The CRM That Arrived Without a Decision
Northwind Health's sales team signed an 18-month contract for a cloud CRM and migrated 1,400 patient-referral records before IT learned of it from an expense report. The CRM vendor stores data in a region not approved for patient data, and the contract lacks a breach-notification clause. Sales credits the tool with a 12% lift in referral conversions and refuses to migrate before renewal. The CISO wants an immediate shutdown; the CIO says IT has no authority over line-of-business spending. The risk committee meets in three weeks, and the annual audit begins in five.
1. Identify the primary governance failure this situation reveals, and state the first action the risk practitioner should take before the risk committee meets.
Read the worked answer
The failure is governance, not technology: there is no enforced decision-rights or risk-acceptance gate for third-party engagements, so a business unit could commit data and contract terms with nobody accountable for the resulting risk. Shutting the system down first would trade a manageable risk for a certain business loss and would not close the gap.
First action: contain and quantify. Restrict access to the minimum necessary, confirm exactly what data resides in the tool and in which region, and get a breach-notification addendum signed. Document exposure in risk terms - record count, regulatory notification cost, contractual exposure - so the committee decides on facts rather than on the CISO's and the sales director's competing assertions. Escalation without a quantified statement invites a political outcome. Because audit fieldwork begins in five weeks, any exception must also be documented and time-bound before then.
2. Draft the decision-rights structure the risk committee should approve: who may accept this residual risk, what conditions apply, and how exceptions end.
Read the worked answer
Tier the authority by residual risk, not by budget:
- Low residual (no sensitive data, standard clauses): business owner accepts, logged in the register, security review within 30 days.
- Moderate (sensitive data, compensating controls required): business owner accountable but the CISO must concur; acceptance capped at 90 days with remediation milestones.
- High (regulated data, no contractual protections): risk committee or board accepts. No business owner may self-approve.
Conditions for this CRM: a data-residency remediation plan with a dated commitment, the breach-notification addendum, DLP coverage and quarterly access review, and an explicit migration decision at renewal rather than automatic rollover. Every acceptance must carry an expiry date - an exception without one becomes the permanent control environment.
Close the loop with a procurement gate: no contract signature without a completed risk assessment, enforced in the buying system rather than stated in policy.
3. What single metric best evidences the fix at the next audit, and why is 'number of policy violations' the wrong choice?
Read the worked answer
The strongest evidence is the proportion of third-party engagements that passed a risk assessment before contract signature - a preventive, population-based measure drawn from procurement records that shows the gate is operating on everything, not just on what someone happened to notice.
A count of policy violations is a lagging indicator. It only counts what was detected, reveals nothing about undetected cases, and can be reduced simply by detecting less - which makes it a metric that rewards the wrong behaviour. Pair the gate-coverage figure with the percentage of accepted exceptions closed on schedule, which shows acceptances are not silently accumulating. Both are auditable from system records rather than self-report.