Documentation score and implementation score should not be the same

One score hides too much

A control can look complete on paper and still fail in practice. The reverse also happens: a team may have a working technical safeguard with weak written ownership.

For compliance operators, these are different problems. Documentation gaps need policy work. Implementation gaps need engineering, operations, or process change.

What each score means

Documentation score should measure whether the team has clear, dated, reviewable written evidence. Implementation score should measure whether the control appears to operate in the system, workflow, or evidence trail.

• Documentation evidence: policies, procedures, registers, meeting records, approval notes

• Implementation evidence: configuration, scan signals, access settings, tests, logs, workflow activity

• Evidence confidence: source quality, age, linkage, and traceability

How this changes remediation

When the scores are split, remediation can become specific. The system can say whether to update a document, connect a source, run a test, or assign an owner.