Review the control scorecard

Objectives

The quarterly control scorecard goes to the audit committee on Friday. Six metric definitions are up for review, and the team's position is that every one of them is 'already reported today'.

Accept the definitions someone outside the team could reproduce. Reject the ones that cannot survive a question about what they divide by, when they were true, or what they actually track.

Verdicts are accept or reject. Every rejection needs one reason code from: tool-denominator | no-window | count-not-aging | no-freshness.

H-1  MFA enrolment: 3,332 of 3,400 active admin accounts taken from the HR-backed identity inventory, evaluated daily, window 1-31 August.
H-2  Patch compliance: patched hosts divided by hosts the vulnerability scanner reported on this month.
H-3  Exception aging: open exceptions bucketed 0-30 / 31-90 / 90+ days against approved expiry, oldest item named.
H-4  Access review compliance: 98%. No period, no counts, no run date.
H-5  Exception health: count of open exceptions, quarter over quarter, presented as the risk trend.
H-6  Backup verification tile: renders the last successful check result; the tile carries no timestamp and no staleness threshold.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the request before the artefact

   Read each definition as an auditor would: what is the numerator, what is the denominator, over what window, and how old is this number allowed to be before it stops meaning anything?

2. Step 2

   Judge every line, including the boring ones

   Six entries, six verdicts. Skipping the two good ones is how the useful definitions get replaced by rounder-looking numbers next quarter.

   Every line in the fixture carries a verdict

3. Step 3

   Separate what is wrong from what is merely ugly

   A metric that improves when a measuring tool loses sight of something is broken regardless of how carefully it is computed. Check where each denominator comes from before you check the arithmetic.

   Two entries track activity rather than exposure: one counts records that a bulk close can reduce, the other reports a result whose age is invisible.

   Accept and reject land on the right lines

4. Step 4

   Say why, in the vocabulary the programme uses

   Reserve the denominator code for the entry whose population comes from the tool doing the measuring, and keep the two time-related codes apart: missing period is not the same failing as missing age.

   Each rejection cites a valid reason code

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.