Chapter 10 — Security governance, risk and compliance: quality and troubleshooting
Lesson map
Lesson 10 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Ageing"]
N2["Lab — Ageing of open findings by severity"]
N3["10.2 Why findings stall"]
N4["10.3 Fixes"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Ageing"]
N2["Lab — Ageing of open findings by severity"]
N3["10.2 Why findings stall"]
N4["10.3 Fixes"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX046"]
[Learning outcomes]
|
v
[10.1 Ageing]
|
v
[Lab — Ageing of open findings by severity]
|
v
[10.2 Why findings stall]
|
v
[10.3 Fixes]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) measure the quality of the findings process; (2) identify ageing problems; (3) troubleshoot why findings stall.
10.1 Ageing
Lena checks how long open findings have been outstanding against their severity targets. The lab examines eight open findings. Of three high findings, two are past the thirty-day target, at forty-eight and ninety-five days. Of three medium findings, one is past ninety days at one hundred and thirty. Of two low findings, one is past one hundred and eighty days at two hundred. Four of eight findings are overdue, half of all open items. Ageing alone does not explain why these four stalled, which is why she turns to the owners next.
Lab — Ageing of open findings by severity
"""Ageing of open audit findings by severity (synthetic Marston data, days open)."""
f = [("high", 12), ("high", 95), ("medium", 40), ("medium", 130), ("medium", 75), ("low", 200), ("low", 15), ("high", 48)]
lim = {"high": 30, "medium": 90, "low": 180}
for s in ("high", "medium", "low"):
a = [d for x, d in f if x == s]; over = [d for d in a if d > lim[s]]
print(f"{s}: open {len(a)}, past {lim[s]}-day target {len(over)} {over}")
print(f"total open {len(f)}; overdue {sum(d > lim[s] for s, d in f)}")
Run with python3 lab_age.py. Verified output:
high: open 3, past 30-day target 2 [95, 48]
medium: open 3, past 90-day target 1 [130]
low: open 2, past 180-day target 1 [200]
total open 8; overdue 4
10.2 Why findings stall
Lena interviews owners of the four overdue findings. The ninety-five-day high finding needs a supplier change the supplier has not prioritised. The forty-eight-day high finding has a fix ready but waiting for a change window. The medium finding's owner left Marston and nobody took it over. The low finding was considered unimportant and forgotten. She learns that ageing data show where to look, but conversations reveal causes, which differ for each finding. The orphaned medium finding, for example, needs a process fix, while the supplier issue needs contractual pressure.
10.3 Fixes
Lena proposes specific fixes: escalate the supplier issue through contract management, schedule an extra change window for the ready fix, reassign orphaned findings automatically when owners leave and review low findings quarterly so they are either fixed or formally accepted. She also suggests adding the reason for delay to each overdue finding in the committee report. She learns that improving process quality means addressing distinct causes rather than applying one general push. The added delay reasons also let the committee see whether the same cause keeps recurring.
Worked example
Lena finds four of eight findings overdue, discovers four different causes through interviews and proposes a specific fix for each.
Synthetic case. Findings and causes are synthetic.
Errors and limits
Small numbers. Interviews may be defensive.
Exercises
- EX046 — Overdue count. How many open findings were overdue? Rubric: 3 = four of eight;; 2 = 4/8;; 1 = vague;; 0 = none.
- EX047 — High overdue. Which high findings were overdue? Rubric: 3 = those at 48 and 95 days;; 2 = two;; 1 = vague;; 0 = none.
- EX048 — Orphan cause. Why did the medium finding stall? Rubric: 3 = its owner left and nobody took it over;; 2 = orphaned;; 1 = vague;; 0 = none.
- EX049 — Orphan fix. How will orphaned findings be prevented? Rubric: 3 = automatic reassignment when owners leave;; 2 = reassign;; 1 = vague;; 0 = none.
- EX050 — Low finding fix. How should low findings be handled? Rubric: 3 = reviewed quarterly to fix or formally accept;; 2 = quarterly;; 1 = vague;; 0 = none.
Synthesis
Ageing data point to stalled findings, and conversations reveal distinct causes to fix.
Continue studying — chapter 10 of 12
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →