A reviewer-attested uncontrolled critical exposure demands immediate executive attention and containment.
Donegal Readiness · Board Assurance
A Board needs a judgment.
A Board needs a judgment.
Not another percentage.
A favorable average can conceal critical exposure. A high compliance score can conceal a process that does not operate. And missing evidence is not evidence of safety.
A provisional, evidence-gated conclusion above the underlying assessment—where the unknowns, conditions and accountable decisions stay visible.
Research-stage methodology · Not a calibrated assurance opinion, certification or product availability guarantee
DONEGAL / BOARD ASSURANCEMethod preview
GRAYInsufficient AssuranceUnknown is not safe.
Board decision required
Approve the boundary and risk appetite, identify critical dependencies, and request reviewed operating evidence before drawing a controlled conclusion.
See the supporting model →- Rated intersections
- 0 / 20
- Risk appetite
- Not documented
- Independent challenge
- Not established
- Confidence
- Insufficient
Unassessed illustration—not a live rating, product certification or independent assurance opinion.
06possible Board states
05independent measures
04operating domains
20evidence-qualified intersections
Board-first judgmentUnknown is not zero.
Unknown is not zero.
Unknown is a question.
Compliance, maturity, improvement, capability and residual risk are not interchangeable. Higher residual risk is worse. No average can cancel an uncontrolled critical condition.
The Deming/PDSA improvement and organizational actualization dimensions reflect the founder’s own dissertation research, independent work and practical experience. Donegal’s assessment rubric is developed independently, not derived from a former employer’s proprietary materials.
Confirmed uncontrolled critical exposure can warrant Red even with sparse coverage. Without confirmed adverse evidence, an otherwise insufficiently assessed organization remains Gray—not Green, and not automatically Red.
Explore the decision states →Executive signal
Six states. No false comfort.
Possible research-method outcomes, not scores assigned to any customer. Every color requires its own scope, evidence and recorded reasoning.
Recorded exposure is outside approved appetite, or critical residual exposure needs a formal disposition.
A substantiated material weakness or high residual exposure requires management treatment.
Risk is reviewed as within appetite, but sustained evidence or independent challenge remains incomplete.
Approved appetite, critical dependencies, assessed eligible cells, sustained performance and independent challenge.
Incomplete scope, appetite, critical dependencies or evidence. Gray is not a declaration of safety.
Priority matters. Confirmed uncontrolled critical risk outranks missing data. Verified exposure outside appetite requires action. Gray is not lower than Red: it means the evidence is insufficient for a safe conclusion. Green requires sustained results and independent review—not just documents.
Supporting proof · 5 × 4Twenty questions.
Twenty questions.
No invented answers.
Each intersection needs dated, scoped evidence and an assessor rationale. A blank cell is not a failing zero and cannot be promoted by an unrelated questionnaire.
Illustrative unassessed profile0 of 20 rated
| Measure | Organizational | People | Physical | Technological |
|---|---|---|---|---|
| ComplianceRelevant obligations and implementation | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required |
| Process maturityConsistency and control over time | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required |
| PDSA improvementMeasured operational improvement | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required |
| ActualizationPurpose-fit, sustainable capability | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required |
| Residual riskExposure after controls; higher is worse | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required | Not assessedEvidence and review required |
Unknown ≠ zero. Absence of evidence does not create a numeric rating.Risk is directional. Severe residual exposure is never averaged away.
From assessment to decision
The next Board action is part of the answer.
A useful assurance report changes what someone decides, owns or checks next. The Board conclusion appears first; the traceable five-by-four model and distinct framework reports remain beneath.
CRA, ISO 27001 and NIS2 each preserve their own scope. An inherent CRA finding is not automatically an enterprise-wide residual-risk grade, and the Lite introduction does not unlock full-workflow reports.
Donegal Readiness
Begin with what you can prove.
Explore Readiness through your Donegal account. Your Portal shows the currently available tools and the access applicable to your subscription. Independent advisory and technical assessments are separately scoped and paid.
Board Assurance remains provisional. This product does not make regulatory conformity decisions, issue certifications or provide an independent assurance opinion.