---
tool_id: WACK-TOOL-0049
concept_id: WACK-CONCEPT-0010
playbook_content_id: WACK-CONTENT-0129
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Five-State Assessment Reconciliation Matrix

> Stop one green control status from collapsing criterion, fact, record, claim, and conclusion into the same object.

**Expected output:** A claim-level matrix that separately identifies expected criteria, bounded observations, literal document statements, accountable assertions, validation work, mismatches, authorities, decisions, and reopening triggers.  
**Working time:** 120 minutes  
**Derived from:** WACK-CONTENT-0129

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Collect the five states without reconciling them

Choose one consequential control claim and preserve each source object in its native authority and time boundary.

- [ ] **What is expected, and which standard, program, policy, contract, or design authority created it?**

  Notes: ________________________________________________

- [ ] **Which observations, documents, assertions, validation records, failures, exceptions, and contrary facts exist for the same subject and period?**

  Notes: ________________________________________________

## 02 / Map — Give every object a durable identity

Connect criterion, subject, population, occurrence, artifact, assertion, test, conclusion, owner, and time without using one status as a shortcut.

- [ ] **Do the five states address the same subject, population, environment, service, version, and period?**

  Notes: ________________________________________________

- [ ] **Which join is inferred rather than supported by an attributable record?**

  Notes: ________________________________________________

## 03 / Explain — Name every disagreement

Describe the mismatch and authority boundary before judging its effect on the claim.

- [ ] **Is the gap expected-versus-observed, observed-versus-documented, documented-versus-asserted, or asserted-versus-validated?**

  Notes: ________________________________________________

- [ ] **Can the mismatch change the full claim, a bounded part of it, or only the quality of the record?**

  Notes: ________________________________________________

## 04 / Reduce — Remove status words that hide propositions

Narrow claims, correct stale records, separate recurring occurrences, and stop attachment presence or tool pass states from auto-closing validation.

- [ ] **Which broad status can be replaced with a precise proposition and independent states?**

  Notes: ________________________________________________

- [ ] **Which duplicate, stale, or unverifiable record can be retired without losing chronology?**

  Notes: ________________________________________________

## 05 / Prove — Reperform the five-state traversal

Validate only the boundary supported by criteria, observations, documents, assertions, tests, exceptions, and authority.

- [ ] **Can another qualified reviewer reproduce the bounded conclusion from stable identifiers?**

  Notes: ________________________________________________

- [ ] **What time, change, failure, provider update, or contrary observation must reopen it?**

  Notes: ________________________________________________

## Completion check

- [ ] The expected state identifies its authority and exact criterion without being represented as operating evidence.
- [ ] Every observation identifies subject, population, environment, method, time, result, limitation, and source.
- [ ] Every document is quoted or summarized within its literal subject, period, version, and authority boundary.
- [ ] The accountable assertion is a precise, testable proposition rather than a generic green status.
- [ ] The validation conclusion identifies criteria, evidence, method, exceptions, authority, limits, and reopening triggers.
- [ ] Every unresolved mismatch remains visible and assigned rather than overwritten by the latest pass.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._