Controlspan / Field notes   Enterprise GRC intelligenceResearch edition · October 2026 · US market
Scorecard / RESEARCH NOTE 05

4. How do you calculate scores without rewarding unsupported claims?

CONTROLSPAN RESEARCH DESKSECTION 09 · PAGE 5 OF 13Last updated 28 October 2026

Score suitability and evidence separately, then use the lower result. A convincing promise should not receive the same credit as a buyer-reproduced outcome.

Step A: Assign a suitability score

Score Meaning
0 Observed failure or confirmed inability to meet the requirement in the proposed scope
1 Meets only the weak anchor; material workarounds or unresolved dependencies
2 Better than the weak anchor but does not yet meet all conditions of the acceptable anchor
3 Meets every condition of the acceptable anchor
4 Meets the acceptable anchor and most strong-anchor conditions; remaining gaps are explicit
5 Meets every strong-anchor condition relevant to the agreed scope
U Unknown or not evaluated; capability has not been established

Use U, not “unsupported capability”, when something was not demonstrated. For conservative calculation, U earns zero points until resolved, but it remains visibly different from an observed failure.

Roadmap functionality receives no first-release capability credit. A promise to build something is evidence about a delivery dependency, not proof that the required capability exists.

Step B: Apply the evidence cap

Evidence level Maximum earned score What qualifies
E0: no usable evidence 0 No evidence, or evidence unrelated to the offered scope
E1: assertion 1 Sales statement, generic marketing material or an unverified response
E2: documented capability 2 Relevant technical documentation or a detailed design, without adequate validation of the proposed use
E3: observed or substantively reviewed 3 Witnessed buyer scenario; or reconciled commercial, security or delivery evidence appropriate to a documentary criterion
E4: buyer-validated 4 Buyer repeats the task or independently validates the relevant artefacts and dependencies
E5: operationally validated 5 E4 plus applicable exception, scale, recovery or lifecycle checks; contractual dependencies are in execution-ready agreed documents

Documentary criteria need equivalent proof, not artificial demonstrations. For C10, for example, E4 could mean finance has independently reconciled quantities and charges to the quote and statement of work. E5 additionally requires validated downside scenarios and agreed contractual treatment of material exposures. For C4, a signed plan alone does not establish that named people are available or that a migration dependency is achievable.

Apply the cap to the whole criterion only when the evidence covers its material requirements. One working integration does not validate every critical integration in scope.

Step C: Calculate the result

For each criterion:

Earned score = MIN(suitability score, evidence cap)

Weighted points = criterion weight × earned score ÷ 5

Total score = SUM(weighted points)

Store weights as numbers totalling 100. With weights in B2:B13 and earned scores in C2:C13, the spreadsheet formula is:

=SUMPRODUCT(B2:B13,C2:C13)/5

Calculate evidence coverage separately:

Evidence coverage = SUM(weights of criteria with adequate E3–E5 evidence)

Coverage measures the share of weighted scope with adequate proof. It is not a statistical confidence level, and high coverage does not imply high quality: a thoroughly tested failure has strong evidence but a low suitability score.

What happens to missing or inapplicable requirements?

  • Missing evidence: retain the weight and record U. Never shrink the denominator for one supplier.
  • Genuinely out-of-scope requirement: remove it consistently for every option before scoring and reallocate its weight.
  • AI excluded: the default adjustment is C12 from 2% to 0% and C8 from 5% to 7%. Confirm that excluded AI pathways are disabled or otherwise approved under C6.
  • Critical failed subtest: apply the relevant gate. Do not let successful minor tasks compensate for it.
← PREVIOUS PAGE3. What are the weighted enterprise GRC evaluation criteria?NEXT →5. What should every shortlisted supplier demonstrate?

Find the evidence.

Search across 188 research pages and 12 sections.