Chapter 4 — Security governance, risk and compliance: competing explanations
Lesson map
Lesson 04 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Rival explanations"]
N2["4.2 Designing checks"]
N3["4.3 Literature on control effectiveness"]
N4["4.4 Judging plausibility"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Rival explanations"]
N2["4.2 Designing checks"]
N3["4.3 Literature on control effectiveness"]
N4["4.4 Judging plausibility"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX021"]
[Learning outcomes]
|
v
[4.1 Rival explanations]
|
v
[4.2 Designing checks]
|
v
[4.3 Literature on control effectiveness]
|
v
[4.4 Judging plausibility]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) list rival explanations for an observed difference; (2) design checks that can distinguish them; (3) judge which explanations remain plausible.
4.1 Rival explanations
Before collecting data, Lucas lists explanations that could produce lower excess access in quarterly units even if frequency itself made no difference. Quarterly units might have lower turnover. They might have fewer systems, making access simpler. Their managers might be more diligent in general, and diligence rather than frequency could drive results. Reviews might also be rubber-stamped, in which case frequency would add cost without benefit. Writing these down early forces him to plan checks rather than explain results away later.
4.2 Designing checks
For each rival, Lucas plans a check. He compares turnover and system counts between groups. To probe diligence, he records whether units completed other controls on time, such as security training. To detect rubber-stamping, he measures how many access removals each review produced and how long reviewers spent per account. If quarterly reviews remove almost nothing and take seconds per account, their apparent benefit is suspect. These checks cannot prove cause but can make some explanations much less plausible. Each check is written into the plan.
4.3 Literature on control effectiveness
Lucas connects his checks to the literature. Herley and van Oorschot (2017) argue that security research often lacks falsifiable claims, and he uses their point to insist that his hypothesis could fail. Gordon and Loeb (2002) remind him that more control is not always worth its cost, so he will compare benefit with reviewer hours. The COBIT 2019 emphasis on performance management supports measuring whether a process achieves its goal, not merely whether it occurs. Together these sources shape what he measures, how he frames costs and what counts as a fair test of his idea.
4.4 Judging plausibility
Lucas plans to report each rival with its check result and a judgement: ruled less likely, still plausible or untested. He will avoid claiming that quarterly review causes lower excess access unless the main rivals are weakened. Dr. Solberg approves this structure, noting that examiners value candour about what remains uncertain. She also asks him to state in advance what result would count against his hypothesis: no meaningful difference, or a difference that disappears among units with similar turnover. Lucas adds this to his plan.
Worked example
Lucas lists four rival explanations, plans checks for each and states in advance what result would count against his hypothesis.
Synthetic case. Planned checks are synthetic; cited works are real.
Errors and limits
Some rivals cannot be tested. Diligence measures are crude.
Exercises
- EX021 — Rubber-stamp test. How will Lucas detect rubber-stamping? Rubric: 3 = removals per review and time per account;; 2 = removals;; 1 = vague;; 0 = none.
- EX022 — Diligence proxy. What proxy does Lucas use for general diligence? Rubric: 3 = on-time completion of other controls such as training;; 2 = training;; 1 = vague;; 0 = none.
- EX023 — Cost lens. Which source reminds Lucas that more control is not always worth its cost? Rubric: 3 = Gordon and Loeb (2002);; 2 = Gordon-Loeb;; 1 = vague;; 0 = none.
- EX024 — Falsifiability. Why does Lucas cite Herley and van Oorschot? Rubric: 3 = to insist his hypothesis could fail;; 2 = falsifiable;; 1 = vague;; 0 = none.
- EX025 — Judgement categories. Which three judgements will each rival receive? Rubric: 3 = ruled less likely, still plausible or untested;; 2 = three;; 1 = vague;; 0 = none.
- EX026 — Disconfirming result. What result would count against the hypothesis? Rubric: 3 = no meaningful difference, or one that disappears at similar turnover;; 2 = stated;; 1 = vague;; 0 = none.
Synthesis
Listing and checking rival explanations is the core of honest observational research.
Continue studying — chapter 04 of 08
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →