FMAE Rule Taxonomy
Executive Summary
Key Takeaways
- ✓ The FMAE rule engine classifies its 26 rules into six categories, read directly from each rule's own category class attribute in source, not assigned separately for documentation purposes.
- ✓ Structural is by far the largest category (18 of 26 rules), reflecting that most of what the engine checks for is model mechanics rather than governance or hygiene.
- ✓ Five categories outside Structural — Assumptions Governance, Integrity Controls, Structural Hygiene, Aggregation Logic, and Model Governance — each address a distinct, narrower failure mode.
- ✓ This taxonomy, not a rule's severity, is what determines a rule's category on its Rule Reference page and its sibling-rule cross-links.
What This Taxonomy Is¶
Every FMAE structural rule declares a category attribute as part of its own class definition in source
— the taxonomy below is read directly from that attribute across all 26 rules, not a scheme assigned to
the rules separately for this page. If a rule's category ever changes in source, this page is out of date
until it is re-verified against the rule files directly.
The Six Categories¶
| Category | Member rules | Count |
|---|---|---|
| Structural | R001–R018 | 18 |
| Assumptions Governance | R019 | 1 |
| Integrity Controls | R020, R021 | 2 |
| Structural Hygiene | R022 | 1 |
| Aggregation Logic | R023 | 1 |
| Model Governance | R024, R025, R026 | 3 |
Structural. The largest category by a wide margin. It covers the core mechanical checks that apply to how a model calculates: hardcoded values overriding formulas, broken or orphaned links, circular references, formula inconsistency across a row, propagated error values, volatile functions, manual calculation mode, hardcoded dates, unresolved external precedents, and related patterns. A Structural finding is, generally, a claim about whether the model calculates the way its own internal pattern implies it should.
Assumptions Governance. A single rule (R019, Repeated Hardcoded Literal) addressing whether a business assumption is centralized in a controlled input layer or scattered as repeated literal values across the model. Distinct from Structural because the concern is governance of the assumption itself, not a single cell's mechanical correctness.
Integrity Controls. Two rules (R020 Anchor Drift, R021 Hidden Sheet Dependency) addressing whether a model's references and worksheet visibility are internally consistent — whether a reference anchor has drifted from its intended class, and whether a hidden worksheet carries a live formula dependency a reader would not otherwise see.
Structural Hygiene. A single rule (R022, Merged Cells in Data Region) addressing a formatting-level structural risk — merged cells inside a data region, which can silently break row-pattern assumptions that other rules and manual review both rely on.
Aggregation Logic. A single rule (R023, Aggregation Range Gap), carrying critical severity despite the category's narrow scope: it detects a formula-bearing cell sitting immediately adjacent to, but outside, an aggregation range — a pattern that can mean a line item is silently excluded from a total.
Model Governance. Three rules (R024 Unused Input Driver, R025 Orphaned or Invalid Named Range, R026 Missing Input Validation) addressing whether a model's input layer is actively maintained — driver cells that are no longer referenced, named ranges pointing at invalid or missing targets, and input cells with no validation control.
Category Is Independent of Severity¶
A rule's taxonomy category and its severity are two separate, independently declared attributes. Category answers what kind of structural issue the rule addresses; severity answers how serious a triggered finding from that rule is. The clearest illustration is R023: it sits alone in the narrow Aggregation Logic category, yet carries critical severity — one of only five rules across the entire 26-rule engine whose severity can override a model's numeric risk score (see the SM-2.0 Scoring Methodology page). A small category is not a signal of low materiality.
How This Taxonomy Is Used Elsewhere¶
Every page in the Rule Reference states its rule's taxonomy category and links to its sibling rules — the other rules sharing that same category — as a "related rules" cross-link, so a reader investigating one finding can see the other checks addressing the same kind of structural concern.
Related Reading¶
- FMAE Audit Engine — Architecture Overview — where rule execution sits in the overall pipeline.
- FMAE Scoring Engine — SM-2.0 Methodology — how a rule's severity, not its category, feeds into the numeric score and critical-override logic.
- Rule Reference — the full set of individually addressable rule pages.
- RP-004: Financial Model Audit Taxonomy — the fuller, academic-register formalization of this same six-category taxonomy.
How OXXON tests thisRun a free structural check with FMAE
Frequently Asked Questions
What are the six FMAE rule categories?
Structural, Assumptions Governance, Integrity Controls, Structural Hygiene, Aggregation Logic, and Model Governance.
Which category has the most rules?
Structural, with 18 of the engine's 26 rules — it covers the core mechanical checks (hardcodes, broken links, circular references, formula inconsistency, propagated errors, and related checks).
Is a rule's category the same as its severity?
No. Category is a classification of what kind of structural issue a rule checks for. Severity (critical, high, medium, or low) is a separate, independent attribute describing how serious a finding from that rule is. R023, for example, is in the narrow Aggregation Logic category but carries critical severity.
Where is each rule's full detail documented?
On its own page in the Rule Reference, linked from this page and cross-linked back to its taxonomy category.
Related Articles
FMAE Audit Engine — Architecture Overview
The FMAE audit engine processes a workbook through five stages executed in a fixed order — parsing and workbook ingestion, dependency graph construction, rule engine execution, risk scoring, and report generation. Each stage consumes the previous stage's output and exposes nothing about how any later stage will use it, so the stages can be documented, tested, and read about independently. This page is the map; the detail behind each stage lives on its own Technical Documentation page as those pages are published.
Rule Reference Index
The Rule Reference is a set of individually addressable pages, one per FMAE structural rule, living at /fmae-knowledge-centre/rule-reference/ — the FMAE equivalent of an AWS error-code reference or a NIST control catalog. Each rule page states its purpose, detection logic at a conceptual level, severity, evidence produced, remediation guidance, and its sibling rules within the same taxonomy category. All 26 rule pages are now published; this index page explains how the Rule Reference is organized and links to every rule page in taxonomy order.