## Chapter 1 — Calculus I ### Learning outcomes You will (1) describe risk that changes over time with rates; (2) read when exposure is growing or shrinking; (3) use accumulation to total exposure across a period. ### 1.1 Rates in governance Nadia Okafor is an engineering student at the fictional Kestrel Polytechnic. Her supervisor, Prof. Tomas Brenner, links every foundation course to one running case: the fictional Ardwell Power Cooperative, an electricity distributor with nine hundred staff, a customer payment portal and remote access for the vendors who maintain its control systems. In calculus Nadia learns that a derivative measures how fast something changes. At Ardwell, the number of open audit findings changes each month. Its rate of change shows whether the backlog is shrinking, holding steady or growing, which the board needs more than a single monthly count. ### 1.2 Reading the curve Nadia plots open findings after the last external audit. The count jumps when the report arrives and then declines as teams close items, quickly at first and then slowly, because the hardest findings remain. The derivative is steeply negative early and flattens later. Where the curve flattens, management attention usually fades, and old findings linger. Nadia learns that a straight-line forecast would wrongly promise that every finding closes by a fixed date. Choosing a realistic shape for how organisations actually respond is the first modelling decision in governance analysis. ### 1.3 Accumulating exposure Integration adds a rate over time. Nadia uses it to define exposure from a known weakness: each day an unpatched internet-facing server remains open adds to the window in which an attacker could use it. The area under the curve of open weaknesses over time is the accumulated exposure. Closing findings faster shrinks that area even if the final count is the same. This gives Ardwell a better governance measure than the number of findings closed, because it rewards speed on the weaknesses that matter. ### Worked example Nadia describes the audit-finding backlog as a curve, reads its rate of change and defines accumulated exposure as an area. > **Synthetic case.** Kestrel, Ardwell and all figures are synthetic. ### Errors and limits Smooth curves hide lumpy monthly data. Exposure areas ignore how severe each weakness is. ### Exercises - **EX001 — Backlog trend.** What does the rate of change of open findings tell the board? *Rubric:* 3 = whether the backlog is shrinking, steady or growing;; 2 = trend;; 1 = vague;; 0 = none. - **EX002 — Flattening meaning.** Why does the flattening of the curve matter? *Rubric:* 3 = attention fades and hard findings linger;; 2 = lingering;; 1 = vague;; 0 = none. - **EX003 — Exposure integral.** How does Nadia define accumulated exposure? *Rubric:* 3 = area under open weaknesses over time;; 2 = area;; 1 = count;; 0 = none. ### Synthesis Rates and accumulation describe how governance backlogs and exposure change over time. ### Continue studying — chapter 01 of 50 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** Whether the backlog of open findings is shrinking, holding steady or growing. **EX002.** Because management attention fades there and the hardest findings linger. **EX003.** As the area under the curve of open weaknesses over time.