Finding Data Model & Confidence

Technical-Documentation • — • 3 min read

Audience: Technical Reviewers • Auditors • Integration Engineers
Last Reviewed: July 2026
Updated: Version 1.0

Executive Summary

Every FMAE finding carries the same fixed structure — which rule triggered it and that rule's identity at the time it ran, its evidence, a narrative explanation, and a confidence label of high, medium, or low. Confidence is a deterministic categorical label derived from how strongly a row's cells agree on a pattern, not a machine-learning probability estimate. Stating this plainly matters, since describing FMAE's confidence as AI-derived or probabilistic would overstate what the engine actually does.

Key Takeaways

✓ Every FMAE finding carries the same fixed structure — rule identity and its attributes at execution time, evidence, a narrative, and a confidence label.
✓ A finding's rule snapshot captures the rule's category, severity, frequency, and weight as they were at the moment the finding was produced, so a finding remains interpretable even if a rule's attributes change in a later engine version.
✓ Confidence (high, medium, or low) is a deterministic categorical label derived from how strongly a row's cells agree on a pattern — never a machine-learning probability estimate.
✓ Overstating confidence as AI-derived or probabilistic would be a fabricated capability claim; FMAE states plainly that it is not.

What a Finding Contains¶

Every FMAE finding, regardless of which of the 26 rules produced it, carries the same fixed structure:

A rule snapshot — the rule's identity (rule ID), its taxonomy category, severity, frequency, and declared weight, captured at the moment the finding was produced.
Evidence — the specific cell references, values or formula text, and a description tying the finding to exactly what triggered it (see Evidence & Provenance for the full model).
A narrative — why the pattern matters structurally, and general remediation guidance.
A confidence label — one of high, medium, or low.
Provenance stamps — the engine version and rule pack version that produced it (see Rule Engine & Rule Packs).

Why the Rule Snapshot Matters¶

A finding's rule snapshot captures the rule's category, severity, frequency, and weight as they actually were at the moment the finding was produced — not merely a reference to the rule's current, possibly since -changed definition. This matters because a rule's declared attributes can, in principle, change between engine versions. Recording the rule's actual attributes at execution time means a finding from a past audit remains fully interpretable on its own terms even if the live rule's current attributes have since been revised.

Confidence Is Deterministic, Not Probabilistic¶

A finding's confidence label — high, medium, or low — is a categorical label derived from how strongly the cells being compared in a row agree on a common pattern: broadly, a comparison with a very high level of agreement across a sufficiently large sample is labelled high confidence, and other cases are labelled medium. This is a deterministic, rule-based categorization, not a machine-learning probability estimate, and not a signal produced by any language model.

This distinction is stated plainly here because it is easy to overstate by accident. Describing FMAE's confidence as "AI-derived" or as a probability would be a fabricated capability claim — the engine does not produce a probability of correctness, and no part of its confidence labelling involves a model inferring likelihood from context. It produces a categorical label from a directly observable, reproducible comparison, and the same input always produces the same label.

Example¶

A finding produced by R001 (Hardcoded Cells) carries: a rule snapshot identifying R001, category Structural, severity critical, weight 15.0; evidence naming the specific sheet, cell address, and the row pattern the flagged cell departs from; a narrative explaining that the hardcoded value will not respond to changes in the model's stated assumptions; and a confidence label reflecting how strongly the row's other cells agree on the pattern the flagged cell breaks.

Evidence & Provenance — the full model behind a finding's evidence and the provenance stamps it carries.
FMAE Rule Taxonomy — the categories a finding's rule snapshot can carry.
Rule Reference — individual rule pages, each describing what evidence and confidence a triggered finding for that rule produces.

How OXXON tests thisRun a free structural check with FMAE

Frequently Asked Questions

What does an FMAE finding actually contain?

A snapshot of the rule that triggered it (identity, category, severity, frequency, weight at the time it ran), supporting evidence, a narrative explaining why it matters and what to do about it, and a confidence label of high, medium, or low.

How confident is FMAE in its own findings?

Confidence is expressed as one of three deterministic categorical labels — high, medium, or low — derived from how strongly the cells being compared agree on a pattern. It is not a machine-learning probability score and is never described as one.

Why does a finding record the rule's severity and weight at the time it ran, rather than just referencing the rule by ID?

Because a rule's declared severity or weight can change between engine versions (as happened historically with one FMAE rule). Recording the rule's actual attributes at execution time means a finding from a past audit remains interpretable on its own terms, even if the live rule's current attributes have since changed.

Is FMAE's confidence label the same thing as a probability?

No. It is a categorical label derived from a deterministic comparison — how many cells in a sample agree on a pattern, and how large that sample is — not a statistical probability estimate of correctness.

FMAE Audit Engine — Architecture Overview

The FMAE audit engine processes a workbook through five stages executed in a fixed order — parsing and workbook ingestion, dependency graph construction, rule engine execution, risk scoring, and report generation. Each stage consumes the previous stage's output and exposes nothing about how any later stage will use it, so the stages can be documented, tested, and read about independently. This page is the map; the detail behind each stage lives on its own Technical Documentation page as those pages are published.

FMAE Rule Taxonomy

Every rule in the FMAE structural rule pack declares a category attribute at the point it is defined in source — this is not a classification imposed on the rules afterward for documentation purposes, it is the classification the engine itself uses. Six categories cover all 26 rules — Structural (18 rules), Assumptions Governance (1), Integrity Controls (2), Structural Hygiene (1), Aggregation Logic (1), and Model Governance (3). This page publishes that taxonomy as the FMAE equivalent of a control catalog's classification scheme, cross-linked to the Rule Reference page for each member rule.

Evidence & Provenance

FMAE separates two concerns that are easy to blur together — evidence (the specific facts that justify a finding) and provenance (the record of what engine, rule pack, and source file produced it). An evidence bundle is a deterministic export of facts the platform has already computed elsewhere — the manifest's own provenance and coverage disclosure, an explicit set of findings, and any circular dependency regions those findings touch — copied verbatim, never recomputed or inferred at export time.