CommunityPay produces formal governance attestations through a three-stage pipeline: continuous data collection, weekly aggregation, and formal attestation generation. This page describes each stage, the artifacts produced, and how each assessment is derived.
The Three Stages
Stage 1: Continuous Data Collection
Governance data is collected continuously as a byproduct of normal operations. Every enforcement decision, exclusion event, escalation, notification, and override produces a record.
Key data sources:
| Source | What It Records |
|---|---|
| EnforcementDecision | Every guard evaluation: which guards ran, what they found, what the outcome was |
| ExclusionTriggerHit | Every time a risk trigger fired: signals evaluated, conditions met |
| ExclusionStatusHistory | Every exclusion status change: created, acknowledged, resolved, expired |
| EscalationEvent | Every escalation: who was notified, when, whether they acknowledged |
| ExclusionNotificationEvent | Every notification: delivery method, success/failure, timestamp |
| AuditOverride | Every override: scope, who authorized it and when, reason, usage count |
None of these records are created specifically for attestation — they are operational records that happen to provide complete governance evidence. The attestation system reads from them; it does not modify them.
Stage 2: Weekly Aggregation (Governance Digest)
The GovernanceDigest is generated every Monday morning for each association. A digest is versioned, can be replaced by a later version, and carries its own SHA-256 hash. It records, for the week:
- Health: a health score and tier, chain health (healthy decision chains against total), and a reliance grade with its reasons
- Prevented loss: totals by type and by policy, with the count of blocked and escalated actions
- Violations: new, pending, and resolved, by type
- Overrides: requests, approved, and denied
- Approvals: requests, completed, rejected, and pending, with average approval hours
- SLA compliance: the compliance rate and breaches by severity (minor, major, critical)
- Risk: the governance risk coefficient and tier, the risk signals, and alerts by severity
- Week over week: the previous week's figure beside each of the above
Stage 3: Formal Attestation
Two formal outputs come from these records:
- The Governance Controls Attestation (GCA) is an institutional packet that quantifies control effectiveness for a period.
- The Governance Attestation is the statement of whether the association operated within its declared governance policies during a period. It reads the weekly digests and the source records, and carries the exception counts and the governance policy snapshot in force.
GCA Structure
A GCA covers a period — a year, a quarter, or a month — and contains five sections, a list of risk flags, and an overall assessment.
Controls Summary
| Metric | Description |
|---|---|
| Total transactions | Financial actions attempted in the period |
| Passed all controls | Actions that passed every guard |
| Blocked, escalated, overridden | The count of actions in each outcome |
| Pass rate | Passed over total; none where nothing was attempted |
| Blocked amount | Total dollar value of blocked transactions |
| Escalated amount | Total dollar value of transactions requiring review |
Override Summary
| Metric | Description |
|---|---|
| Total overrides | How many AuditOverrides were used in the period |
| Override rate | Overrides over the period's transactions; none where there were no transactions |
| Scope breakdown | Distribution across the six override scopes — closed period, fund segregation, year-end close, integrity gate (a recordable scope that no control consults today), vendor risk, disbursement compliance |
| Most common scope | The scope overridden most often in the period |
| Override details | Up to twenty overrides, with who authorized each and the justification |
Exclusion Summary
| Metric | Description |
|---|---|
| Evaluations | Eligibility evaluations in the period, split into eligible, ineligible, excluded, conditional, withheld, and error; the buckets add up to the total |
| Active exclusions | Exclusions in force |
| Created and resolved | Exclusions opened and closed in the period |
| Trigger breakdown | Which triggers fired and how often |
Vendor Compliance
| Metric | Description |
|---|---|
| Linked vendors | Vendors linked to a contractor licensing record |
| Standing | How many are compliant, in warning, non-compliant, or critical |
| Compliance rate | Compliant over linked; none where no vendor is linked |
| Active alerts | Outstanding compliance alerts by type, and expired credentials |
SLA Compliance
| Metric | Description |
|---|---|
| Items tracked and measured | Approval items tracked, and those that carried an SLA threshold |
| Within SLA and breached | The count of each, with critical breaches |
| SLA compliance rate | Within SLA over measured |
| Average resolution time | Mean hours to resolution |
Not Measured Is Not One Hundred Percent
Each section states whether it measured anything. A period with no attempted actions has no pass rate, a period with no transactions has no override rate, and an association with no linked vendor has no vendor compliance rate. An exclusion section that could not be built is flagged and is never read as an empty one. A packet cannot read STRONG from counts that were never computed.
