The rubric

Published, versioned, and fixed before we start.

Every Skoor is computed from measurement against this rubric — never opinion. You can read what is scored before an engagement begins, and verify afterwards that we did not shape it around you. The rubric version is printed on every report.

Implementation Skoor — your firm's posture.

Point in time, re-scored annually. Four dimensions, each scored across Legal, Risk, Compliance and Security, against the standards that bind your firm.

PolicyIs there a written AI policy, does it name the tools in use, and does anyone own it?

PermissionsIs what each role may touch scoped and enforced, or decided by whoever is typing?

RecordsIs what was sent, and to which tool, recorded — and retained where the firm controls it?

Audit trailCan the firm produce, for a chosen week, what its AI touched and who approved it?

Agent Skoor — behaviour, continuously.

Scored per agent, continuously, against the certified profile that agent was deployed under.

Policy adherenceDid the agent stay inside the profile it was deployed under?

Output reviewWas its output reviewed by the person accountable for the work?

DriftWhen behaviour moved outside the profile, was it caught inside the committed window?

A Skoor says your configuration meets the technical safeguards in a standard. It does not say you are compliant — that is a legal opinion, and it belongs to your counsel.

Version history.

v1.0August 2026 · CPA firmsInitial published rubric. Standards tracked: IRC §7216, IRS Pub 4557 (WISP), GLBA Safeguards Rule, Treasury Circular 230, AICPA ET 1.700, SQMS, and SOX for firms with public-company audit clients.

Rubrics for other regulated professions are in development and will be published here before their first engagement. When a standard moves, the rubric versions against it — and existing customers are re-scored on the schedule in their maintenance engagement.

See the rubric applied in the sample report →