Why confidence decays — and why your dashboard should say so
Most GRC dashboards print a static green tick. Frank prints an expiry date. Here's why every claim we publish carries one.
Compliance dashboards have a problem they refuse to name. They show you a state — green, amber, red — without telling you when that state will stop being true. The certificate is issued in March. The dashboard shows green for the rest of the year. By November, half the controls have drifted, three vendors have changed their offering, two engineers have left, and the dashboard still says green.
This is not a bug. It is a deliberate omission, and it is the single biggest reason boards get caught flat-footed.
Confidence is a window, not a stamp
When Frank publishes a posture, it publishes it as a single artefact — a coverage assertion. It is the claim made legible, and it carries four things a green tick never does:
- A posture — acceptable, conditional, or not acceptable — against a named obligation.
- A scope — exactly what the claim covers, and explicitly excludes.
- An expiry, expressed as
Holds until YYYY-MM-DD. - An evidence basis — the systems of record the claim reads from, and a decay schedule for how the posture degrades if no fresh evidence arrives.
The expiry is calculated, not declared. It is a function of the evidence half-life, the governed-exception schedule, and the dependency-risk fan-in. When you renew a piece of evidence, the date moves out. When an exception’s review window closes, the date moves in.
There is no path to “indefinite green”. The system refuses to render it.
What this changes in practice
Three concrete things shift when confidence has a date on it:
- The board agenda changes. “What expires this quarter?” becomes a real question, with a real list. The list is generated, not authored.
- Renewal becomes a budgeted activity. You can plan evidence collection against the decay schedule the same way you plan capacity against forecast load.
- Self-reporting stops being punished. A posture that quietly becomes stale is more dangerous than a posture that loudly declares itself conditional. Frank rewards the latter — pricing does not increase when an exception is filed.
What this is not
It is not a way to defer responsibility (“Frank said it was conditional, not us”). It is not a substitute for control ownership. It is not a green light because the date is far away.
It is the simplest honest answer to the question every regulator and every board will ask sooner or later: how do you know that’s still true?
You can see what your own scope still supports, and the date it stops. Start with obligation visibility — it will not reassure you or print a green tick. It will tell you what your evidence holds today, and when that expires.