◇ OpenCyber Academy
Postgraduate · Chapter 12 · English

Chapter 12 — Final review and transfer

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Final review and transfer

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Final review"]
  N2["12.2 Transfer"]
  N3["12.3 Continuing development"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Final review"]
  N2["12.2 Transfer"]
  N3["12.3 Continuing development"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX056"]
[Learning outcomes]
    |
    v
[12.1 Final review]
    |
    v
[12.2 Transfer]
    |
    v
[12.3 Continuing development]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) review your postgraduate learning critically; (2) transfer methods to new contexts; (3) plan continuing development.

12.1 Final review

Daniel presents his work to Dr. Varga and an external examiner from another insurer. He summarises the decisions, evidence and results and answers questions. The examiner asks whether quantification will survive his departure. Daniel points to the handover, the trained colleague and internal audit's review of the method. Dr. Varga asks what he would do differently; he answers that he would collect incident cost data from the start and involve brokers earlier. Both answers point to data and stakeholders he could have engaged earlier, not to flaws in the methods themselves.

12.2 Transfer

Daniel considers how his methods transfer. Tiering applies to any organisation with many suppliers. Loss exceedance reporting suits organisations with boards used to financial risk, such as banks or pension funds, but may need simplification for smaller charities. Calibration training applies wherever experts estimate uncertain quantities. He learns that methods transfer best when their assumptions are explicit, so new users can check whether those assumptions hold in their setting. For a small charity, for instance, a single tiering rule based on data access may be enough where Halbrook needed three criteria.

12.3 Continuing development

Daniel plans continuing development: deeper study of statistics for risk, following updates to NIST CSF and ISO standards and joining a professional community on risk quantification. He also commits to mentoring a junior colleague. Dr. Varga notes that GRC practice changes quickly and that his habits of critical reading, controlled evaluation and transparent reporting will remain useful as specific frameworks change. Dr. Varga also suggests he keep his calibration records, so he can later check whether his own estimates stay well calibrated.

Worked example

Daniel defends his work, explains how methods transfer with explicit assumptions and plans continuing development.

Synthetic case. The review is synthetic.

Errors and limits

Self-review can be generous. Transfer needs local testing.

Exercises

Synthesis

Final review consolidates learning and prepares methods for transfer to new contexts.

Continue studying — chapter 12 of 12

← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →