Chapter 8 — Security governance, risk and compliance: difficult cases | Postgraduate Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 A critical supplier fails"]
  N2["8.2 Incomplete evidence"]
  N3["8.3 Escalation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 A critical supplier fails"]
  N2["8.2 Incomplete evidence"]
  N3["8.3 Escalation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 A critical supplier fails]
    |
    v
[8.2 Incomplete evidence]
    |
    v
[8.3 Escalation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) handle conflicts between compliance and risk; (2) decide under incomplete evidence; (3) escalate appropriately.

8.1 A critical supplier fails

A high-tier claims supplier's SOC 2 type two report shows exceptions: access reviews were not performed for two quarters. The supplier is critical, and replacing it would take a year. Daniel must recommend what to do. He considers options: accept with compensating controls, require a remediation plan with milestones, increase monitoring or start an exit plan. He recommends a remediation plan, extra monitoring of the supplier's access to Halbrook data and a parallel exit assessment. The parallel exit assessment keeps Halbrook from being trapped if the remediation milestones slip.

8.2 Incomplete evidence

A new cloud provider for fraud analytics offers only a recent ISO/IEC 27001:2022 certificate, whose scope does not clearly include the analytics service. Daniel cannot confirm controls directly. He recommends a limited pilot with synthetic data, contractual rights to audit and a request for a scope statement. He learns that difficult cases rarely offer complete evidence, and that good practice is to limit exposure while evidence is gathered rather than choose between blind trust and refusal. The synthetic-data pilot lets fraud analysts test the service while no policyholder data is exposed to unconfirmed controls.

8.3 Escalation

A business director wants to proceed with the analytics provider using real policyholder data before the scope statement arrives. Daniel escalates to the chief risk officer with a short memo: the decision needed, the options, the risk and his recommendation. The chief risk officer supports the pilot with synthetic data only. Daniel learns that escalation is a normal governance tool, and that a clear memo makes it a decision process rather than a personal dispute. The memo also leaves a record showing that the director's request and the risk reasoning were both considered.

Worked example

Daniel handles SOC 2 exceptions at a critical supplier, limits exposure to an uncertain provider and escalates a data decision with a clear memo.

Synthetic case. Suppliers and decisions are synthetic; SOC 2 and ISO/IEC 27001:2022 are real.

Errors and limits

Compensating controls can mask risk. Escalation can strain relationships.

Exercises

EX036 — SOC 2 exception. What exception did the supplier's report show?
Show marking criteria
Rubric: 3 = access reviews not performed for two quarters;; 2 = access review;; 1 = vague;; 0 = none.
EX037 — Critical supplier plan. What did Daniel recommend for the critical supplier?
Show marking criteria
Rubric: 3 = remediation plan, extra monitoring and parallel exit assessment;; 2 = three;; 1 = replace immediately;; 0 = none.
EX038 — Scope doubt. Why was the provider's certificate insufficient?
Show marking criteria
Rubric: 3 = its scope did not clearly include the analytics service;; 2 = scope;; 1 = vague;; 0 = none.
EX039 — Limited exposure. How did Daniel limit exposure while gathering evidence?
Show marking criteria
Rubric: 3 = pilot with synthetic data and audit rights;; 2 = pilot;; 1 = vague;; 0 = none.
EX040 — Escalation memo. What did Daniel's escalation memo contain?
Show marking criteria
Rubric: 3 = decision needed, options, risk and recommendation;; 2 = memo;; 1 = vague;; 0 = none.

Synthesis

Difficult cases call for limiting exposure, reading assurance carefully and escalating clearly.

Continue studying — chapter 08 of 12

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →