At Alder Quay Logistics, a delayed access review leaves former contractors able to approve freight refunds. The operations director calls this a governance failure but asks the board to disable accounts itself. The CISO says the risk committee owns every security risk, and an internal auditor offers to approve the repair and later certify it independently.
You must establish who decides, who performs the work, and who can challenge the evidence. The board needs a decision-ready report before its next meeting, not a list of technical tickets. Work through a refund-policy decision, a numerical loss boundary, and an escalation route that still works between scheduled meetings.
Delegating work does not erase accountability; a committee name does not prove decision authority.
Governance directs; management delivers
Governance evaluates stakeholder needs, sets direction and boundaries, and monitors whether objectives are achieved. Management plans, implements, and operates within those boundaries. The board approves a risk appetite and challenges results; executives allocate resources and deliver the response. Disabling a departed contractor account is an operational management action, even when a board finding prompted it.
The board retains oversight accountability, including when it delegates detailed scrutiny to a risk committee. The chief executive translates direction into funded priorities. Business executives own risks to their objectives: the operations director owns refund-service risk, rather than transferring it to the CISO merely because access technology is involved. The CISO advises leadership, coordinates the security program, and reports exposure; explicit delegated authority determines which decisions the CISO may approve.
An auditor asks for delegation records, decision minutes, named risk owners, and evidence that overdue remediation received challenge. A chart containing job titles is insufficient if nobody can explain who may accept a material exception. Avoid both extremes: making the board operate controls and allowing operators to redefine acceptable exposure without authorization.
Direction flows down; exposure and evidence flow up through defined decision rights.
Three lines describe roles, not three departments
In the three lines model, first-line management owns service delivery and manages its risks. Refund supervisors operate approval controls and resolve access-review findings. Second-line roles provide expertise, support, monitoring, and challenge: risk or compliance staff can set methods and question weak control evidence. Both first and second lines are management roles, not independent assurance merely because their names contain assurance or compliance.
Internal audit provides third-line independent assurance on governance and risk management, with direct functional access to the governing body or its audit committee. It can advise on a control design without taking management's decision or operating the control. If an auditor approves individual refunds and later audits those approvals, self-review compromises independence. External assurance providers can complement the model but are not simply a fourth mandatory line.
A small company may combine responsibilities, but must identify conflicts and safeguards such as independent review and alternate reporting access. A CISO who runs security operations is performing first-line work for those activities; a security oversight team may perform second-line work. An auditor asks what people actually do, who evaluates their work, and whether they can report adverse findings without management filtering them.
RACI turns a vague owner into a decision map
RACI distinguishes Responsible, who performs the activity; Accountable, who answers for its outcome and final decision; Consulted, who contributes before the decision; and Informed, who receives the result. Use one clearly identified accountable role per activity in this room's convention. Several people may perform work, and the accountable person may also perform it, but that does not override an independent-approval requirement.
Worked example: for drafting the refund access policy, the security analyst is R, the operations director is A, legal and the CISO are C, and service managers are I. For approving that policy under Alder Quay's charter, the executive risk committee is A and performs the approval decision, the policy coordinator is R for preparing the approval package, legal and the CISO are C, and service managers are I. For implementing access changes, the access administrator is R, the operations director is A, the CISO is C, and internal audit is I. Different activities have different accountable roles; the board is not automatically A for every row.
Segregation of duties prevents one person from controlling incompatible stages, such as requesting, approving, and executing their own privileged access. RACI clarifies roles but does not technically enforce separation: distinct identities, approval gates, access restrictions, and logs must implement it. An auditor samples a real change from request to authorization to execution. In a small team, a documented independent compensating review may reduce risk, but a second signature by the same person using another account does not.
Charters and policy cycles give decisions legitimacy
A committee charter states purpose, scope, membership, chair, delegated authority, quorum, meeting cadence, reporting route, and escalation rules. Alder Quay's executive risk committee can approve operational security policies with three voting members present; it cannot increase board-approved risk appetite. Minutes record attendees, conflicts, evidence considered, decisions, owners, and due dates. A meeting without the required quorum can discuss a proposal but cannot claim a valid approval under that charter.
