Deterministic rules
Code applies these rules. The AI never produces a rating, tier or decision. All rules are Confirmed by the analyst (2026-11-02).
- IRA answer ratings Confirmed
Each Yes/No answer has a fixed rating per question (see table). "Unknown" is always Medium and opens a follow-up.
- Inherent risk Confirmed
High if IRA-02 (customer PII) or IRA-03 (regulated info) is Yes, or 4+ answers are rated High. Low if no answers are High and 2 or fewer are Medium. Otherwise Medium.
- Tier and review cadence Confirmed
High: Tier 1 (full SIG + evidence, annual review). Medium: Tier 2 (SIG Lite, review every 2 years). Low: Tier 3 (basic check, review at renewal).
- BC privacy (FIPPA) flag Confirmed
Triggered if data may leave Canada (IRA-13 Yes/Unknown) and personal information may be involved (IRA-02 or IRA-16 Yes/Unknown). A triggered flag opens a finding to confirm with the Privacy Office. Not legal advice.
- Control strength Confirmed
From confirmed questionnaire rows only. Strong: no Gaps and at most 10% Needs evidence. Adequate: at most 1 Gap. Weak: otherwise.
- Residual risk Confirmed
Strong: one level below inherent (min Low). Adequate: same as inherent. Weak: one level above (max High). "Provisional" while any Needs evidence row is open.
- Recommendation Confirmed
Escalate - do not approve yet if residual is High or control strength is Weak. Otherwise Approve with conditions if any finding is open (open follow-ups, confirmed Gaps and Needs evidence rows, a triggered FIPPA flag), else Approve.
IRA answers and the v1 back-test (Halden Advisory (fictional))
Answers are from the manual v1 assessment. “Unknown” always rates Medium and opens a follow-up.Halden Advisory is a fictional vendor. Vendor responses are illustrative and were written for this portfolio. They make no statement about any real organization's security practices.
| ID | Area | Question | Yes / No | Answer | Code rating | v1 rating |
|---|---|---|---|---|---|---|
| IRA-01 | Data | Will confidential information be shared? | High / Low | Yes | High | High |
| IRA-02 | Data | Will customer PII be accessed? | High / Low | No | Low | Low |
| IRA-03 | Data | Will regulated information be processed? | High / Low | No | Low | Low |
| IRA-04 | System Access | Will the vendor access internal systems? | Medium / Low | Yes | Medium | Medium |
| IRA-05 | System Access | Will the vendor require privileged access? | High / Low | No | Low | Low |
| IRA-06 | System Access | Will the vendor connect to the corporate network? | High / Low | No | Low | Low |
| IRA-07 | Service Criticality | Is this a business-critical service? | High / Low | Yes | High | High |
| IRA-08 | Service Criticality | Would an outage significantly impact operations? | High / Low | No | Low | Low |
| IRA-09 | Service Criticality | Is there an alternate vendor available? | Low / Medium | Yes | Low | Low |
| IRA-10 | Technology | Will the vendor host company data? | High / Low | No | Low | Low |
| IRA-11 | Technology | Will cloud services be used? | Medium / Low | No | Low | Low |
| IRA-12 | Technology | Will subcontractors be involved? | Medium / Low | Unknown | Medium | Medium |
| IRA-13 | Regulatory | Will data leave the country? | High / Low | Unknown | Medium | Medium |
| IRA-14 | Regulatory | Are regulatory requirements applicable? | Medium / Low | Yes | Medium | Medium |
| IRA-15 | Regulatory | Is sensitive intellectual property involved? | High / Low | Yes | High | High |
| IRA-16 | Data | Will employee or other personal information be shared?added after v1, not in the manual assessment | High / Low | No | Low | n/a |
- Inherent risk Code
- Medium (v1: Medium). Medium because 3 answers are rated High (below 4) and neither IRA-02 nor IRA-03 is Yes.
- Tier Code
- Tier 2: SIG Lite questionnaire, review every 2 years.
- Open follow-ups Code
- IRA-12, IRA-13
- FIPPA flag Code
- Checked, not triggered: data may leave Canada (IRA-13 = Unknown), but no personal information indicated (IRA-02 = No, IRA-16 = No). Not legal advice.