Chapter 8 — Security governance, risk and compliance: supervised case analysis

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 The case"]
  N2["8.2 Analysis"]
  N3["8.3 Recommendations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 The case"]
  N2["8.2 Analysis"]
  N3["8.3 Recommendations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 The case]
    |
    v
[8.2 Analysis]
    |
    v
[8.3 Recommendations]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) analyse a governance case under supervision; (2) identify control and governance failures; (3) recommend proportionate improvements.

8.1 The case

Mr. Reyes gives Lena a synthetic case from a peer credit union. A supplier managing the card platform was breached, exposing some member card data. The credit union had a contract with security clauses and received an annual certificate, but nobody reviewed the supplier's assurance report, which noted exceptions in access management. After the breach, the regulator asked why the exceptions were not followed up. The unread exceptions in access management are exactly the kind of warning that a review of the assurance report would have caught.

8.2 Analysis

Lena identifies failures at several levels. At control level, supplier access management had known weaknesses. At process level, assurance reports were received but not read. At governance level, nobody owned supplier risk, and the board never saw supplier risk reported. She notes that this pattern mirrors Marston's own vendor management gap found in self-assessment. She learns that cases are most valuable when they reveal patterns relevant to one's own organisation. Marston's largest self-assessment gap, vendor management at one point three three, therefore becomes the focus of her recommendations.

8.3 Recommendations

Lena recommends that Marston assign an owner for supplier risk, review assurance reports for critical suppliers with a checklist that highlights exceptions, track exceptions as findings and report supplier risk to the board twice a year. She keeps the recommendations proportionate to Marston's size. Mr. Reyes asks how she would measure success; she proposes tracking the share of critical suppliers with reviewed reports and the time to follow up exceptions. Both measures can be reported in the twice-yearly supplier risk update to the board.

Worked example

Lena analyses a peer supplier breach, finds failures at control, process and governance levels and recommends proportionate improvements with measures.

Synthetic case. The case is synthetic.

Errors and limits

Single cases may not generalise. Hindsight makes failures look obvious.

Exercises

• EX036 — Case trigger. What triggered the regulator's question?
  Show marking criteria

  Rubric: 3 = unreviewed exceptions in the supplier's assurance report;; 2 = exceptions;; 1 = vague;; 0 = none.
• EX037 — Process failure. What was the process-level failure?
  Show marking criteria

  Rubric: 3 = assurance reports received but not read;; 2 = unread;; 1 = vague;; 0 = none.
• EX038 — Governance failure. What was the governance-level failure?
  Show marking criteria

  Rubric: 3 = nobody owned supplier risk and the board never saw it;; 2 = ownership;; 1 = vague;; 0 = none.
• EX039 — Exception tracking. How should supplier exceptions be handled?
  Show marking criteria

  Rubric: 3 = tracked as findings;; 2 = findings;; 1 = ignored;; 0 = none.
• EX040 — Success measure. Give one measure of success Lena proposed.
  Show marking criteria

  Rubric: 3 = share of critical suppliers with reviewed reports;; 2 = measure;; 1 = vague;; 0 = none.

Synthesis

Case analysis reveals multi-level failures and patterns relevant to one's own organisation.

Continue studying — chapter 08 of 12

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →