Simulated data · as of 2026-09-30

Executive risk and assurance dashboard

One view across the five case studies. Values are computed from the shared synthetic datasets, not typed in, and every chart has a table and a download.

Simulated. Fictional company, synthetic data. Not client work or an assurance opinion. Projects are counted separately (findings, vendor issues, framework gaps, AI gates) and are not blended into one score. Tested controls were chosen by risk, so results do not describe the whole control environment.

Filters

Filters apply to findings, remediation actions, vendor issues and control tests where that field exists. Vendor, AI and framework-gap figures have no severity or domain and are not filtered.

Key indicators

12 findings

Open audit findings

Definition

Findings from the Project 1 ITGC audit that are not closed by retest and not formally risk-accepted.

Calculation: count(findings where status not in {'Closed (retested)','Risk accepted'})

Source: data/analysis/findings.csv

Rules: Includes inconclusive F-13 and partially remediated findings. Excludes 2 closed or accepted. Project 1 only; vendor issues and framework gaps are counted separately.

As of: 2026-09-30 (simulated) · Case study

5 findings

Open High findings

Definition

Open Project 1 findings rated High.

Calculation: count(open findings where severity = 'High')

Source: data/analysis/findings.csv

Rules: Same inclusion as K01.

As of: 2026-09-30 (simulated) · Case study

7 findings

Open Medium findings

Definition

Open Project 1 findings rated Medium.

Calculation: count(open findings where severity = 'Medium')

Source: data/analysis/findings.csv

Rules: Same inclusion as K01.

As of: 2026-09-30 (simulated) · Case study

0 findings

Open Low findings

Definition

Open Project 1 findings rated Low.

Calculation: count(open findings where severity = 'Low')

Source: data/analysis/findings.csv

Rules: Same inclusion as K01.

As of: 2026-09-30 (simulated) · Case study

6 items

Overdue remediation items

Definition

Remediation actions (Project 1) plus vendor remediation issues (Project 3) past their due date and not validated complete.

Calculation: P1: count(actions where target_date < as_of and not (Completed and retest Pass)); P3: count(issues where overdue = Yes and status != Closed)

Source: data/analysis/remediation_actions.csv; projects/03-third-party-risk/remediation-and-monitoring-tracker.csv

Rules: P1 contributes 1, P3 contributes 5. A management-reported completion that failed retest still counts as overdue.

As of: 2026-09-30 (simulated) · Case study

12 tests

Controls tested not operating effectively

Definition

Project 1 control tests concluded 'Not operating effectively' out of 16 tests.

Calculation: count(control_tests where conclusion starts with 'Not operating effectively')

Source: data/analysis/control_tests.csv

Rules: Counts tests, not controls. 18 of 33 controls were not tested (see audit program). Conclusions are limited to the stated populations.

Note: Tested controls are a risk-based selection, not a random sample, so this is not a rate for the whole control environment.

As of: 2026-09-30 (simulated) · Case study

2 vendors

Vendors with High residual risk

Definition

Assessed vendors whose residual risk after considering the evidence is High.

Calculation: count(vendor_risk_register where residual_risk = 'High')

Source: projects/03-third-party-risk/vendor-risk-register.csv

Rules: Only the 3 vendors assessed in Project 3; the other vendors in the inventory were not assessed.

As of: 2026-09-30 (simulated) · Case study

0 use cases

AI use cases approved to proceed (unconditionally)

Definition

AI use cases with an unconditional approval decision.

Calculation: count(ai_use_case_inventory where decision starts with 'Approved')

Source: projects/04-ai-governance/ai-use-case-inventory.csv

Rules: Of 2 use cases: 1 Conditionally approved (limited pilot); 1 Not approved: must not proceed

As of: 2026-09-30 (simulated) · Case study

0 of 16 gates

AI approval gates evidenced

Definition

Approval gates for AI use cases with closing evidence on file.

Calculation: count(gates where status = Done) over count(gates)

Source: projects/04-ai-governance/ai-approval-gates.csv

Rules: Vendor-linked gates read their status from the Project 3 tracker.

As of: 2026-09-30 (simulated) · Case study

54 gaps

Audit-readiness gaps identified

Definition

Gaps found when 32 unified controls were assessed against the paraphrased framework requirements and Project 1 results.

Calculation: count(audit-readiness-gap-assessment rows)

Source: projects/02-unified-controls/audit-readiness-gap-assessment.csv

Rules: Gap types include missing evidence, operating failures, design weaknesses, mapping uncertainty and 'Not applicable' items.

As of: 2026-09-30 (simulated) · Case study

50 gaps

Actionable gaps (excluding Not applicable)

Definition

Gaps that need action, excluding rows recorded as not applicable.

Calculation: count(gaps where gap_type != 'Not applicable')

Source: projects/02-unified-controls/audit-readiness-gap-assessment.csv

Rules: 4 'Not applicable' rows excluded.

As of: 2026-09-30 (simulated) · Case study

0.93 ratio

AI evidence review: exception recall (held-out, assisted mode)

Definition

Share of the 43 labelled exceptions in the held-out set that the rules-plus-mock-model pipeline flagged as exceptions.

Calculation: TP / (TP + FN) from evaluation.json, held-out set of 108 cases

Source: projects/05-ai-evidence-review/evaluation.json

Rules: 95% interval 0.814-0.976. The 'model' is a heuristic mock, labels are author judgement, and no human review has been performed.

Note: Illustrative only; not evidence that AI improves audit quality.

