Richard G. Prouse. January 2026. 3 minute read
How much does poor documentation reduce the protection a control gives you?
In proportion. A control that works 95% of the time but is 10% documented has a defensibility value of 9.5%.
Directors, officers and anyone who signs off safety or security procedures.
Risk standards such as ISO 31000 tell organisations to manage risk, but give no way to measure how far weak documentation undermines a control once it is examined after an incident.
This working paper proposes one. The Prouse Residual Liability Model treats documentation as a multiplier.
The effectiveness of a control (Ce) is multiplied by a Documentation Coefficient (Cd) between 0.0 and 1.0, which measures how well the control's design and operation can be proven from records. If the coefficient is near zero, so is the credit the control earns, whatever was spent on it.
Version 2.1 (October 2026) refines the original formula. It adds the impact of harm (I) and, where keeping records is itself a legal duty, the penalty for failing it; keeps every result between zero and the full exposure; and defines how Cd is measured by audit sampling. In a pre-specified simulation study across seven assumed legal environments, it chose which documentation to fix better than 5×5 risk matrices and expected-loss methods. That is a simulation result; the specification sets out how the model will be tested against real court outcomes. Read the Version 2.1 specification (PDF), download the free calculator (Excel) or download the simulation code.
The paper also introduces the Prouse Forensic Index, a score from 0 to 100 for board reporting: below 40 is fragile, 40 to 75 is marginal, and 76 or above is robust.
It works through one example. A biometric entry system that restricts access successfully 95% of the time, but whose enrolment criteria and log reviews were never written into an audited procedure, scores 0.95 multiplied by 0.10: a defensibility value of 9.5%.
Prouse, R. G. (2026). Bridging the Documentation Void: A Quantitative Approach to Residual Liability (Lr) and Fiduciary Defensibility. SSRN working paper. DOI 10.2139/ssrn.6175099.
Confidential Risk Consulting