Controls
Control vs finding
A finding is one scanner record about one resource. A control is the check itself. GovIntel scores controls and reports every resource.
What they are
A finding is a single record produced by the scanner: one check, evaluated against one resource, at one moment.
A control is the check itself — the governance question being asked, independent of how many resources it was asked about.
Why the distinction is load-bearing
Finding counts scale with the size of an estate. Adding twenty buckets to an account that fails a bucket-level control adds twenty findings and changes nothing about how that account is governed.
Control counts do not move when the estate grows. They move when governance changes, which is what a board is asking about.
| Finding | Control | |
|---|---|---|
| Unit | One resource, one check | One check |
| Scales with estate size | Yes | No |
| Used for scoring | No | Yes |
| Reported in the pack | As resource evidence under its control | As a row in the register and index |
What GovIntel does
Records are collapsed to distinct controls before scoring and before exposure estimation. The resources are not discarded — they are carried against the control and are what materiality is computed from.
So the pack reports both: 76 controls failed, and, for each one, every resource it was observed failing on.
Related
- Controls, not findings — the methodology page
- Materiality — what the resource counts are used for