Separate risk, controls, exceptions, and assurance claims using evidence rather than confident labels.
50 min 135 XPSkills: Risk terminology, Control classification, Assurance vocabulary
Brief
At Alder Quay Records, a stolen supplier password exposes customer delivery addresses. The operations lead calls the password an asset, the missing login safeguard a threat, and the incident itself a vulnerability. Meanwhile, a policy waiver is described as a certification, and a dashboard labels all remaining risk eliminated.
You are preparing the incident briefing and an assurance pack. Your job is to replace those labels with defensible claims: what could be harmed, how harm could occur, which safeguards change the exposure, and what the evidence actually demonstrates. Vocabulary matters because each term routes a decision to a different owner.
Name the object, event, weakness, decision, or evidence claim before choosing its label.
Build a risk statement, not a pile of synonyms
An asset is something of value: address records, the dispatch service, staff expertise, or trust in the service. A threat is a potential cause of harm, such as credential theft, accidental deletion, or flooding; the threat actor is the person or group behind an intentional threat. A vulnerability is a weakness a threat can exploit, such as a reusable supplier password without a second authentication factor. A credential can itself be a sensitive asset, but that does not make its theft a vulnerability.
Likelihood expresses how probable a defined event is over a stated period; impact expresses the consequences if it occurs. Risk concerns uncertainty and its effect on objectives, often expressed here as the possibility of a threat exploiting a vulnerability and harming an asset. Write: stolen supplier credentials could allow unauthorized address exports because access lacks a second factor, causing notification costs and delivery disruption. An incident is an event that has occurred; the risk statement describes possible future loss or recurrence.
For a simplified annual model, assume a 20% chance of one material export incident and a loss of 100,000 currency units if it occurs: expected annual loss is 0.20 × 100,000 = 20,000. That is not a forecast that exactly 20,000 will be lost. A 4-by-5 qualitative score of 20 is a ranking, not money or a calibrated probability. An auditor asks for the asset owner, event boundary, time horizon, assumptions, and basis for both estimates; listing only 'cyber risk: high' hides all five.
A risk statement connects a potential cause, a weakness, an event, and consequences over a defined horizon.
Inherent and residual describe a control baseline
Inherent risk is the exposure before the controls considered in the assessment; residual risk is what remains after those controls. Document the boundary: some methods exclude every safeguard, while others assess before a proposed treatment with baseline safeguards already present. Without that convention, two teams can report different inherent values for the same scenario and both appear consistent with their own method.
Using the previous annual model, set inherent likelihood at 20% and impact at 100,000. Tested login safeguards reduce the estimated likelihood to 5%; an export limit reduces estimated incident loss to 40,000. Residual expected annual loss is 0.05 × 40,000 = 2,000. The reduction is 18,000, not proof that the controls will stop every incident. If those controls are only planned, 2,000 is target residual risk, not demonstrated current exposure.
Compare remaining exposure against approved tolerance and route it to an authorized risk owner. A business decision to retain it is risk acceptance; it neither removes the threat nor proves a control works. An auditor asks whether effectiveness evidence supports the residual estimate and whether acceptance has scope, rationale, authority, review date, and triggers for reconsideration. Do not subtract ordinal high/medium/low labels as though they were currency.
Classify controls along two independent axes
By function, preventive controls attempt to stop an event, detective controls reveal events or unwanted conditions, corrective controls restore or remediate after a problem, and deterrent controls discourage attempts. A login block is preventive; an unusual-export alert is detective; restoring corrupted records is corrective; a monitored-area notice can be deterrent. Classify the specific mechanism and objective: logging alone does not prevent an export, and an alert without a responder may detect without limiting the damage.
By implementation, administrative controls use governance and people-led processes, technical controls use system mechanisms, and physical controls use tangible barriers or environmental safeguards. An approval procedure is administrative, an enforced access rule is technical, and a locked records-room door is physical. These are not competing lists: the door is physical and preventive; a guard's visible patrol may be physical and deterrent or detective. Some schemes call people-led controls operational; state your taxonomy instead of assuming universal labels.
