IRAP isn't a pass/fail — and that confuses people

An IRAP report is a structured opinion, not a certificate.

The persistent misunderstanding — among SaaS vendors, procurement officers, and occasionally agency staff — is that an IRAP assessment concludes with a verdict. It does not. There is no tick. There is no “IRAP certified” stamp. An ASD-endorsed assessor produces a report describing the implementation state of ISM controls within a defined scope. An authorising officer reads that report and makes a risk decision. The two roles are deliberately separate.

A well-written IRAP report describes each in-scope control as implemented, partially implemented, alternately controlled, or not implemented. Where a control is not fully implemented, the report records the residual risk and the assessor’s view on its sufficiency. The report does not say “the system passed”. It says: here is the state of the controls, here is what’s missing, here is what the agency should think about before authorising the system into its trust boundary.

This matters for three reasons.

First, vendors who optimise for “passing” optimise for the wrong outcome. A report with ten honestly documented residual risks is more useful to an authorising officer than one that papers over real gaps. The assessor’s independence is what makes the report load-bearing.

Second, the endorsed cloud services list is a separate construct. Being on the register reflects that an assessment has been conducted at a particular classification level. It is not a quality grade, and it does not confer authorisation to operate inside any particular agency.

Third, the authorising officer’s decision is contextual. The same residual risk profile may be acceptable to one agency and unacceptable to another, depending on the data they intend to put into the system. An IRAP report informs that conversation; it cannot replace it.

TrustedZone’s Director, an ASD-endorsed assessor since 2023 operating to the PROTECTED ceiling, sees the same failure mode recur across engagements: vendor leadership treating the assessor as an examiner. The assessor is not an examiner. The assessor is a witness whose testimony helps the agency decide.

Takeaway. When you read an IRAP report, read the residual-risk table before you read the cover page. That is where the report actually lives.

Published by TrustedZone news automation on 2026-05-15 AEST. Director rollback.