A policy expresses mandatory direction; standards define required detail, and procedures explain execution. The policy owner drafts a version, consults affected functions, obtains approval from the authorized body, publishes the effective version, communicates changes, and retains superseded copies. Alder Quay reviews policies every twelve months and after material incidents, legal changes, or business changes. Review does not require pointless edits, but a no-change outcome still needs dated evidence and the designated reviewer.
Track version, owner, approver, approval date, effective date, next review date, and exceptions with expiry and authority. An auditor asks whether staff used the approved version and whether a material incident triggered review before the annual deadline. Common errors include treating a draft as effective, making the author their own unauthorized approver, and calling an unreviewed policy current because its next scheduled date has not arrived.
Appetite, tolerance, and capacity are different boundaries
Risk appetite is the amount and type of risk an organization is willing to pursue or retain to achieve objectives. Risk tolerance specifies acceptable variation around an objective or boundary; organizations must define its metric and time horizon. Risk capacity is the maximum exposure the organization can bear without jeopardizing viability or critical obligations. Capacity is a limit on ability, not permission to take all that risk. Financial and nonfinancial constraints may both matter.
For one simplified annual refund-loss measure, Alder Quay's board sets appetite at no more than 100,000 loss units in forecast annual residual loss. A documented tolerance permits temporary forecasts up to 120,000 only with executive remediation and board-risk-chair notification within one business day when the forecast exceeds 100,000. Finance estimates capacity at 300,000 on the same annual basis. A forecast of 110,000 is outside appetite but within the defined tolerance; it still triggers action. At 130,000, tolerance is breached although capacity remains unexceeded. At 310,000, capacity is exceeded and viability response is urgent. These figures are illustrative forecasts, not a universal formula or guarantees of loss.
Keep the scope, estimation method, horizon, uncertainty, and authority consistent when comparing measures. Do not compare a monthly incident count to an annual currency boundary, or confuse expected annual loss with a worst-case loss capacity estimate. This example deliberately uses one common forecast metric; real programs often need separate scenario stress tests as well. An auditor asks who approved the limits, when assumptions were refreshed, and what happened when a forecast crossed each threshold.
Being below capacity does not make an appetite or tolerance breach acceptable.
Escalate decisions, not just dashboards
Escalation rules identify the trigger, recipient, deadline, decision required, and fallback when a recipient is unavailable. At Alder Quay a forecast above appetite goes from the operations director through the executive risk committee to the board risk chair within one business day; a tolerance breach requires an urgent decision on containment, funding, or service restriction. Critical legal or safety duties follow their own immediate notification paths. Waiting for the quarterly board pack must not silently suspend escalation obligations.
A KPI measures performance toward an objective: 96 of 100 access reviews completed on time gives a 96% completion KPI against a 98% target. A KRI signals exposure: 8 of 200 privileged accounts lack a current owner, giving a 4% unowned-account KRI against a 2% trigger. The KPI can improve while risk worsens if teams finish easy reviews and leave dangerous accounts unresolved. A metric's purpose, not whether it is a percentage, determines the label; indicators may be leading or lagging and require contextual interpretation.
A board report links objectives, exposure against approved boundaries, trends, uncertainty, incidents, overdue actions, and decisions requested. Show the 4% KRI with denominator, source date, owner, response deadline, and the proposed restriction on unowned accounts; do not conceal it behind the 96% completion figure. Retain the report, minutes showing challenge, and follow-up actions. An auditor asks whether an adverse indicator actually reached someone with authority and whether decisions were implemented, not merely whether a dashboard existed.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The board's account queue
Scenario sim+45 XP
Resolve both role confusions using short terms.