As of: 2026-09-30 (simulated) · Case study

0 risks

Enterprise risks needing executive acceptance (recorded residual >= 15)

Definition

Enterprise risks whose recorded residual score meets the fictional executive-acceptance threshold.

Calculation: count(risks where residual_score >= 15)

Source: data/raw-synthetic/risks.csv

Rules: Residual scores are the pre-audit values recorded in the risk register. They were NOT re-rated after the audit results; see the heatmap note.

As of: 2026-09-30 (simulated) · Case study

Findings and remediation

Findings by severity and status

Open findings by time to target date

All findings share one report date, so age is uniform; time to target is shown instead.

Open findings by control domain

Control test outcomes

Project 1 remediation actions (validated state)

A management-reported completion that failed retest is not counted as complete.

Open vendor issues by age

Vendors, AI, gaps and enterprise risk

Enterprise risk heatmap (recorded residual, pre-audit)

These are the scores recorded before the audit. They have not been re-rated; the table on the page shows open audit findings against each risk as a signal for management to re-rate.

Count of enterprise risks by recorded residual likelihood and impact
	Impact 3	Impact 4
Likelihood 5	0	0
Likelihood 4	0	0
Likelihood 3	4 R-03, R-07, R-08, R-11	3 R-01, R-04, R-09
Likelihood 2	4 R-05, R-12, R-13, R-14	3 R-02, R-06, R-10
Likelihood 1	0	0

Enterprise risks and open audit findings

C10 Enterprise risks and open audit findings
Risk	Title	Recorded residual	Open P1 findings	Of which High
R-01	Inappropriate or unremoved user access	12	4	2
R-02	Misuse of privileged access	8	1	1
R-03	Unauthorised or untested production change	9	3	1
R-04	Data loss or unrecoverable systems	12	3	1
R-05	Security events not detected or acted on	6	1	0
R-06	Critical vendor failure	8	0	0
R-07	Vendor data exposure	9	0	0
R-08	Incorrect AI-generated customer response	9	0	0
R-09	Sensitive data exposed through an AI tool	12	0	0
R-10	Payment card data compromise	8	0	0
R-11	Unremediated vulnerabilities	9	0	0
R-12	Privacy breach or non-compliant retention	6	0	0
R-13	Insecure software development	6	0	0
R-14	Delayed incident response and notification	6	0	0

Vendor inherent versus residual risk

Only 3 vendors were assessed. Vendor V-02 moves up because of unanswered questionnaire items.

C7 Vendor inherent vs residual risk
Vendor	Tier	Inherent	Residual	Movement
Stratwick Managed Hosting Inc.	Tier 1	High	High	Same
Pinebrook Print and Mail Ltd.	Tier 3	Low	Medium	Up
Lumenvale AI Ltd.	Tier 2	Medium	High	Up

AI use-case decisions

C8 AI use-case decisions and risk
Use case	Name	Decision	Inherent	Residual as proposed	Target after gates	Gates evidenced
AI-01	Customer Support Response Assistant	Conditionally approved (limited pilot)	High	High	Medium	0 of 8
AI-02	Policy and Procedure Document Analyser	Not approved: must not proceed	High	High	Medium	0 of 8

Audit-readiness gaps by type and roadmap phase

C11 Audit-readiness gaps by type and roadmap phase
Gap type	By day 30	By day 60	By day 90	Total
Design weakness	3	2	2	7
Mapping uncertainty	0	3	6	9
Missing control	1	1	3	5
Missing evidence	1	5	12	18
Not applicable	0	0	4	4
Operating failure	5	5	1	11

AI evidence review variants

Mock model, author-labelled synthetic cases, no human review. Recall confidence intervals for rules-only and assisted overlap.

C12 AI evidence review variants (held-out 108 cases)
Variant	Precision	Recall	F1	False-positive rate	Abstention rate
Rules only	0.94	0.7	0.8	0.057	0.33
Mock text-only	0.95	0.95	0.95	0.057	0.08
Assisted	0.95	0.93	0.94	0.057	0.19

Methodology and downloads

Definitions, formulas and inclusion rules for every indicator are in each indicator's Definition panel and in the methodology document. A test re-derives the headline figures from the source CSV files independently of the build, and chart totals are checked against source row counts.

Related: the continuous monitoring demo, a simulated daily replay of three audit tests with exception tracking and alerts.

Dashboard summaryPDF · 14 KB
Dashboard workbookXLSX · 30 KB
KPI definitions and values (CSV)CSV · 4 KB
All chart tables (CSV)CSV · 26 KB
Dashboard dataset (JSON)JSON · 44 KB
Methodology (Markdown)MD · 10 KB

Chart tables (default view)

C1 Findings by severity and status
Severity	Open	Closed or accepted	Total
High	5	1	6
Medium	7	0	7
Low	0	1	1

C2 Open findings by time to target date
Time to target date	High	Medium
Due within 30 days	0	0
Due in 31-60 days	5	0
Due in 61-90 days	0	7
Due in more than 90 days	0	0

C3 Open findings by control domain
Domain	High	Medium	Total
Change management	1	2	3
IT operations	1	2	3
Identity and access	2	2	4
Logging and monitoring	0	1	1
Privileged access	1	0	1

C4 Control test outcomes
Outcome	Tests
Effective with exceptions within tolerance	3
Not operating effectively	12
Inconclusive	1

C5 Project 1 remediation actions by validated state
State	Actions
Not started	11
In progress	2
Complete and retest passed	2
Reported complete, retest failed	1

C6 Open vendor issues by age and severity
Age since opened	High	Medium	Low
0-14 days	11	2	0
15-30 days	0	0	0
31+ days	2	1	2