Compliance Health
See how Muin computes your compliance score across seven weighted factors, read the exec summary on the landing page, and act on what is driving your posture.
Compliance Health is the /compliance landing page. It answers two questions at a glance: where are we today (what needs attention this week) and how healthy is our program overall (what’s the score and what’s driving it).
The page has two tabs — Today and Health — with the tab state kept in the URL so a deep-linked /compliance?tab=health reopens exactly where you left off.
The Two Tabs
| Tab | What it shows | Who opens it |
|---|---|---|
| Today (default) | Action items due this week: overdue attestations, DSARs inside their 30-day window, licenses expiring soon, incidents without an owner | Compliance leads working the queue |
| Health | Overall score gauge, the seven score factors broken out, per-framework completion, evidence freshness trends | Execs reading posture; auditors doing readiness checks |
There is no separate Overview page — the former Overview and former Dashboard are merged into these two tabs (Plan 272j IS22). One URL, one landing.
The Compliance Score
Your overall score is a weighted aggregate across seven factors. The formula is defined in one place (ComplianceScoreService.WEIGHTS) and the same formula drives both the landing gauge and the Health tab breakdown — so the number you see on /compliance and the number you see after clicking Health never disagree.
The Seven Factors (exact weights)
| Factor | Weight | What it measures |
|---|---|---|
| Framework completion | 25% | Share of framework controls marked implemented, tested, or certified |
| Risk management | 20% | Share of identified risks that are mitigated or accepted (not open) |
| Training compliance | 15% | Completion rate across assigned programs that are currently in-window |
| Policy documentation | 15% | Share of active policies with current versions and fresh review dates |
| Evidence freshness | 10% | Share of evidence items refreshed within their configured TTL |
| Vendor assessment | 10% | Share of active vendors that have a current risk tier set |
| License compliance | 5% | Share of tracked licenses that are current (not expired, not inside the alert window without action) |
The weights sum to 1.00. If you want them audited, muin.server/src/services/compliance/score_service.py line 40 is the source of truth — the marketing page will never drift from it because CI verifies this table against the constant on every build.
Score Ranges
| Score | Readiness badge | What it means |
|---|---|---|
| 80–100 | Audit-ready | Above the default SOC 2 readiness threshold (80). The gauge flips green. |
| 60–79 | Approaching | Notable gaps; the exec summary cites the two or three top drivers |
| 40–59 | Action needed | Significant gaps across multiple factors |
| 0–39 | Critical | Multiple factors at or near zero; use the At-a-Glance card to pick the first thing to fix |
The 80 threshold is tunable per framework — Frameworks → Framework detail → Readiness threshold. The gauge re-reads that value every time the page loads, so raising or lowering the threshold moves the “audit-ready” line immediately without a recompute.
When the Gauge Says “Not Assessed Yet”
Score calculation needs data. A brand-new tenant with zero frameworks, zero policies, zero training, zero risks, and zero vendors has nothing to score — the gauge renders the empty state rather than “0/100”. Completing the Getting Started checklist (a framework, a policy, a first training assignment) moves the gauge off the empty state within minutes.
The At-a-Glance Exec Summary
Below the gauge is a narrative card — Compliance at a glance — that translates the score into 2–4 sentences. It cites the specific factors and control IDs dragging the posture, grounded in the tenant’s current breakdown.
┌─ Compliance at a glance ─────────────────── [LLM ● Fresh] ─┐
│ │
│ Framework completion is the single biggest lift at 62% │
│ — SOC 2 CC6.1 and CC7.2 still have untested controls. Risk │
│ management is healthy at 88%; training is on track. Close │
│ the two framework gaps to clear the audit-ready threshold. │
│ │
│ Score 74/100 ↑ +2.3 vs last week Touches: CC6.1 CC7.2 │
└─────────────────────────────────────────────────────────────┘Summary Source Badge
Every At-a-Glance card shows a source badge so you always know where the copy came from:
| Badge | What it means | When it fires |
|---|---|---|
| LLM | Bedrock Claude wrote this narrative grounded in your current breakdown | Most of the time |
| Fallback | A deterministic rule-based narrative fired because the LLM was slow, rate-limited, or returned something that failed the citation fence | When safer to show an honest rule-based summary than risk a hallucinated one |
| Network error | Summary temporarily unavailable; numeric score is still accurate | Transient — a refresh retries |
The fence rejects narratives that cite controls or factors not present in the tenant’s actual breakdown. If the LLM output fails the fence, the fallback narrative fires instead — the badge always reflects what you’re actually reading. You never see a fake LLM summary pretending it wrote something the fallback wrote.
