Skip to content

Periodic Coverage Recertification

Periodic review — instantiates Target-Complete Mapping Design

On a fixed cadence, re-proves from scratch that every required target still has a valid witness — with an independent sign-off — so coverage that quietly decayed since last time is caught before it is assumed.

Periodic Coverage Recertification re-establishes, on a fixed cadence, that every required target still has a valid witness — treating past coverage as expired until re-proven rather than assumed to persist. Its defining move is treating coverage as a perishable, time-boxed attestation: certification decays, so each cycle re-verifies the mapping from a clean slate, forces every change since the last cycle through controlled review, and requires an independent reviewer to sign off. That catches the silent decay a continuous dashboard normalizes and a one-time check never revisits — a witness that lapsed, a target that drifted out of spec. It is the scheduled, independent re-proof, not the day-to-day monitor.

Example

An airline must keep, for every required emergency scenario — rejected takeoff, cabin depressurization, ditching — both a current checklist and crew trained within recency limits. Annually, and after any fleet or procedure change, recertification re-verifies each scenario from scratch: is the checklist current, is the mapped crew still within recurrency, did every procedure change since the last cycle actually pass through change control? This cycle finds that a newly-introduced aircraft variant's ditching procedure still maps to a checklist never updated for the variant's different raft stowage — coverage that was "certified" a year ago and has silently decayed since. An independent check airman signs the recertification, not the crew who own the procedure. (Recurrent-training and recency practice is real; the specific finding is illustrative.)

How it works

What distinguishes it is the combination of a time-boxed re-proof, change control, and independence. Each cycle re-verifies every target's witness afresh rather than carrying last cycle's result forward; routes every intervening change to the mapping through logged, controlled review; and has an independent party — not the coverage's owner — certify the result. Decay and unreviewed drift both surface on schedule, because the default assumption is that nothing is still covered until this cycle shows it is.

Tuning parameters

  • Cadence — how often the full re-proof runs, plus event triggers after major change. Shorter cycles catch decay sooner but cost more each time.
  • Re-proof depth — full re-verification of every target versus a sampled attestation. Full is rigorous; sampling is cheaper but can miss the one decayed case.
  • Independence level — self-attestation versus peer versus a fully independent reviewer. More independence is what resists rubber-stamping.
  • Change-control coupling — how strictly changes to the mapping since the last cycle must be logged and reviewed before the cycle can certify.

When it helps, and when it misleads

Its strength is catching slow decay and normalized drift that a live dashboard stops noticing and a one-time audit never revisits — and its independence resists the self-serving sign-off. Its weakness is structural: recertification is periodic, so a gap that opens just after a cycle lives until the next one, and the cadence bounds that blind window. The classic misuse is rubber-stamping the recertification — re-signing last cycle's result without actually re-verifying, so the attestation persists while the coverage rots underneath it. The discipline that guards against it is to require genuine re-proof rather than carry-forward, insist on an independent signer, and shorten the cadence or add event triggers wherever decay is fast — the same logic behind recency and recurrent-training requirements in high-consequence fields.[1]

How it implements the components

Periodic Coverage Recertification realizes the time-and-assurance side of the archetype — the components that keep coverage true as time passes:

  • coverage_revalidation_cadence — the fixed schedule, plus event triggers, on which coverage is re-proven from scratch.
  • mapping_change_control — intervening changes to the mapping are logged and routed through controlled review before each cycle can certify.
  • independent_coverage_review — an independent party re-verifies and signs off, deliberately not the owner of the coverage being certified.

It does not continuously watch coverage between cycles — that is the Coverage Dashboard — nor hunt down the specific missing witness, which is Coverage Counterexample Search; recertification re-proves the whole map on a cadence.

Notes

Recertification bounds the blind window to a single cadence; between cycles you rely on the dashboard and monitors for fast signals. The two are complements, not substitutes: continuous monitoring for the day-to-day, periodic independent recertification for the truth-check that the monitor itself has not quietly gone wrong.

References

[1] Recency (recurrent-training) requirements — the rule that a qualification lapses unless re-demonstrated within a set interval, standard in aviation and other high-consequence domains. It is the same principle applied to coverage: a certification is treated as expiring on a clock, so it must be earned again rather than assumed to endure. ↩