Three words practitioners use interchangeably and shouldn't. Learn to separate the threat, the safeguard, and the obligation.
30 min 170 XPSkills: Risk fundamentals, Control design
Brief
Risk, control and compliance are used interchangeably in most organisations, and that imprecision is the reason so many programs cannot be automated. A machine cannot enforce a word that means three different things depending on who is speaking.
This room fixes the vocabulary. By the end you should be able to look at any statement in a compliance program and say which of the three it is, and therefore what kind of engineering it needs.
A risk is what could go wrong. A control is what you do about it. Compliance is who is asking.
Risk: likelihood times impact
A risk is a possible future event with a negative outcome. It has two measurable dimensions: likelihood (how probable) and impact (how bad). Multiply them and you get an inherent risk rating: the exposure before anybody does anything about it.
Risk statements should name the asset, the threat and the consequence: 'an attacker obtains production database credentials from a public repository, exposing customer records'. If your risk register is full of one-word entries like 'access', it is not a risk register.
Inherent risk is a coordinate, not an adjective: plot likelihood against impact.
Control: the deliberate response
A control is a deliberate mechanism that reduces likelihood or impact. Controls are classified by timing, preventive (stop it before it happens), detective (notice it after it happens), corrective (fix it once noticed), and by nature: manual, automated, or hybrid.
GRC engineering is mostly the work of pushing controls left along both axes: from detective toward preventive, and from manual toward automated. A preventive automated control is the cheapest control you will ever own, because it produces no tickets and no screenshots.
What remains after controls are applied is residual risk. Management accepts residual risk up to a documented threshold: the risk appetite. Everything above appetite needs another control or a formal acceptance with an owner and a date.
Every compliance claim traces back through evidence and a control to a real risk.
Compliance: someone else's checklist
Compliance is the obligation to demonstrate to an external party, a regulator, an auditor, a customer, that required controls exist and operate. It is a reporting relationship, not a security outcome. You can be fully compliant and badly exposed, and you can be secure and non-compliant.
This is why mature programs model controls once and map them to many frameworks, rather than running a separate program per certification. One control, many obligations.
Risk treatment: four choices
Every assessed risk ends in one of four treatments. Mitigate: add or strengthen controls to reduce likelihood or impact. Transfer: move the financial consequence to someone else, usually through insurance or contract. Accept: a named owner signs that the residual risk is within appetite, with a review date. Avoid: stop the activity that creates the risk.
The treatments are not interchangeable. Transfer moves money, not exposure: the breach still happens, the customers are still harmed and the regulator still calls you. Recording an insurance policy as a mitigation hides the real residual risk from the people who must accept it.
Insurance pays for the damage. It does not prevent it.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The register that isn't
Answer challenge+30 XP
Three concepts, one of them only pretending to be there.
Incident brief
Row 41 of the corporate risk register reads, in full: "Access: High: Owner: IT: Status: Mitigated (SOC 2 CC6.1 passing)".
The risk lead defends it in the committee: "It is a risk, it is rated, it is owned, and the control behind it passed the last audit. That is a complete row."
There is no threat, no asset and no consequence anywhere in the row. There is, however, a passing framework control and an external report that says so.
Term bank, not all of these are right
riskcontrolcompliancethreatimpactappetite
1.1Of risk, control and compliance, which one is genuinely absent from row 41? (one word)
1.2"SOC 2 CC6.1 passing" evidences which of the three instead? (one word)
Task 2: Preventive in name only
Answer challenge+40 XP
Classify by what the mechanism does, not by what the owner calls it.
Incident brief
A storage bucket is created with public read access at 09:14. At 09:16 an alert fires, a ticket opens, and at 09:41 an on-call engineer flips the bucket private. The resource was reachable from the internet for twenty-seven minutes.
The control owner records it in the catalog as: "CTRL-88, Preventive, Automated: blocks public buckets." Nothing was blocked; the bucket was created exactly as requested and later changed.
The committee asks whether the alert makes the leak less likely to happen again next sprint.
2.1Ignore the catalog label. By timing, what type of control is CTRL-88 actually? (one word)
2.2Which of the two risk dimensions does CTRL-88 reduce: the one the committee asked about, or the other one? (one word)
Task 3: Accepted, or just ignored?
Answer challenge+50 XP
Name the exposure, then name the threshold it broke.
Incident brief
Legacy VPN concentrators cannot support MFA. Compensating controls bring the exposure down from Critical to High. The board's documented tolerance statement caps unmitigated access exposure at Medium.
In a Slack thread the CISO writes: "Acknowledged, we'll live with it for now." No owner is recorded, no review date is set, and the item is closed in the register as "Accepted".
The internal audit lead flags it, and is told: "Acceptance is a management decision, and management accepted it."
Term bank, not all of these are right
inherent riskresidual riskrisk appetiterisk acceptancetolerancecompensating control
3.1The High exposure remaining after the compensating controls is called what? (two words)
3.2The board's documented Medium cap that this breached is called what? (two words)
Task 4: The insurance that mitigated nothing
Answer challenge+50 XP
Name the treatment by what it actually changes.
Incident brief
Risk R-17, ransomware on the file servers, was rated High. Last quarter the company bought a cyber insurance policy with a large ransomware cover.
The register now says: "R-17 | Treatment: Mitigated (insurance) | Residual: Low." No backup, patching or endpoint change was made.
The CFO argues the rating is right: "If it happens, we are paid. That is the risk gone."
Term bank, not all of these are right
mitigateacceptavoidtransferlikelihoodimpact
4.1Which of the four treatments did the company actually apply? (one word)
4.2Which risk dimension does the policy reduce, and only partly? (one word)
Labs
75 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
A risk register arrives with the row: risk = "we are not SOC 2 compliant", control = "train staff on security", rating = "high because the auditor said so".
None of those three fields contains what its column is for. Rewrite the row so the risk is an event with a consequence, the control is the enforcement that already exists, and the compliance reference points at a requirement rather than a framework name.
What the team actually told you
Concern raised: contractors sometimes reach the production console
with a password alone; one did so last quarter from an unmanaged laptop.
Mitigation already live: the SSO tier refuses any console login that
has not completed an MFA challenge. It blocks the attempt itself.
Rating scale in use: low | medium | high | critical
Framework identifiers seen in this programme: CC6.6, A.5.17, IA-2
Control types: preventive | detective | corrective
The risk register goes to the committee tomorrow with 40 rows. You may flag only the rows where the register misrepresents the organisation's actual exposure.
Raise those rows worst first. Leave the ones that are simply uncomfortable reading.
List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.
Risk register extract
R-1 R-03 rated low residual because "a policy exists"; no control is linked and no test has ever run.
R-2 R-07 inherent and residual scores identical; the linked control was retired last year and never unlinked.
R-3 R-11 accepted by the CTO, who is not the risk owner and has no acceptance authority under the framework.
R-4 R-14 description is three sentences long and poorly written.
R-5 R-18 review date passed six weeks ago; owner is on parental leave.
R-6 R-22 uses "medium" where the taxonomy says "moderate".
R-7 R-25 residual rating lowered from high to low with no change in control coverage and no rationale recorded.
R-8 R-30 sorted below R-31 despite a higher score, because the sheet is sorted by id.
1
2
3
4
5
6
7
8
9
10
11
12
Checks
The right findings are raised
Benign lines are left out
Severity matches the actual exposure
Ranked worst first
Next on your path · GRC Fundamentals
Frameworks Tour: SOC 2, ISO 27001, NIST
Map the same underlying safeguard across SOC 2 Trust Services Criteria, ISO 27001 Annex A, NIST CSF and 800-53.
