OpenCyber Academy
Postgraduate · Chapter 4 · English
Course code: OCA-143Chapter 04: OCA-143-C004

Chapter 4 — Advanced risk and ethics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Ethics of numbers"]
  N2["4.2 Conflicts of interest"]
  N3["4.3 Protecting people"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Ethics of numbers"]
  N2["4.2 Conflicts of interest"]
  N3["4.3 Protecting people"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Ethics of numbers]
    |
    v
[4.2 Conflicts of interest]
    |
    v
[4.3 Protecting people]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) identify ethical issues in risk quantification and assurance; (2) handle conflicts of interest; (3) protect people affected by risk decisions.

4.1 Ethics of numbers

Daniel considers ethical issues in quantification. Numbers can be used to justify cutting controls by choosing optimistic inputs, or to frighten boards into spending with pessimistic ones. He learns that ethical practice means documenting sources for each estimate, inviting independent challenge and reporting ranges honestly. He also notes that people affected by risks, such as policyholders whose data could be exposed, rarely appear in loss models, so their interests need explicit attention. In the supplier breach scenario, he therefore adds a short narrative of the harm to policyholders beside the loss figures.

4.2 Conflicts of interest

Daniel's role creates potential conflicts. He estimates risks for controls his own team runs, and his bonus depends partly on meeting budget targets. Dr. Varga asks how he will manage this. He proposes that internal audit review his key estimates, that he declare the conflict to the risk committee and that budget decisions be made by people other than the estimator. He learns that conflicts are normal in practice and become harmful mainly when they are hidden. He also records the declaration in the committee minutes so that later reviewers can see the conflict was known when estimates were accepted.

4.3 Protecting people

Halbrook considers reducing breach notification costs by narrowing what counts as a notifiable incident. Daniel points out that notification obligations come from law and that narrowing them would harm policyholders who need to protect themselves. He recommends instead investing in faster detection so incidents are smaller. He learns that GRC professionals sometimes need to defend people outside the organisation, and that compliance with law is a minimum, not the full measure of ethical conduct. Faster detection also reduces the number of policyholders affected, which the notification approach would only have hidden.

Worked example

Daniel documents estimate sources, declares and mitigates his conflicts and defends policyholders' interests in notification decisions.

Synthetic case. The cases are synthetic.

Errors and limits

Ethical judgements can be contested. Declared conflicts still influence.

Exercises

Synthesis

Ethical GRC practice documents estimates, manages conflicts and protects those affected by risk.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →

Worked answers

EX016. By choosing optimistic or pessimistic inputs to justify cutting or increasing spending.

EX017. People affected by risks, such as policyholders.

EX018. Internal audit review of estimates, declaring the conflict and having others make budget decisions.

EX019. Because notification duties come from law and narrowing them would harm policyholders.

EX020. As a minimum rather than the full measure of ethical conduct.