# ApertureRisks Exposure Assessment Methodology

Version: 2.0 — August 2026

## Purpose

This methodology explains how ApertureRisks turns client-provided operating records and source intelligence into an evidence-backed exposure assessment. The assessment is decision support, not an automatic action or a legal, customs, insurance, financial, or certification determination.

## Workflow

1. Confirm the tenant, supplier identities, decision question, assessment period, and accountable owner.
2. Validate structured supplier, relationship, BOM, lane, facility, contract, financial-basis, supplier-performance, and evidence records.
3. Link signals or operating conditions only to client records they can defensibly affect.
4. Calculate AR-Score from signal confidence (31.25%), exposure relevance (37.50%), and business impact (31.25%), rounding once after the complete weighted sum.
5. Assess Response Readiness independently from governed action evidence. Higher values mean stronger preparation and never modify AR-Score v2.
6. Deliver prioritized findings, evidence lineage, limitations, recommended next actions, owners, and open evidence requests for human review.

## Data rules

- Missing values remain missing and never become zero risk.
- Client exposure requires a client-scoped relationship or operating record with a stable identifier.
- Financial exposure is shown only with a recorded basis.
- Supplier performance uses explicit structured measurements and publishes no score when inputs are insufficient or conflicting.
- External source intelligence without a verified client linkage remains external context.
- Every evidence request remains open until a received response is explicitly validated.

## Output

The assessment output identifies the scope, connected records, source freshness, findings, exposure basis, confidence basis, evidence gaps, AR-Score model version, separate Response Readiness version and basis, recommended actions, accountable owners, and limitations. Recommendations require authorized human review.

## Versioning

Historical Legacy AR-Score v1 results remain readable under their four-pillar 25/30/25/20 model and are never recalculated as v2. Current AR-Score v2 results use the three exposure pillars above. Trends place an explicit model-change boundary between versions and report no numeric delta across it. Future formula or threshold changes require a new version and regression tests.