Larkspur Analytics: Data, Risk and Governance
Larkspur Analytics is a 200-person UK data business serving financial-services clients. It holds personal data on 1.2 million consumers and runs its core platform on a single cloud region with no tested failover. Last quarter it suffered two outages totalling 14 hours and a phishing incident in which an employee credential was compromised; no data was confirmed exfiltrated. The board is considering a £2.5m investment in multi-region resilience and a £600,000 security programme. Revenue is £30m, EBITDA £4m, and a major client contract worth £6m a year is up for renewal in six months; the client's due-diligence questionnaire asks for evidence of ISO 27001 certification, tested disaster recovery, and breach-notification procedures. The CEO argues the spend is unnecessary because no breach has occurred.
1. Assess Larkspur's risk exposure and advise whether the investment is justified.
Read the worked answer
Risk identification.
- Availability risk. Single-region, untested failover produced 14 hours of outage in one quarter. At £30m revenue, an hour of downtime costs roughly £3,400 in lost revenue plus SLA credits and reputational damage. Two more such quarters could cost several hundred thousand pounds directly.
- Cyber risk. A compromised credential is a leading indicator of a control weakness (MFA, access management, monitoring). The absence of confirmed exfiltration is luck, not assurance.
- Regulatory risk. Under UK GDPR, a personal data breach must be notified to the ICO within 72 hours where it poses a risk to individuals. Processing 1.2 million records without tested breach procedures creates exposure to fines of up to £17.5m or 4% of global turnover, plus individual claims.
- Commercial risk. The £6m renewal (20% of revenue) depends on ISO 27001, tested DR and notification procedures. Losing it would cut EBITDA materially.
Quantification. The £3.1m programme is about 10% of revenue and 77% of EBITDA - large, but the downside is larger: a £6m contract loss, potential fines, and remediation costs. Expected loss from a serious incident plausibly exceeds the spend.
Advice. The investment is justified, but should be phased: security controls and breach procedures first (they are prerequisites for the renewal), then multi-region resilience. The CEO's "no breach yet" argument confuses absence of evidence with evidence of absence.
2. Recommend a governance and reporting structure to manage these risks on an ongoing basis.
Read the worked answer
Governance structure.
- Board risk committee. A dedicated committee (or audit committee remit) with a named risk owner, meeting quarterly, receiving a risk register scored on likelihood and impact. The CEO should not be the sole arbiter of risk appetite.
- Chief Information Security Officer (CISO). Accountable for controls, with a direct reporting line to the board committee so security is not buried under IT operations.
- Three lines of defence. Operations own controls; a risk/compliance function monitors them; internal audit provides independent assurance. External ISO 27001 certification gives the client the evidence it requires.
- Key risk indicators. Track outage hours, mean time to recover, phishing click rates, patch latency, privileged-access reviews and incident close-out times, reported monthly with thresholds and escalation triggers.
- Disaster recovery testing. At least annual full failover tests with documented results, plus tabletop breach exercises covering the 72-hour ICO notification and client communication.
- Third-party and contract risk. Embed security requirements in client contracts and supplier agreements; maintain a breach-notification playbook with named contacts and legal review.
- Risk appetite statement. The board should formally state tolerance (e.g. maximum four hours' unplanned downtime a year) so management decisions are anchored.
Reporting. A one-page risk dashboard to the board monthly, a full review quarterly, and immediate escalation for material incidents. This converts the current reactive posture into a documented, auditable system that also satisfies client due diligence.