Chapter 8 — Programming II

Chapter 8 — Programming II

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Functions and tests"]
  N2["8.2 Several sources"]
  N3["8.3 Discrepancies"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Functions and tests"]
  N2["8.2 Several sources"]
  N3["8.3 Discrepancies"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Functions and tests]
    |
    v
[8.2 Several sources]
    |
    v
[8.3 Discrepancies]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) structure governance scripts into functions with tests; (2) read several data sources; (3) cross-check sources to find discrepancies.

8.1 Functions and tests

Sofia restructures her scripts into functions, each doing one job: reading a file, checking a rule or printing a report. She writes small tests with known answers. For example, a test gives the owner check a record with an empty owner and expects it to be flagged. Tests catch mistakes when she changes code later. She learns that governance scripts need tests because their output may be used as evidence, and wrong evidence can mislead managers and auditors. The empty-owner test, for example, would fail at once if a later change broke the owner check.

8.2 Several sources

Real checks combine sources. Sofia reads the inventory, the identity system's account export and the human resources leaver list. Each uses different names for the same thing; the identity system uses email addresses, while human resources uses staff numbers. She writes a mapping table to join them. She learns that much governance work is reconciling sources that were never designed to match, and that documenting the mapping is essential so others can repeat the check. Her mapping table, linking staff numbers to email addresses, is itself evidence that should be kept with the check results.

8.3 Discrepancies

Cross-checking reveals discrepancies: four accounts belong to staff on the leaver list, two laptops in the inventory are assigned to leavers and one active account matches no staff member. Sofia prints each discrepancy with both sources' details. Dr. Haddad notes that discrepancies are where risk hides, because each system looks fine on its own. Reconciliation turns separate records into a single picture, which is the basis for access reviews and asset audits. The active account matching no staff member is the most urgent, because nobody can say who is using it.

Worked example

Sofia writes tested functions, joins three sources with a mapping table and finds leaver accounts, leaver laptops and an orphan account.

Synthetic case. Sources and discrepancies are synthetic.

Errors and limits

Mapping errors cause false alarms. Sources may share the same mistake.

Exercises

• EX022 — Test purpose. Why do governance scripts need tests? Rubric: 3 = their output may be used as evidence;; 2 = evidence;; 1 = vague;; 0 = none.
• EX023 — Join problem. Why did Sofia need a mapping table? Rubric: 3 = sources use different identifiers;; 2 = identifiers;; 1 = vague;; 0 = none.
• EX024 — Orphan account. What is an orphan account in this check? Rubric: 3 = an active account matching no staff member;; 2 = orphan;; 1 = vague;; 0 = none.

Synthesis

Tested scripts that reconcile several sources reveal risks hidden between systems.

Continue studying — chapter 08 of 40

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →