How Compliance Progress Is Calculated | AuditBadger Help Center

Overview

Every compliance project shows a single overall progress percentage, backed by eight section scores. The overall number is a weighted average — each section is scored from 0 to 100 on its own, then contributes a fixed share of the total.

Progress measures how much of the work is recorded in the platform, not whether an auditor will accept it. A project at 100% is one where every document, control, and piece of evidence has reached its final state in AuditBadger.

The Eight Sections And Their Weights

Documents — 20%
Controls — 20%
Evidence — 10%
Risks — 10%
Business Continuity — 10%
Vendors — 10%
Assets — 10%
Assessments — 10%

Each section is the plain average of the items inside it. Ten controls scoring 100, 50, and 0 average out the same way you would expect — no item is weighted more heavily than another within its section.

How Each Section Is Scored

Documents (20%)

Each policy document in the project scores:

10% — someone has edited it at least once
30% — published, when acknowledgements are required
90% — acknowledgement assignments have been sent
100% — published with no acknowledgement required, or every assigned person has responded

A document reaches 100% as soon as everyone assigned has either accepted or rejected the acknowledgement. Rejections still count as a response — the score reflects that the acknowledgement round is finished, not that everyone agreed.

Controls (20%)

Each control in scope scores:

10% — it has a description
50% — a policy document or a piece of evidence is linked to it
90% — implementation notes have been filled in
100% — marked as implemented, not applicable, or accepted as an exception

A control you deliberately rule out counts as complete. Marking something not applicable is a valid answer, and the score treats it that way.

Evidence (10%)

Each measured control scores by the furthest state any of its evidence has reached:

0% — no evidence attached
25% — evidence attached, still a draft
50% — evidence submitted for review
100% — evidence verified, or an automated check is passing

Automated checks that pass with exceptions count as fully covered, the same as a clean pass. See "Which Controls Are Measured For Evidence" below — this is the section people most often expect to be higher than it is.

Risks (10%)

Each risk in your account scores 100% once it has been assessed, and keeps that score through treatment planning, treatment, acceptance, and closure. Risks still in draft or merely identified score 0%.

In other words: identifying a risk does not move the number. Assessing it does.

Business Continuity (10%)

Each active business continuity process scores:

0% — no exercises have been created for its plans
50% — an exercise exists but has not been completed
100% — at least one exercise has been completed

Archived processes are ignored entirely.

Vendors (10%)

Each vendor scores by its review posture:

100% — assessed, assurance reviewed, or recorded as an assurance exception
50% — an assessment is in progress, or known-vendor data is available but not yet reviewed
0% — never reviewed, review due, or action required

Assets (10%)

This section is all-or-nothing: 100% if your account has at least one infrastructure asset recorded, 0% if the inventory is empty.

Assessments (10%)

Each assessment attached to the project scores 50% while it is open and 100% once completed.

Three Rules That Surprise People

Empty sections count as zero, not "not applicable"

A section with nothing in it scores 0% and still carries its full weight. An account with no risks recorded loses the entire 10% risk weighting — the section is not skipped and the remaining weights are not redistributed.

This is the most common reason a project that "feels done" sits in the seventies. Before chasing individual items, check whether an entire section is empty.

Four sections are account-wide, not project-specific

Risks, Business Continuity, Vendors, and Assets are scored across your whole account, not per project. If you run a SOC 2 project and an ISO 27001 project side by side, both show the same score for those four sections, and work recorded in one immediately moves the number in the other.

Documents, Controls, Evidence, and Assessments are specific to the project.

Out-of-scope sections are excluded

Controls belonging to a framework section you have marked as skipped are left out of both the Controls and Evidence sections — they are not counted as incomplete. Narrowing scope raises your percentage legitimately.

Which Controls Are Measured For Evidence

The Evidence section does not measure every control. A control is included when it is applicable and not a linked copy of another control, and then when either of the following is true:

it is expected to hold evidence directly — it has no structural sub-controls beneath it, and it is not a criteria-level heading such as a SOC 2 Trust Services Criterion
it actually has evidence attached, whatever its position in the hierarchy

Two consequences are worth understanding:

Parent controls with structural sub-controls are not measured directly. Their sub-controls are measured instead. Attaching evidence to the parent of a broken-down control does not raise the score — attach it to the sub-controls that need it.

In ISO 27001, a control with attached supporting sub-controls can still hold its own evidence, and that evidence is counted. Attaching a shared sub-control to a control does not stop the control itself from carrying evidence. If it has its own evidence, it is scored on its own; if it has none, it stays out of the calculation and its sub-controls carry the coverage.

Controls marked not applicable or accepted as an exception are excluded from the Evidence section entirely. They do not need evidence, so counting them as uncovered would understate your position.

When The Number Updates

Progress is recalculated in the background whenever meaningful work is recorded, including:

editing, publishing, or assigning a policy document, and completing an acknowledgement round
generating a control description, linking a policy, adding implementation notes, or marking a control implemented
adding evidence to a control, and any change to that evidence's state — submitted, verified, rejected, or expired
an automated evidence check returning a new result
assessing or treating a risk
creating or completing a business continuity exercise
preparing or finishing a vendor assessment
adding an asset
starting or finishing an assessment

There is no nightly recalculation. The number is event-driven, so it updates within moments of the action rather than on a schedule. Recalculation runs in the background — if a percentage looks stale immediately after a bulk change, refresh the page after a few seconds.

Raising Your Percentage

In rough order of return on effort:

Look for empty sections first. Recording a handful of vendors or a single infrastructure asset can move the overall number several points, because each section carries a fixed 10-20% share.
Finish acknowledgement rounds. A published document sits at 30% until assignments go out and people respond. Chasing the last few acknowledgements converts 30% into 100% for that document.
Verify evidence rather than leaving it submitted. Submitted evidence scores 50%; verified scores 100%. For automated sources, a passing check gets you to 100% without manual review.
Mark genuinely irrelevant controls as not applicable. This scores them as complete in the Controls section and removes them from the Evidence section.
Assess risks you have already identified. An identified-but-unassessed risk scores zero; assessing it scores full.
Complete a business continuity exercise. A planned exercise is worth 50%, a completed one 100%.

Troubleshooting

"My evidence percentage is lower than I expected, but my sub-controls all have evidence."

Check whether evidence is attached to parent controls that have structural sub-controls beneath them. Those parents are not measured; their sub-controls are. Also check for sub-controls with no evidence at all — a single uncovered control scores zero and pulls the average down more than a partially covered one.

"I marked controls as not applicable and nothing changed."

Not-applicable controls score 100% in the Controls section and are removed from the Evidence section. If neither number moved, confirm the status saved and that the controls belong to a section that is in scope.

"Two of my projects show the same score for risks and vendors."

That is expected. Those sections are account-wide. See "Three Rules That Surprise People" above.

"The number did not change after I did the work."

Recalculation is queued in the background rather than run on the spot. Give it a few seconds and reload. If it still has not moved, the item you changed may not affect a scored state — for example, editing the description of an already-implemented control does not change its score, because it is already at 100%.