfactory | Did not operate adequately |
not_applicable | Did not apply |
Procedure review status
pending, in_review, reviewed, returned.
Workpaper review status
draft, in_review, reviewed.
Regulatory inspections
Inspection status
active, drafting_response, in_review, response_submitted, follow_up, closed, archived.
Inspection type
supervisory_examination, thematic_review, ad_hoc_inquiry, desk_review, on_site_inspection.
Item validation state
unvalidated, internally_validated, independent_validated.
Correspondence type
letter_received, response_sent, meeting_notes, clarification_request, status_update.
Incidents
Incident status
draft, triage, investigating, remediation, in_review, closed, cancelled.
closed and cancelled are terminal. Direct transition to closed is prohibited from every state; closure requires governed review approval.
Category
operational, cyber_technology, fraud_financial_crime, compliance_regulatory, privacy_data_protection, third_party, conduct_market.
Severity
Low, Medium, High, Critical.
Reportability status
not_reportable, potentially_reportable, confirmed_reportable, submitted, regulator_acknowledged.
Severity does not determine reportability
They are independent assessments from different criteria.
Scope and assets
Asset status
active, decommissioned.
Asset type
application, server_endpoint, database, network_security, cloud_workload, saas, identity_security, other.
Environment
production, staging, development, dr, corporate.
Criticality
Critical, High, Medium, Low.
Data classification
Public, Internal, Confidential, Restricted.
Scope status
active, archived.
Scope type
population, qualitative.
Scope purpose
assessment, control_baseline, audit, regulatory_filing, certification, policy_boundary.
Third-party risk
Engagement status
Includes active and terminated.
Determination and classification record state
active, superseded, overridden.
Classification state
draft, issued, under_review, confirmed, superseded.
Questionnaire run state
open, responded, reviewed.
Decision outcomes
Approve, approve with conditions, reject, risk acceptance recorded.
Regulatory intelligence
Source type
webpage, document_feed, manual.
Source status
active, paused, retired.
Smart Extract
Session status
ready, extracting, review, published, failed.