Control States
PASS, PARTIAL, FAIL, EVIDENCE GAP, NOT APPLICABLE and EXCEPTION — precise definitions.
Updated Aug 13, 2026Product 2026.95 minMSP operator, Internal IT, Auditor
Prerequisites
- A framework enabled for at least one customer
Overview
Every control AssurIQ tracks sits in exactly one of six states at any point in time. These states are deliberately precise so a report never has to guess what a percentage actually means.
The six states
| State | Definition |
|---|---|
| PASS | Current evidence confirms the control is operating as required |
| PARTIAL | The control is in place but with a known gap, incomplete coverage, or an in-progress remediation |
| FAIL | Current evidence confirms the control is not operating as required |
| EVIDENCE GAP | No sufficient evidence yet exists to evaluate the control |
| NOT APPLICABLE | The control is out of scope for this asset class, site or environment |
| EXCEPTION | A documented, owned, time-bound risk acceptance overrides the raw evaluation |
How states change
States change automatically as new evidence arrives from collectors, connectors and manual uploads, or when an authorized user sets an exception or marks a control not applicable with justification. Every transition is recorded; nothing is overwritten.
Exception vs. FAIL
An EXCEPTION is not a way to hide a FAIL. It requires an owner, a reason, and an expiry date, and it remains visible in reports as an exception rather than a pass — reviewers can always see that a decision was made to accept the risk rather than fix it.
Related playbooks
Was this helpful?