Chapter 17 — Control and feedback basics
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Governance as feedback"]
N2["17.2 Delays"]
N3["17.3 Overreaction"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Governance as feedback"]
N2["17.2 Delays"]
N3["17.3 Overreaction"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Governance as feedback]
|
v
[17.2 Delays]
|
v
[17.3 Overreaction]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) describe governance as a feedback loop; (2) identify sensors, set points and actuators in a management system; (3) recognise delays and oscillation in governance responses.
17.1 Governance as feedback
In control engineering, a system measures its output, compares it with a set point and adjusts its input to reduce the difference. Nadia sees the same loop in governance. Ardwell's board sets risk appetite as the set point. Monitoring and key risk indicators act as sensors. Decisions about budgets, controls and priorities act as actuators. ISO/IEC 27001:2022 builds this loop into its requirements for monitoring, internal audit, management review and continual improvement, so the management system corrects itself over time. In this loop, internal audit and management review are the steps that compare measured risk with the board's set point.
17.2 Delays
Feedback loops with long delays behave badly. If Ardwell measures control performance once a year, problems grow for months before anyone responds, and corrective actions arrive late. Nadia models a simple loop in which a backlog of findings is reviewed quarterly versus annually and sees that the annual loop lets the backlog swing much further from target. She learns that faster measurement does not guarantee better control, but slow measurement almost guarantees poor control, especially when risks change quickly. Prof. Brenner adds that quarterly review only helps if decisions are also taken quarterly; a fast sensor with a slow actuator still lags.
17.3 Overreaction
Too strong a response can also cause trouble. After a bad audit, management might impose strict controls everywhere, causing workarounds and complaints, then relax them, then tighten again. Engineers call this oscillation. Nadia suggests proportionate responses tied to the size of the gap and the importance of the asset. Prof. Brenner notes that good governance aims for steady improvement rather than dramatic swings, and that documented decision rules help managers respond consistently instead of reacting to the latest headline or audit report. A rule such as tightening controls only for assets above a defined criticality would damp the swings after a bad audit.
Worked example
Nadia maps appetite, indicators and decisions onto a feedback loop and shows how delays and overreaction degrade governance.
Synthetic case. The models are illustrative; ISO/IEC 27001:2022 is real.
Errors and limits
Organisations are not linear systems. Indicators can be gamed.
Exercises
- EX049 — Set point. What acts as the set point in Ardwell's governance loop? Rubric: 3 = the board's risk appetite;; 2 = appetite;; 1 = vague;; 0 = none.
- EX050 — Annual loop. What happened to the backlog when reviewed annually instead of quarterly? Rubric: 3 = it swung further from target;; 2 = larger swings;; 1 = vague;; 0 = none.
- EX051 — Oscillation cure. What helps managers avoid oscillating responses? Rubric: 3 = proportionate, documented decision rules;; 2 = rules;; 1 = vague;; 0 = none.
Synthesis
Governance works as a feedback loop that needs timely sensing and proportionate correction.
Continue studying — chapter 17 of 50
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →