The RED Score
The RED score is Adaca's rubric for whether a control addresses a risk, assessed on three measures: Relevance, Extent and Duration. It is scored on the relationship between an initiative and the risk it mitigates, and re-assessed over time, so the trend of residual exposure is read from the history rather than guessed.
In Detail
Relevance. Whether the initiative addresses the risk it targets. A control aimed at the wrong failure mode scores low, however well it is built. A policy covering general data handling does not address a model trained on customer records. Relevance distinguishes the two.
Extent. Whether it reaches enough of what is exposed. Covering three of thirty affected systems is a low Extent, regardless of execution quality. A control that governs one deployed model while five others run unassessed scores low on Extent.
Duration. Whether the effect is sustained. A control that holds for a fortnight and then lapses scores low on Duration. A control that held during a pilot but is not maintained once a model reaches production scores low on Duration.
Where it is used. The score lives in Adaca RED, the operations register for AI initiatives, risks and incidents, and it is the measure behind the governance record in an Adaca AI governance engagement. The rubric is documented and can be applied in any tool.
Common Questions
Is RED a risk rating?
No. It rates the control's effect on the risk, not the risk itself.
Who scores it?
The people who own the initiative, with Adaca, at each assessment.
Can we use it without the platform?
Yes; the rubric stands on its own.
Last updated