Errata

What the first edition says

Each question scores 0, 1, or 2. Five questions add up to a domain score from 0 to 10. Page 367 reads that total on three bands: 0 to 3 is High risk, 4 to 7 is Medium, and 8 to 10 is Low.

That leaves a gap. A domain can score 2, 2, 2, 2, and 0. That adds up to 8, which reads Low risk. But a 0 means the control is not in place at all. So a missing control can hide inside a strong total.

What changes

Add this box after the domain-score table on page 367:

THE CRITICAL-CONTROL OVERRIDE

Four of the twenty questions cover a control whose complete absence means a failure in that domain would have no owner and nothing to catch it. If any of these scores 0, the domain cannot read Low risk, whatever the five questions add up to. Cap it at Medium and take the conditional-go path: name that control in the engagement letter or the DPA before you sign.

• 1.2 Output validator named. Nothing catches the error.
• 1.5 Data leaving your control. The one gap a contract cannot undo once your data has trained someone's model.
• 2.5 Decision ownership. Nobody is accountable for the decision.
• 4.5 Liability allocation. Nobody has settled who pays.

The override only prevents a Low reading. A domain already scoring Medium or High keeps the band its total earned. And a 1 is not a 0: partial credit means the control exists somewhere, which is a gap to close, not an absence to stop for.

When the override caps a domain, take the conditional-go path for that control even if the decision table on page 368 would otherwise read "Go, with the Medium-risk domain on your watch list." A missing critical control goes in the contract before you sign, not on a watch list.

What stays the same

The 0, 1, 2 scale does not change. Neither do the three bands or the decision rule on pages 367 and 368. Any one domain in High risk is still a no-go.

The Talairis Law Group worked example is not affected. None of its four critical-control questions scores 0, so its outcome stands as printed.

Why

A control that is completely missing should never read as Low risk.

What the first edition says

Appendix C does not say what to do with a question you can't answer. Appendix A does. On pages 314 and 315, the Culture AIR-MAP tells you to score it 0 for now and move on. The Core instrument had no matching rule. That leaves you guessing when a vendor has thin paperwork.

What changes

Add this box to "How to Score" in Appendix C, on page 362:

IF YOU CAN'T ANSWER A QUESTION

Score it 0 for now and mark it unknown. The domain reads its band from that 0. Then write the range: what the domain would total if every unknown scored 2. If the range crosses a band line, the unknowns decide your answer, and each one is a question to put to the vendor before you sign.

What stays the same

The 0, 1, 2 scale, the bands, and the decision rule do not change. Neither does the critical-control override in E-001. A 0 marked unknown counts exactly like any other 0.

Why

An unknown is a question for the vendor, and the range shows you whether the answer can change your decision.