The Claims Portal Exception Request
A regional health insurer (1,400 staff, 2.1 million member records) runs a claims portal that has been in production for nine years. Quantitative analysis puts the portal's annualized loss expectancy at $1.8M: a 30% annual likelihood of a breach with $6M impact. Remediation - re-platforming authentication, patching the underlying framework, and adding centralized logging - costs $900K in year one plus $150K per year, and modelling puts residual ALE at $200K. The board's risk appetite statement caps tolerable annualized loss at $1M per scenario and forbids accepting risk that would breach regulatory obligations. The CFO argues for acceptance, noting the company has never suffered a breach at this portal, that the year is already over budget, and that cyber insurance would cover the loss anyway.
1. Is the CFO's proposed acceptance defensible? Show the comparison you would put in front of the risk committee, including at least one consideration his framing omits.
Read the worked answer
Not defensible as stated, for three separable reasons - quantitative, governance, and regulatory.
Quantitative: compare over a multi-year horizon, not a single year.
| Option | 3-year expected cost |
|---|---|
| Accept | 3 × $1.8M = $5.4M expected loss, with a 66% chance of at least one event (1 − 0.7³) |
| Treat | $900K + (3 × $150K) + (3 × $200K residual) = $1.95M |
Treating is cheaper on expected value alone, so this is not a close call that risk appetite needs to settle.
Governance: $1.8M exceeds the $1M per-scenario appetite. The CFO cannot accept it; acceptance above appetite belongs to the board risk committee, documented and time-bound.
What his framing omits:
- 'We've never been breached' is absence of evidence, not evidence of low likelihood. A 30%/yr likelihood means a 70% chance of no event in year one - silence is exactly what the model predicts either way.
- 'Insurance covers it' is transfer, not elimination: retention/deductible, coverage limits, sublimits for regulatory defence, and no coverage for penalties or reputational loss.
- Regulatory overlay: if the framework gap is a required safeguard under the applicable security rule, 'accept' is not a business option available at any level - the appetite statement already says so.
2. Leadership still insists on deferring remediation for 12 months. What must exist for that deferral to be a managed decision rather than an undocumented gamble?
Read the worked answer
Convert it into a time-bound, owned, monitored risk exception:
- Named acceptor at the right level - board risk committee (above appetite), with the CFO and CISO as concurring, not deciding, parties. Signature and date.
- Quantified exposure and rationale - restate ALE, the 66% three-year event probability, and the specific business constraint (budget cycle), so the record shows what was known.
- Compensating controls that reduce likelihood now, funded from operating budget if capital is unavailable: network restriction of the portal to expected geographies, WAF rules, anomaly alerting on the portal's account, shortened session tokens, enhanced monitoring with an explicit detection SLA.
- Interim milestones - e.g., authentication re-platforming (the cheapest third of the project) delivered in 90 days, with the exception voided if milestones slip.
- Expiry and triggers - hard review at 12 months, plus automatic revocation on: any near-miss, a new exploit published for the framework version, an audit finding, or a change in the regulatory position.
- Reporting - the exception appears on the monthly risk dashboard until closed; exceptions that quietly persist are how risk acceptance becomes risk neglect.
The distinction the exam tests: acceptance is legitimate risk management, but only when it is informed, authorized at the correct level, bounded in time, and monitored.