A reassuring sentence in a risk review can also be misleading: we have never had an incident. It is offered as evidence that controls work. An absence of incidents does not establish that capability. It may only show that the conditions which would test the controls have not yet arrived together.

An absence of incidents does not show that controls work. It may only show that they have not been tested.

A system can run clean for years because the load never peaked, the dependency never failed, and the rare input never appeared, not because the chain that would catch those things has ever been exercised. The quiet record alone does not establish capability. Relevant evidence of the intervention chain being exercised is needed to distinguish the two.

Why the engine discounts the quiet record

AGDA® measures demonstrated capability under stress, not the absence of past failure. A control that has never been triggered is graded on what can be shown about how it behaves when it is, through drill, through production evidence, through stress. A clean history with no such evidence does not raise measured readiness, because it cannot distinguish a strong chain from an untested one.

This frustrates the instinct to be rewarded for years without an event. The frustration is the point. The years without an event are exactly the period in which untested exposure accumulates unseen, and the only way to know which you hold is to test it before the event does.

The question that replaces the comfort

Instead of have we had an incident, the useful question is sharper and less comfortable:

When did this control last act, in production or in drill, against the conditions it exists to catch?
If the answer is never, on what evidence do we believe it would?
What would the failure look like, and would we see it in time to intervene?

A margin you can name and have tested is a margin. A quiet record is a coincidence you have not yet had cause to examine.