Gaps & Roadmap
Gaps
A Gap is never created by hand — it’s automatically derived whenever a control’s current rating falls short of its pillar’s target:
gap size = target maturity level − current maturity level (only when positive)
The same gap record stays in place as ratings and targets change over time — it reopens, resizes, or closes rather than being deleted and recreated, which keeps its history intact.
From the engagement’s Gaps tab, you can edit:
| Field | Notes |
|---|---|
| Business impact | 1–5 — how much this gap matters to the business. |
| Implementation effort | 1–5 — how hard it is to close. |
| Recommendation | Free-text remediation guidance, stored alongside the gap. |
Priority score
Once both business impact and implementation effort are recorded, a priority score is calculated:
priority score = (gap size × business impact) / implementation effort
…then scaled by the firm-wide risk appetite and regulatory deadline multipliers. A gap missing either input shows no priority score yet — fill both in to rank it.
Use the Gaps list’s filters (pillar, standard, status) and sort options (priority score, gap size, pillar, standard) to work through the backlog, or check the rollup view for a severity summary per pillar/standard.
Roadmap
Add a gap to the Roadmap to turn it into a tracked remediation item.
| Field | Notes |
|---|---|
| Bucket | Quick win, Short term, Mid term, or Strategic. If you don’t pick one, it’s auto-suggested from implementation effort (lower effort → quicker bucket) — always overridable. |
| Owner name / contact | Who’s accountable for closing this item. |
| Effort estimate | Free text. |
| Cost estimate | Amount + currency. |
| Target start / completion dates | |
| Execution status | Not started, In progress, Completed, or Deferred — tracked independently of the underlying gap’s own status. |
An item shows as overdue (calculated live) if its target completion date has passed and it’s neither Completed nor Deferred.
Unlike ratings and gap details, the Roadmap stays editable through Finalized — it only locks once the engagement is Archived, since remediation work typically continues after the assessment itself is signed off.
Next step
Generate a Report to deliver the assessment, gaps, and roadmap to stakeholders.