The critical rating the CRO wants downgraded

Two requests, handled separately.

The rating. The rating is derived from the rating methodology agreed at planning, applied to the facts: no alternate site, 12% manual capacity, 18-month exposure, highest-volume Tier 1 process. I will happily re-derive it in front of her, show the scoring line by line, and change it if I have misapplied the methodology or the facts are wrong. What I will not do is work backwards from a desired reporting outcome - that inverts the logic, because then the distribution of ratings controls the assessment instead of the assessment producing the distribution.

'Already on the risk register at high' is not a mitigating factor. It may show the risk is known, which is better than unknown, but it does not reduce impact or likelihood, and it certainly does not justify a lower audit rating. The register and the audit use different lenses (enterprise, annual horizon, aggregated) so a reconciliation is a fair challenge; a downgrade is not an automatic consequence.

The sentence. It is a factual observation tested against the risk-escalation threshold in the risk policy. If the fact is right, it stays. If she has evidence it is wrong - a paper that did go to the board risk committee - I correct it immediately and note the correction. Disagreement with a fact is resolved by evidence, not by deletion.

Who decides. The CAE owns report content and ratings; the audit committee receives critical findings under the charter. The CRO's proper route is a management response published alongside the finding, and escalation to the CAE. I document the conversation and its rationale - a request to suppress a reportable matter is itself worth telling the CAE about.

The auditor does not accept risk; management does, at the delegated authority level, with visibility to the audit committee. My job is to make the residual position visible and test whether the acceptance is authorised.

Is 18 months acceptable? For a Tier 1 platform operating on 12% manual capacity, 18 months of that exposure likely exceeds tolerance. The question is not the end date but the interim: if management will not fund temporary mitigation, the acceptance must be at board level, recorded in the register, with a named owner and the acceptance itself documented.

Finding structure:

• Criteria - policy requires Tier 1 recovery within the stated RTO via an alternate site; contract commitments to customers.
• Condition - no alternate site since the contract lapsed seven months ago; manual workaround covers 12% of volume.
• Cause - vendor contract renewals are not linked to the BCM calendar; no oversight of continuity-critical contracts.
• Effect - quantified: duration of exposure, volume that cannot be processed, customer and regulatory notification obligations triggered by a prolonged outage.
• Recommendation - restore contracted alternate capacity within 90 days; raise interim manual capacity to an agreed percentage; add continuity-critical contract renewals to a monitored register with monthly reporting to the audit committee.

Rating: rate on residual risk including whatever interim controls management actually commits to and can evidence. If interim measures are credible, residual risk may fall - but only against evidence, not against a promise. A rating that reflects only the 18-month end state flatters the position the organisation is actually in today.

A repeat finding is not just the same deficiency twice. It is evidence that the corrective action process, or the prior follow-up, did not work - which is an audit-process issue I have to own part of.

Actions:

1. Re-examine the prior closure. Did the previous follow-up test closure, or accept a management assertion? If we accepted an assertion, that is a root cause of the repeat and should be reflected in how we design follow-up now.
2. Report it as a repeat explicitly - original finding reference, original commitment date, current status, and the gap between them. The committee needs to see the pattern, not just the deficiency. Three findings repeating is a governance story; three findings presented fresh is not.
3. Raise a separate observation on the corrective action process - no defined verification standard, no accountability for committed dates, no ageing report to the audit committee.
4. Set the follow-up interval by risk, not by calendar. Untested backups on a Tier 1 platform warrants re-test at 90 days. Define closure criteria in advance and in evidence terms: a successful restore test of a defined sample, with results reviewed - not 'policy updated' or 'backup tool procured'.
5. Escalate with a request, not a complaint: a named accountable executive and a committed date, with the committee informed if neither is provided.

Follow-up is where most audit value is won or lost. A finding that is reported twice and closed on an assertion the second time damages credibility more than the original deficiency.