Incident brief
The board sets the refund-loss boundary and asks executives to implement it. A director calls that boundary-setting management and insists governance means disabling accounts. Separately, internal audit designs the test plan and independently reports whether management's controls work; the CISO labels it second-line monitoring even though audit does not operate those controls.
Term bank, not all of these are right
governancethird linemanagementsecond line
1.1What function is the board performing by setting direction and monitoring outcomes? (one word)
1.2Which line provides the described independent internal audit assurance? (two words)
Task 2: The supposed capacity allowance
Scenario sim+45 XP
Identify the boundaries, not the manager's labels.
Incident brief
The board is willing to retain annual forecast loss of 100,000, permits temporary variation to 120,000 under an escalation rule, and estimates maximum bearable exposure at 300,000 on the same measure. A manager calls 300,000 the appetite and says a 130,000 forecast needs no escalation because the company can survive it.
2.1What term describes the board's willingness boundary of 100,000? (two words)
2.2Which boundary at 120,000 has the 130,000 forecast breached, while remaining below maximum bearable exposure? (two words)
Task 3: One person, two signatures
Scenario sim+45 XP
Name the assignment and the exposure measure.
Incident brief
The access administrator performs an approved change, while the operations director has final answerability for implementation. The administrator calls herself Accountable simply because she did the work, then signs her own access request as independent approver using a second login. In the same report, 4% of privileged accounts have no owner; the dashboard labels this an on-time delivery KPI despite using it to trigger exposure escalation.
Term bank, not all of these are right
responsibleKRIaccountableKPI
3.1Which RACI role describes the administrator performing the change, rather than the director's final answerability? (one word)
Alder Quay's coordinator calls the annual review reminder an approval and sets the loss ceiling to the maximum the company could survive. Replace those assumptions with the mandatory charter requirements.
Fill the starter as a declarative governance record. Passing checks validates these fields, not actual committee behavior, independence, or delivery of notifications.
Mandatory charter and reporting requirements
policy approval: executive risk committee
policy review: every 12 months and after a material incident
access-change implementation RACI: responsible = access administrator; accountable = operations director
independent approval of privileged access: required
annual residual loss in loss units: appetite 100000; tolerance limit 120000; capacity 300000
forecast above appetite: notify board risk chair within 1 business day
board reporting: every 3 months; report KPI review completion and KRI unowned privileged accounts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
Checks
Use authorized approval and both review triggers
Separate performance, accountability, and independent approval
Keep the three annual loss boundaries distinct
Route an appetite breach within the required deadline
Report performance and exposure at the required cadence
The coordinator marks every claim compliant because each has a signature. Judge each independent claim against the baseline, not its title.
Baseline: audit must not operate the controls it independently assures; privileged access requires a different human approver; committee approval needs three voting members; forecasts above 100000 require board risk chair notification within one business day. Policy review is annual and incident-triggered. Accept claims that meet their stated scope without inventing unrelated defects.
Verdicts are accept or reject. Every rejection needs one reason code from: audit-self-review | self-approval | invalid-quorum | missed-escalation.
Six independent governance evidence claims
GV-1 | Internal audit approves every refund and then independently assures the effectiveness of its own approvals.
GV-2 | An administrator requests privileged access and approves it using a second login; the log confirms both identities belong to the same person.
GV-3 | The executive risk committee declares a policy approved with only two voting members present; its charter requires three and provides no alternate approval route.
GV-4 | Annual forecast loss reaches 110000. Management suppresses board risk chair notification for a month because the figure remains below 120000 tolerance.
GV-5 | The policy file links authorized committee approval with three voters, publication, and a dated annual review; a later material incident also triggered documented review.
GV-6 | A board pack shows review completion at 96/100 as a KPI and unowned privileged accounts at 8/200 as a KRI, with source dates, thresholds, owners, decisions requested, and tracked actions.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · GRC Fundamentals
Risk Assessment in Practice
Build evidence-based risk scenarios, score exposure, and assign accountable treatment and review.