Trend Delta
The +2.3 vs last week readout compares the current overall score to the value from seven days ago. Values between −0.5 and +0.5 render as “Stable” — small oscillations from cache expiry or minor data refreshes don’t get flagged as movement.
Dashboard Walk-through
Today Tab
The Today tab is a work queue. It aggregates items that need a human decision this week across all of compliance:
| Widget | Pulled from | Click-through goes to |
|---|---|---|
| My pending compliance work | Attestations due, DSARs you own, tasks assigned to you | The originating page (policy, DSAR, HumanTask) |
| Active compliance workflows | Workflow runs currently in progress | Workflows module → run detail |
| Compliance review queue | Items routed to a compliance reviewer (policy acks, questionnaire approvals) | The reviewer’s inbox for that item |
| Recent alerts | New regulatory alerts + drift notifications surfaced in the last 7 days | Regulatory Alerts detail or Frameworks page |
Employees who aren’t compliance owners mostly live in My pending compliance work — it’s the single place to see “what does compliance want from me today.”
Health Tab
The Health tab is the analytical view:
| Section | What it shows |
|---|---|
| Overall gauge + At-a-Glance | The numeric score, readiness badge, and exec summary narrative |
| Score breakdown | Each of the seven factors with its current value and weight contribution |
| Framework cards | Each active framework with its own completion percentage and control counts |
| Evidence freshness | Distribution of evidence items by age band (0–30d / 30–90d / 90d+) |
| Deadline list | Upcoming policy reviews, attestations, license renewals, and certifications in the next 30 days |
Click any framework card to open that framework’s detail page (see Frameworks). Click an evidence age band to filter the Documents tab to items in that band.
How Scores Change
Scores are cached for 5 minutes (ComplianceScoreService.CACHE_TTL_SECONDS), so small edits don’t thrash the gauge. After that window the next load recomputes against live data.
Actions that immediately invalidate the cache:
- Implementing or testing a control
- Closing a risk (moving it out of
openstatus) - Completing a training assignment
- Refreshing evidence (uploading a new version)
- Renewing a license
- Setting a vendor’s risk tier
- Publishing a new policy version
Other edits (descriptions, tags, assignee changes that don’t affect status) don’t move the score — the formula reads status fields, not prose.
FAQs
How does the score work?
Your score is a weighted sum of seven factors (see the table above). Each factor is a ratio in [0, 1] — for example, training compliance is “programs completed / programs assigned and in-window.” Each ratio is multiplied by its weight, and the sum is scaled to 0–100. The seven weights sum to 1.00 and are defined in ComplianceScoreService.WEIGHTS.
Why does it say “Not assessed yet”?
The tenant has no active frameworks, policies, training, risks, or vendors yet — there’s nothing to measure. Add any of those (usually, activating your first framework is the fastest step) and the score starts computing within minutes.
What affects my score the most?
Framework completion (25%) and Risk management (20%) combined make up 45% of the score, so those two move the needle fastest. In practice, the At-a-Glance narrative tells you which factor is currently the biggest drag for your specific tenant — usually the one with the lowest ratio, not necessarily the one with the highest weight.
Is the AI exec summary a hallucination risk?
The backend enforces a citation fence: any framework, factor, or control code the LLM names must actually exist in your tenant’s current breakdown. Narratives that fail the fence get replaced with a deterministic rule-based summary, and the Fallback badge is shown so you know. The numeric score shown above the card is always computed from real data, never from the LLM.
Why did my score drop by a point overnight with no changes?
Evidence freshness decays with time. A document that was 29 days old yesterday and 30 days old today may have crossed a freshness band, reducing its contribution. This is expected behavior — the factor is meant to decay. Refreshing evidence in the Documents module restores it.
Can I change the weights?
Not for beta. The seven weights are tuned across the platform and CI verifies the doc table matches the code constant. Adjustable weights are tracked in Plan 276 for post-beta.
Related
- Frameworks — activate SOC 2, GDPR, HIPAA, and custom frameworks
- Risk register — how the 20% risk factor is computed
- Licenses and permits — the 5% license factor
- Score engine reference — the algorithmic detail for score history, drift, and remediation