← Control library
E03 · Evidence
Scope and residual-risk statement
Readers interpret a narrow result as a guarantee for the entire organization or future versions.
Requirement
Publish the assessed version, environment, use, exclusions, failed or untested areas, residual risks and review triggers beside the result.
Expected evidence
- Signed scope and residual-risk section.
- Consistency check across report, register and public claims.
Proposed verification
- Ask an independent reviewer what is and is not covered.
- Confirm critical failures remain visible and cannot be averaged away.
Limit
Clear limits reduce misinterpretation but cannot control third-party marketing statements.