How your readiness score is calculated

The free readiness checklist published by MSCi — Management System Compliance Incorporation — returns a score out of 100. This is exactly how that number is arrived at, because a score whose arithmetic is hidden is a score nobody should act on.

Every checklist adds to 100

Each question carries marks of its own, and the marks in a checklist sum to exactly 100. They are not equal: a question about leadership commitment or risk assessment carries more than one about a register, because that reflects where an audit spends its time and where a failure costs most.

The checklist will not be saved in our own system unless the marks add to 100, which is a deliberate constraint. A score "out of 100" that is really out of 97 misleads everybody who reads it.

What each answer earns

• Yes — the question's full marks
• Maybe or partly — half
• Not sure — a quarter
• No — nothing

Not sure earning a quarter is the one that surprises people. Not knowing whether something exists is a smaller gap than knowing it does not — in practice it usually means the control exists and the person answering has not seen the evidence. Scoring it zero would push people to guess Yes, and the exercise would stop measuring anything.

A question left unanswered earns nothing, exactly as No does. You are told which ones those are before the score is calculated.

Where the score is worked out

On our server, from the answers stored against your run and the checklist held in our database — never in your browser. A score that could be edited on the way to the report would not be worth sending anyone.

Why the marks are hidden while you answer

During the assessment no marks are shown, and they are not sent to the browser at all. Somebody who can see that a question is worth four marks answers it differently from somebody reading the question. The marks appear for the first time in the emailed report, question by question, once the answering is finished.

The bands

The score falls into one of ten bands, each ten points wide. The band decides three things: what your position is called, what it means in practice, and what to ask us for. A score of 34 and a score of 38 get the same advice, because the difference between them is smaller than the error in any self assessment.

The bands and their wording are maintained by us and can change as the standards do. What does not change is the arithmetic above.

The heaviest gaps

Alongside the score you are given the questions you answered No or Maybe to, ranked by the marks they carry — the eight heaviest. This is the most immediately useful part of the report: it is the shortest route from where you are to a better position, and it is what a sensible proposal should lead with.

What the number does not mean

It is a measure of what you can currently answer for, judged by you. It is not a prediction of an audit result, and it is not a substitute for a gap assessment: recommendations follow from the answers given, and the actual position has to be established by an expert against the evidence.

Two organisations on 55 can be months apart. The score narrows the question. It does not close it.

About the author

Prem Kumar Dvivedi is an auditor with more than forty years in this industry. He has spent that time on both sides of the table — building management systems and auditing them — across quality, environment, health and safety, food safety and information security.