Overall Assessment
The GCA produces an overall assessment using a deterministic decision:
| Assessment | Criteria |
|---|---|
| STRONG | Pass rate at or above 95%, and no high-severity risk flag |
| ADEQUATE | Pass rate at or above 85% |
| NEEDS_IMPROVEMENT | Pass rate at or above 70% |
| DEFICIENT | Pass rate below 70%, or any critical risk flag |
| NOT MEASURED | No control activity was recorded in the period and no critical risk flag was raised; no grade is given |
Risk flags are raised by fixed rules: more than 10% of transactions blocked, more than ten overrides in the period, an active exclusion, a vendor with critical compliance issues, expired insurance among linked vendors, critical SLA breaches, or an exclusion section that could not be built. The assessment carries the reasons behind it. The reasons are generated from the metrics — not written by a human.
The Governance Attestation
The Governance Attestation answers: did this association operate within its declared governance policies during the period? It is generated for a period and records the statistics for it (exclusions, escalations, SLA compliance, notification coverage, control coverage, and exceptions), the exception count, the number of unacknowledged escalations, and the governance policy snapshot in force. Each carries a reference number.
Its status is derived from three checks: SLA compliance below 95% where it was measured, notification coverage below 100%, and any unacknowledged escalation.
| Status | Condition |
|---|---|
| Fully Compliant | No issue is found and no SLA breach is recorded |
| Compliant with Exceptions | No SLA breach is recorded, and one or two issues are found |
| Review Required | An SLA breach is recorded, or more than two issues are found |
A rate that was not measured is not counted as met. The compliance statement says it was not measured.
Exception Register
The exception register is a structured list of governance exceptions. It is synchronized from the association's exclusions and escalation events, with no manual data entry.
Each exception entry contains:
| Field | Description |
|---|---|
| Reference | A human-readable reference, such as EXC-2026-00123 |
| Exception type | EXCLUSION, ESCALATION, OVERRIDE, COMPLIANCE, or SLA_BREACH |
| Severity | LOW, MEDIUM, HIGH, CRITICAL |
| Source | The model and record the entry was built from |
| Policy violated | Which policy or control was involved |
| Detected and notified | When the exception was detected and when notification was sent |
| Escalation chain | The escalation history |
| Status | OPEN, ACKNOWLEDGED, IN_PROGRESS, RESOLVED, or ACCEPTED |
| Resolution | Who resolved it, when, and the notes |
| SLA tracking | The target date, and whether it was breached |
Attestation Artifact
The completed GCA is stored as an InstitutionalPacket with:
- evidence_snapshot: The complete JSON containing all sections, metrics, and risk flags
- content_hash: SHA-256 of the canonical JSON evidence snapshot
- previous_packet_hash: Link to the prior GCA for the same association and period (chain continuity)
- reference_number: Human-readable identifier (e.g.,
GCA-142-2026-Q1-20260131-v1)
The GCA is tamper-evident through the same content hashing and chain continuity mechanisms described in Evidence Packs & Verification.
What This System Proves
The governance attestation lifecycle converts operational data into evidence:
- Controls operate continuously — Not tested once per audit, but measured from the record of every attempted action
- Governance is quantified — Effectiveness is a measured rate, and a period with nothing to measure says so
- Exceptions are captured from source records — The exception register is synchronized, not compiled by hand
- Assessment criteria are deterministic — The same metrics always produce the same assessment
- The chain is verifiable — From individual records through digests to formal attestation, each artifact references its source data
CARI Integration
Board attestation currency is an eligibility signal: the BOARD_ATTESTATION rule, defined and not in force, would require a board attestation signed within the last year, as described in Eligibility Evaluation Framework. The CARI Governance sub-score, which carries a 25% weight in the composite score, is computed from the governance coefficient derived from enforcement telemetry.
For published methodology and component weights, see CARI Methodology and Scoring Framework.
How CommunityPay Enforces This
- Weekly GovernanceDigest aggregates health, prevented loss, violation, override, approval, SLA, and risk metrics from source data
- Exception register synchronized from exclusion events and escalation events
- GCA (Governance Controls Attestation) produces a quantified effectiveness assessment: STRONG, ADEQUATE, NEEDS_IMPROVEMENT, or DEFICIENT, and NOT MEASURED where a period holds no control activity and no critical risk flag
- Assessment derived from measurable criteria — not subjective judgment
- All attestation data traceable to source records: AttemptedActions, EnforcementDecisions, EscalationEvents, ExclusionStatusHistory
- Content hash (SHA-256) computed from canonical JSON snapshot for tamper detection