A compensating control is an alternative safeguard used when the expected control cannot be implemented, addressing the same objective with justified comparable protection under the applicable rules. It may also be technical and preventive. For example, a legacy console cannot support the required login factor; tightly restricted access through a supervised gateway may compensate if tested against the same unauthorized-access risk. A generic backup does not compensate for weak login merely because both are security measures. An auditor asks why substitution is necessary, which objective it preserves, and what gaps remain.
Separate objectives, activities, and permission decisions
A control objective is the intended outcome, such as only authorized workers can export addresses. A control activity is the specific action or mechanism intended to achieve it, such as the service owner comparing export permissions against the active-worker list every month and removing mismatches within one day. 'Keep data safe' is too broad to test; 'run a monthly review' describes an activity but omits the decision criteria and follow-up. Ask an auditor what evidence would demonstrate the stated outcome and how the activity's scope supports it.
A policy exception authorizes a scoped departure from a policy requirement through the policy's governance process. Risk acceptance is an authorized decision to retain a specified exposure. They can be linked but are not interchangeable: the policy authority might grant a 30-day exception to the second-factor rule, while the risk owner separately accepts the remaining access risk subject to daily review. Depending on governance, one record can capture both decisions, but it must identify both authorities and their decisions.
For a worked case, the exception covers only console C until 30 June, requires gateway restrictions, names an owner, and has a replacement deadline. The risk acceptance records the remaining scenario, estimated loss range, rationale, and reassessment trigger if the gateway fails. A project manager saying 'we accept it' supplies neither authorization automatically. Acceptance cannot waive law or contractual requirements, and an expired exception is not renewed simply because the risk register remains open.
Findings describe evidence against criteria
A finding is an evaluation result based on evidence against criteria; depending on the method, findings can include conformity, deficiencies, or improvement opportunities. A nonconformity is failure to fulfill a requirement. An observation is commonly a noteworthy condition or improvement opportunity not established as a requirement breach, but report terminology varies. Do not downgrade a demonstrated breach to an observation to avoid an uncomfortable discussion, or invent a requirement merely because an auditor prefers a different practice.
Suppose the policy requires monthly reviews for every privileged account. Records show no review process for any of 60 accounts across three services over six months. Under a scheme where systemic absence indicates major nonconformity, this supports a major classification. One missed sign-off among 60 otherwise completed reviews may support minor nonconformity under the scheme's isolated-lapse criteria. Major/minor are not universal incident-severity labels: use the assessment scheme, consider systemic impact and recurrence, and do not classify by account count alone.
An auditor should state the criterion, objective evidence, gap, scope, and classification rationale. If policy mandates monthly review but says nothing about dashboard colors, a suggestion to improve the display is an observation, not a nonconformity on that basis. Conversely, four missed reviews cannot be declared minor solely because only four records were sampled; investigate whether the failure extends beyond the sample. A finding records what the evidence supports, not an assumed root cause or a preferred fix.
Assurance has scope, and effectiveness has two questions
An assessment systematically evaluates a subject against criteria using evidence. An attestation is a formal assertion or report about a subject under an applicable scheme; it can be a management declaration or, in professional assurance usage, a practitioner's report on subject matter. Certification is formal recognition of conformity under a defined certification scheme by an authorized body. Not every assessment produces certification, and a signed internal checklist does not become independent certification. Ask who issued the claim, their authority and independence, the criteria, subject, scope, period, and limitations.
Design effectiveness asks whether a control, if performed as specified, could achieve its objective. Operating effectiveness asks whether it actually operated as designed, with appropriate people and consistency, during the assessed period. A monthly review covering only employees is poorly designed for an objective that also includes contractors, even if every scheduled review occurred. A complete procedure that includes both populations may be well designed but operate poorly if reviewers never perform it.
Work the evidence: a procedure requires an owner to reconcile all 60 privileged accounts monthly and remove unauthorized access within one day. A walkthrough of one staged review helps evaluate design and implementation, not six months of operation. Inspecting all six dated reconciliations, source populations, approvals, and removal timestamps supports a conclusion about that period, subject to evidence quality and scope. Five completed months and one missing month do not support an unqualified 'always worked' claim. Management attesting that all six ran is a claim to assess, not a replacement for the underlying evidence.
