Annual planning cycle

Dashboard

Coverage gaps and the highest-priority entities, as of the 2026-07-01 plan date · model v1

Audit coverage (36 mo)

67%

20 of 30 entities

Open high/critical issues

open or in progress

Cyber-driven candidates

cyber exposure ≥ 50

Advisory opportunities

opportunity score ≥ 60

Priority by domain

Average annual priority score per audit domain

48(17)

OPS

39(14)

INTEGRATED

50(10)

ADVISORY

50(5)

Bar length is the 0–100 priority scale; (n) is entity count.

Open issues by severity

Open and in-progress issues across the universe

CRITICAL

HIGH

Top annual plan candidates

Highest annual priority scores across the universe

View full universe

#	Entity	Criticality	Priority	Urgency	Coverage
1	Generative AI Knowledge Assistant ADVISORY, IT	HIGH	70	45	18
2	Digital Onboarding Journey IT, OPS	HIGH	67	53	26
3	Customer Data Domain IT, INTEGRATED	CRITICAL

Score explanation

Annual priority · model v1

Explainable

Generative AI Knowledge Assistant scores 70/100 for annual plan priority under the ADVISORY weighting profile (model v1). Top drivers: strategic overlay (75/100 raw, 25% weight), data & ai risk (90/100 raw, 20% weight), time since last audit (100/100 raw, 10% weight).

Strategic overlay — Drivers: lifecycle onboarding, emerging AI footprint.
Data & AI risk — Drivers: sensitive data, AI usage, 2 data/AI governance signal(s).
Time since last audit — Never audited.

Full factor breakdown

Factor	Raw	Weight	Contribution
Inherent risk	60	15%	9
Control weakness	73	10%	7.3
Issue pressure	37	10%	3.7
Cyber exposure	30	10%	3
Data & AI risk	90	20%	18
Time since last audit	100	10%	10
Strategic overlay	75	25%	18.8

What these terms mean

Inherent riskHow much risk this entity would carry if none of its controls existed.
Blends the entity's linked risk scenarios with its business criticality: 60% from the strength-weighted average of the linked risk scores, 40% from criticality (low 25, moderate 50, high 75, critical 100). An entity with no linked risks falls back to 40% of its criticality alone — that scores low on purpose, because an unassessed entity should not outrank one with measured risk.
Example: A CRITICAL entity (100) with one linked risk scored 20/25 — normalised to (20 / 25) x 100 = 80 — scores 80 x 0.6 + 100 x 0.4 = 88. The same entity with no linked risks scores 100 x 0.4 = 40.
On this record: 60 — 3 linked risk scenario(s), strength-weighted inherent 50/100; HIGH criticality.
Control weaknessHow far the controls meant to mitigate this entity are failing or untested.
Averages the latest test result across every linked control — fail 100, never tested 70, partial 60, pass 0 — weighting key controls double. A control with no test on record counts 50. An entity with no linked controls at all scores 60, because missing assurance is a gap rather than a clean result.
Example: Two linked controls — a key control that failed (100 x 2) and a non-key control that passed (0 x 1) — score (200 + 0) / 3 = 66.7, rounded to 67.
On this record: 73 — 4 of 5 linked control(s) failed or partial on latest test. Key controls weighted double.
Issue pressureHow much unresolved audit history is weighing on this entity.
Adds up points across every linked issue. An open issue scores by severity (critical 40, high 25, moderate 12, low 5), plus 8 if it is past its due date and 6 if it is a repeat finding. An issue closed within the last year still carries a quarter of its severity points as residual signal; anything closed longer ago counts nothing. The total is capped at 100.