Okay, I've been living in Tugboat Logic for the past six months prepping for our SOC 2 audit. The platform is solid, especially for evidence collection and mapping controls. But I’m starting to get really frustrated with one of its flagship features: the **overall "readiness score."**
Here’s my hot take: That big, shiny percentage at the top of the dashboard is giving our leadership a false sense of security. They see it hit 85% and think, "Great, we're almost audit-ready!" Meanwhile, my team is scrambling because the score doesn't tell the whole story.
A few examples from our setup:
* The score heavily weights simply *having* a policy document uploaded. It doesn't validate if the policy is actually any *good*, or if it's just a generic template we downloaded and barely customized.
* We got points for "assigning" a control to an owner, but the system had no way to flag that the owner hadn't logged in or completed their required tasks in over a month.
* It aggregated everything into one number. We could be at 100% on 20 easy controls and 0% on 5 critical ones, and the overall score would still look deceptively high.
The score is a useful internal motivator for my GRC team—it helps us track *volume* of work completed. But when the C-suite sees it, they interpret it as *quality* and *comprehensiveness* of readiness. That’s a dangerous gap.
I’m curious if others have run into this. How do you handle reporting to management? Do you just hide the main dashboard and build custom reports, or have you found a way to make the readiness score more meaningful?