Maturity, assurance & N/A
Maturity scale
Section titled “Maturity scale”| Score | Label | Meaning |
|---|---|---|
| 1 | Not Addressed | No process, documentation or controls address the item |
| 2 | Initial | Work is ad hoc, incomplete or weakly documented |
| 3 | Defined | A documented process exists and is followed |
| 4 | Managed | Practice is measured, reviewed and consistently applied |
| 5 | Optimised | Practice is integrated, evidence-rich and continually improved |
Maturity describes how established the practice is. It does not state whether the resulting impact is acceptable.
Assurance depth
Section titled “Assurance depth”| Depth | Meaning |
|---|---|
| Unverified | No objective evidence evaluated |
| Documented | Approved documentation inspected |
| Implemented | Practice sampled in operation |
| Assured | Operating effectiveness independently verified |
A maturity 4 claim at Unverified assurance is an unsupported assertion. A maturity 1 result can be Assured where strong evidence confirms that the practice is absent.
Rationale
Section titled “Rationale”Explain:
- System-specific facts.
- Evidence and sample.
- Observed result.
- Affected-party perspective.
- Exceptions and uncertainty.
- Treatment or decision.
- Owner and reassessment trigger.
Generic statements such as “policy exists” are insufficient.
Not applicable
Section titled “Not applicable”An item should be marked N/A only where the selected system and assessment context make the guidance genuinely irrelevant. Record:
- Detailed reason.
- Clause and contextual basis.
- Information limitation or alternative assessment where relevant.
- Decision owner.
- Review date.
- Human approval.
Until these fields are complete and approved, N/A does not remove the item from scope.
Do not use N/A because:
- Evidence is missing.
- Work has not started.
- The organisation relies on a supplier.
- An impact is difficult to measure.
- Affected parties were not available.
- Another framework covers similar work.
Coverage
Section titled “Coverage”Coverage includes each assessed or validly excluded atomic item. Unassessed items remain visible and prevent an incomplete assessment from appearing mature.
Read section averages alongside:
- Assessment coverage.
- Assurance depth.
- N/A count and basis.
- Failed tests.
- Findings.
- Impact severity and residual uncertainty.
Example interpretations
Section titled “Example interpretations”- Defined + Documented: a method exists and was reviewed, but operating use has not been sampled.
- Managed + Implemented: the method operates consistently and measurement was sampled.
- Optimised + Assured: independent evidence supports integrated practice and improvement.
- Not Addressed + Assured: absence is well evidenced and should drive a finding or treatment.