Theory
Requirements with no evidence source are more common than failed controls
When requirements are mapped to operational data sources, the largest category is usually requirements that no system can currently answer at all. These gaps matter more than failures, because a failed control is visible while a requirement with no data source produces a narrative that passes. The claim is untested.
Why this matters more than the failures
Claim: inference
A failed control is visible and gets fixed. A requirement with no data source produces a narrative instead, and narratives always pass. The absence is invisible in every report because nothing is red.
Counting unmapped requirements is therefore proposed as an early indicator of program maturity. The claim is untested and easy to test.