Design and operation require different evidence; an assessment conclusion is not automatically certification.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The threat that is actually a weakness
Scenario sim+45 XP
Resolve both labels using the incident facts.
Incident brief
Alder Quay's analyst calls a missing second factor 'the threat' and the address database 'the likelihood'. A thief used a stolen password to export records. After tested safeguards, the team estimates annual exposure at 2,000 and calls this inherent risk, although its agreed baseline excludes those safeguards.
1.1What term describes the missing second factor as an exploitable weakness? (one word)
1.2What term describes the exposure remaining after the tested safeguards? (two words)
Task 2: A waiver is not a safeguard
Scenario sim+45 XP
Name the control function and the permission decision.
Incident brief
A console cannot meet the second-factor policy. A valid approval from the policy authority permits that departure for 30 days; no decision by the risk owner to retain exposure has been recorded. A technician calls the approval risk acceptance and labels an export alert preventive, even though the alert only notifies analysts after an export.
2.1What control function does the alert perform? (one word)
2.2What is the scoped permission to depart from the policy called? (two words)
Task 3: The certificate in the meeting notes
Scenario sim+45 XP
Distinguish evidence of execution from a management claim.
Incident brief
A procedure correctly covers all account types and sets a removal deadline. The assessor now checks six months of reconciliations, reviewer approvals, and removal timestamps. The manager calls that design testing. She also signs a statement claiming all reviews ran and titles it 'independent certification', though no certification body or scheme is involved.
An analyst has put confident but contradictory labels into a risk record. Build a structured replacement from the fixture; use the short canonical terms requested, not a narrative.
This checks classification and simple arithmetic, not whether an implemented safeguard actually works. The given residual assumptions are supported by testing for this exercise.
Risk record requirements
asset: address records
weakness: supplier login lacks a second factor
classify the weakness using the risk vocabulary
baseline: inherent annual probability 0.20; loss per incident 100000
post-control: residual annual probability 0.05; loss per incident 40000
calculate each expected annual loss as probability times loss per incident
alert: notifies an analyst after an export; implemented in software
permission: policy authority permits a 30-day departure from the login rule
risk owner has NOT made a decision to retain the exposure
1
2
3
4
5
6
7
8
9
10
11
12
Checks
Identify the asset and classify the weakness
Calculate inherent and residual expected annual loss
Classify the alert by function
Classify the alert by implementation
Separate a policy departure from retained-risk authorization
Review each claim independently against the baseline. Reject four misleading claims using the closest reason code; accept two claims whose stated evidence supports their limited conclusion.
For this exercise, a systemic absence of a required process is major nonconformity; an isolated lapse may be minor. An observation does not substitute for a demonstrated requirement breach. Certification requires an authorized body operating under a defined scheme.
Verdicts are accept or reject. Every rejection needs one reason code from: function-mismatch | authority-conflation | breach-downgrade | assurance-overclaim.
Six independent terminology claims
FT-1 | An export alert only reports completed exports. Its author claims it is preventive because analysts read it quickly.
FT-2 | A second-factor policy waiver was approved by the policy authority. No risk-owner decision exists, but the report claims risk acceptance is complete.
FT-3 | No service performed any required monthly access review for six months; no review process exists. The report calls this merely an observation because no compromise is known.
FT-4 | A manager signs a self-declaration and calls it independent certification, without any authorized certification body or defined scheme.
FT-5 | A complete review procedure covers employees and contractors. Six months of source populations, reconciliations, approvals, and timely removals support an operating-effectiveness conclusion for that period and scope.
FT-6 | An assessor tests a defined requirement using evidence and issues an assessment finding with criterion, gap, scope, and rationale, explicitly making no certification claim.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · GRC Fundamentals
Governance and Accountability
Translate oversight into clear decision rights, risk boundaries, independent assurance, and meaningful board reporting.
