Risk & Scoring
The critical ceiling
A green rating requires zero failing critical controls, and five or more force red. The ceiling moves the band, never the underlying score.
A weighted pass rate can absorb a small number of critical failures behind a large number of passing controls.
Three critical failures against 120 passing medium controls produces a 92.3 per cent pass rate and, arithmetically, a green rating. That is correct arithmetic and an indefensible governance statement: a board does not ask what proportion of controls passed. It asks whether any critical control is failing.
The rule
| Condition | Effect on the band |
|---|---|
| One or more critical controls failing | The overall band can never be green |
| Five or more critical controls failing | The overall band is forced to red |
Applied to the band, never the score
The numeric score is not altered. The arithmetic stays inspectable — a reader can recompute the weighted pass rate from the methodology page and get the same number the pack prints — while the band stays defensible.
When the ceiling has been applied, the pack says so explicitly. A reader who sees a score of 78 next to a red band is told why, rather than being left to assume an error.
Why five
Five is a threshold, not a discovery. It is published in the scoring configuration, printed on the methodology page of every board pack, and changed only as a deliberate, reviewed methodology change — because moving it would change every customer's rating at once.