Chapter 4 — Advanced risk and ethics
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Risk with uncertainty"]
N2["4.2 Duties to policyholders"]
N3["4.3 Duties to staff"]
N4["4.4 Disclosure"]
N5["4.5 Proportionality"]
N6["4.6 Recording judgements"]
N7["Reviewing the risk view"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Risk with uncertainty"]
N2["4.2 Duties to policyholders"]
N3["4.3 Duties to staff"]
N4["4.4 Disclosure"]
N5["4.5 Proportionality"]
N6["4.6 Recording judgements"]
N7["Reviewing the risk view"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 Risk with uncertainty]
|
v
[4.2 Duties to policyholders]
|
v
[4.3 Duties to staff]
|
v
[4.4 Disclosure]
|
v
[4.5 Proportionality]
|
v
[4.6 Recording judgements]
|
v
[Reviewing the risk view]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) assess risk across the cloud estate with uncertainty; (2) consider ethical duties to policyholders and staff; (3) balance disclosure, fairness and proportionality.
4.1 Risk with uncertainty
For each unenforced namespace, Inês estimates likelihood and impact as ranges, noting the evidence for each. Pricing and quotes hold customer data and face the internet, so their impact range is high; analytics runs user code, so its likelihood range is higher. Ranges reflect what Inês actually knows: she cannot give an exact probability that an unenforced namespace will be exploited, but she can explain why one is more exposed than another. Writing down the evidence for each range lets others challenge it. The result ranks analytics with quotes-prod as first priority, even though analytics holds less customer data.
4.2 Duties to policyholders
Beacon holds health and claims information. Policyholders cannot protect themselves from configuration gaps; Beacon has a duty of care to fix them promptly and to report breaches honestly. A policyholder submitting a claim has no way to check how Beacon configures its clusters, so they rely on Beacon to do it properly. That reliance is why Inês treats unenforced namespaces holding health and claims information as urgent, and why honest reporting matters if something goes wrong. Her plan therefore moves pricing and quotes, which hold customer data, through enforcement first.
4.3 Duties to staff
The audit finding could be framed as someone's failure. Inês frames it as a process gap: the upgrade checklist lacked a step for the PodSecurityPolicy replacement. Blame would discourage people from reporting future problems. Framing the finding as a process gap also points to the fix: a checklist step that confirms admission configuration during upgrades. When the engineer who ran the upgrade worried he would be blamed, Inês showed him the review wording and invited him to co-write the new step. He later led the rollout for two of Beacon's four clusters. Inês notes that the same gap could have occurred with anyone running the upgrade.
4.4 Disclosure
No misuse was detected, so regulatory notification is not required, but Beacon's board and the regulator's supervisory contact are informed in the regular risk report, as Beacon's policy requires for significant control gaps. Informing the board and supervisory contact through the regular report keeps them aware without treating the gap as a breach. The report states what was found, that no misuse was detected, and what is being done. Inês records the disclosure decision with its reasons and the policy it follows, so it can be reviewed if new evidence appears. If later evidence showed misuse, the notification question would be reopened.
4.5 Proportionality
Controls must not stop claims processing; changes are staged to avoid harming policyholders waiting for payments. Claims processing pays policyholders, so a control that blocks a claims job could delay money people are waiting for. Staging changes means each namespace moves through audit and warn modes before enforcement, giving teams time to fix workloads. The legacy claims batch receives a time-limited exception with compensating controls rather than being blocked outright, so payments continue while the rewrite proceeds. Claims-prod is moved last, after the other clusters have shown the staged approach works.
4.6 Recording judgements
Each ethical judgement, such as the disclosure decision, is written with reasons and who made it. Writing judgements down makes them open to review, which matters because ethical decisions are easy to make quietly and hard to check later. For the disclosure decision, the record names Inês and Beacon's risk officer, cites the policy for significant control gaps, and explains why notification was not required. Prof. Rao reviews the records as part of the course, asking whether each reason would convince an outsider. The records are kept with the risk committee's minutes, so later reviewers find them alongside the decisions they explain.
Reviewing the risk view
Prof. Rao asks Inês to state what evidence would change her risk ranges. She lists three: a detected misuse in logs, a new public exposure of a quotes service, and a change in the analytics user base. Writing these down turns the assessment into something that can be updated rather than defended, and it gives the risk committee clear triggers for revisiting the ranking.
Worked example
A platform engineer worries he will be blamed because he ran the upgrade. Inês shows him the review wording and invites him to co-write the new upgrade checklist step. He later leads the rollout for two clusters.
Synthetic case. People and decisions are synthetic.
Errors and limits
Ethical choices often lack a single right answer; make reasoning visible.
Exercises
- EX016 — Risk ranges. Why use ranges for likelihood and impact? Rubric: 3 = uncertainty in estimates; 2 = partial; 1 = vague; 0 = none.
- EX017 — Process framing. How was the finding framed? Rubric: 3 = process gap in upgrade checklist; 2 = partial; 1 = vague; 0 = none.
- EX018 — Disclosure. How was the gap disclosed? Rubric: 3 = board and regulator contact via risk report; 2 = partial; 1 = vague; 0 = none.
- EX019 — Proportionality. How is proportionality applied? Rubric: 3 = staged changes so claims continue; 2 = partial; 1 = vague; 0 = none.
- EX020 — Engineer outcome. What happened with the worried engineer? Rubric: 3 = co-wrote checklist; led rollout; 2 = partial; 1 = vague; 0 = none.
Synthesis
Weigh risk honestly and treat people fairly.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →