Rule Reference Index

Technical-Documentation • — • 3 min read

Audience: Technical Reviewers • Auditors • Integration Engineers
Last Reviewed: July 2026
Updated: Version 1.0

Executive Summary

The Rule Reference is a set of individually addressable pages, one per FMAE structural rule, living at /fmae-knowledge-centre/rule-reference/ — the FMAE equivalent of an AWS error-code reference or a NIST control catalog. Each rule page states its purpose, detection logic at a conceptual level, severity, evidence produced, remediation guidance, and its sibling rules within the same taxonomy category. All 26 rule pages are now published; this index page explains how the Rule Reference is organized and links to every rule page in taxonomy order.

Key Takeaways

✓ All 26 FMAE rule pages (R001–R026) are published, each individually addressable at /fmae-knowledge-centre/rule-reference/, rather than one long undifferentiated list.
✓ Rule pages were built in priority order — the five critical-override rules first, then the 14 remaining high-severity rules, then the 7 medium and low-severity rules — not in rule-ID order.
✓ Every rule page follows the same fixed template — purpose, detection logic, why it matters, evidence produced, severity, examples, remediation, related rules — so any two rule pages are directly comparable.
✓ The five critical-override rules (R001, R002, R004, R006, R023) were the first five rule pages published, because they are the rules capable of capping a model's letter grade regardless of its numeric score.

What the Rule Reference Is¶

The Rule Reference is a set of individually addressable pages, one per FMAE structural rule, living at /fmae-knowledge-centre/rule-reference/. Where the Rule Taxonomy page documents how the 26 rules are classified as a set, each Rule Reference page documents one rule in full — the FMAE equivalent of an AWS error-code reference or a NIST control catalog entry, addressable and citable on its own.

How Rule Pages Are Organized¶

Every rule page follows the same fixed structure, so any two rule pages are directly comparable regardless of which rule they document:

Purpose — what the rule checks for, in one or two sentences.
Detection logic — a conceptual description of what pattern triggers the rule. Actual thresholds and algorithmic detail are not disclosed; a rule page states what the rule is looking for, not the exact internal test.
Why it matters — the structural or financial consequence of the pattern the rule detects.
Evidence produced — what a triggered finding's supporting evidence contains.
Severity — the rule's current severity classification, verified against source at the time the page was written.
Examples — a short illustrative trigger and non-trigger, never drawn from a real client engagement.
Recommended remediation — general guidance on how the underlying issue is typically corrected.
Related rules — sibling rules sharing the same taxonomy category.

Build Order¶

Rule pages were not published in rule-ID order. They were published in priority order, matching the sequence the rules themselves would be encountered by materiality of consequence:

The five critical-override rules — R001, R002, R004, R006, R023 — published first, because these are the only rules capable of capping a model's overall letter grade regardless of its numeric score (see the SM-2.0 Scoring Methodology page).
The 14 remaining high-severity rules — R003, R005, R007–R014, R019–R022.
The 7 remaining medium and low-severity rules — R015–R018, R024–R026.

All 26 Rule Pages¶

Rule	Name	Taxonomy category	Severity
R001	Hardcoded Cells	Structural	Critical
R002	Broken Links	Structural	Critical
R003	Circular References	Structural	High
R004	Formula Inconsistency	Structural	Critical
R005	Volatile Functions	Structural	High
R006	Propagated Errors	Structural	Critical
R007	Manual Calculation Mode	Structural	High
R008	Hardcoded Dates	Structural	High
R009	Unresolved External Precedents	Structural	High
R010	High Fan-In Hardcodes	Structural	High
R011	Cross-Sheet Pattern Drift	Structural	High
R012	Hardcoded Rate Constant	Structural	High
R013	IFERROR Masking	Structural	High
R014	Overly Complex Formula	Structural	High
R015	Explicit Aggregation Review	Structural	Low
R016	Missing Assumptions Tab	Structural	Medium
R017	External Link Count	Structural	Medium
R018	High Hardcode Density	Structural	Medium
R019	Repeated Hardcoded Literal	Assumptions Governance	High
R020	Anchor Drift	Integrity Controls	High
R021	Hidden Sheet Dependency	Integrity Controls	High
R022	Merged Cells in Data Region	Structural Hygiene	High
R023	Aggregation Range Gap	Aggregation Logic	Critical
R024	Unused Input Driver	Model Governance	Medium
R025	Orphaned or Invalid Named Range	Model Governance	Medium
R026	Missing Input Validation	Model Governance	Medium

This table is also always visible, generated directly from the published article set, at the Rule Reference category page.

FMAE Rule Taxonomy — how these rules are classified as a set.
FMAE Scoring Engine — SM-2.0 Methodology — how rule weight and critical-override status feed into a model's score.
FMAE Audit Engine — Architecture Overview — where rule execution sits in the overall pipeline.

How OXXON tests thisRun a free structural check with FMAE

Frequently Asked Questions

How many rules does the FMAE rule engine have?

26, numbered R001 through R026, organized into six taxonomy categories documented in full on the Rule Taxonomy page.

Are all 26 rule pages published?

Yes. Every rule from R001 through R026 has its own dedicated Rule Reference page, verified directly against its own source file in rules/r0*.py.

What does each rule page contain?

A fixed template — purpose, detection logic described at a conceptual level, why the pattern matters structurally, what evidence a triggered finding produces, current severity, an illustrative example, general remediation guidance, and links to sibling rules in the same taxonomy category.

Why were the critical-override rules published first?

Because they are the five rules capable of capping a model's overall letter grade regardless of its numeric score — the highest-consequence findings in the entire rule set, documented on the SM-2.0 Scoring Methodology page.

FMAE Audit Engine — Architecture Overview

The FMAE audit engine processes a workbook through five stages executed in a fixed order — parsing and workbook ingestion, dependency graph construction, rule engine execution, risk scoring, and report generation. Each stage consumes the previous stage's output and exposes nothing about how any later stage will use it, so the stages can be documented, tested, and read about independently. This page is the map; the detail behind each stage lives on its own Technical Documentation page as those pages are published.

FMAE Rule Taxonomy

Every rule in the FMAE structural rule pack declares a category attribute at the point it is defined in source — this is not a classification imposed on the rules afterward for documentation purposes, it is the classification the engine itself uses. Six categories cover all 26 rules — Structural (18 rules), Assumptions Governance (1), Integrity Controls (2), Structural Hygiene (1), Aggregation Logic (1), and Model Governance (3). This page publishes that taxonomy as the FMAE equivalent of a control catalog's classification scheme, cross-linked to the Rule Reference page for each member rule.

FMAE Scoring Engine — SM-2.0 Methodology

FMAE computes a model's risk score as 100 minus the triggered rules' combined weight, normalized against a fixed basis, currently 207.0 under the active SM-2.0 methodology. SM-1.0, the engine's original scoring basis (170.0, covering R001–R021), is retained as a frozen historical reference rather than deleted from the record. Five rules — R001, R002, R004, R006, and R023 — are critical-override rules. If any of them triggers, the resulting letter grade is capped so a model cannot be graded A or B regardless of how high its numeric score is. This page documents the exact formula, the versioning between SM-1.0 and SM-2.0, and a fully worked example.