Risk Acceptance on a Core Banking SaaS Migration
You are CISO of a $3.2B asset regional credit union with 1,200 employees and 38 branches. The business wants to migrate the core banking platform to a SaaS provider in 90 days to cut $2.1M in annual run cost. The vendor's SOC 2 Type II report shows three exceptions: change tickets lacking independent approval in 12 of 60 sampled changes, one privileged access review not performed for 45 days, and two onboarding background checks missing. The contract includes a right-to-audit clause and a 99.9% SLA. Your risk register rates the initiative inherent risk 16 (high) and proposed residual risk 9 (medium) after controls. The board risk appetite statement says no high residual risk for Tier 1 systems. A regulatory examination begins in six months. The business sponsor argues that delaying the migration forfeits the $2.1M savings and that the exceptions are administrative. The board risk committee meets in 10 days.
1. What decision should you recommend to the board risk committee, and how should you frame the residual risk and risk acceptance authority?
Read the worked answer
Recommend conditional approval with a time-bound risk acceptance, not a simple yes. Reasoning: the residual score of 9 depends on controls that the SOC 2 exceptions show may not be operating effectively. A medium residual score is credible only if change approval, privileged access review, and background checks are validated. Because the system is Tier 1 and a regulatory examination is six months away, the board risk committee, not the CISO alone, should own acceptance.
Frame the decision in three parts. First, state inherent risk 16 and explain that current residual risk is likely higher than 9 until conditions are met. Second, define the acceptance gate: if conditions reduce residual risk to 6 or below and operate for 90 days, approve with monitoring; if not, defer go-live. Third, assign the business sponsor as risk owner and record acceptance in board minutes.
The $2.1M savings is relevant but not decisive. The decision must map to the risk appetite statement. Do not let the CISO sign acceptance for a business-owned Tier 1 risk; that would weaken governance and confuse accountability during the regulatory examination.
2. Identify the conditions and compensating controls you would require before go-live, and explain how each changes the risk estimate.
Read the worked answer
Conditions before go-live:
- Independent change approval workflow with retained evidence for all production changes. This reduces the likelihood of unauthorized or untested change.
- Monthly privileged access review with a named approver and evidence retention. This reduces privilege misuse and insider risk.
- Background checks completed before production access, with a documented exception process. This reduces insider risk at onboarding.
- Contractual right-to-audit, security addendum, and a SOC 2 bridge letter at go-live and quarterly. These improve detection and accountability.
- Continuous control monitoring for the three exception areas, with monthly reporting to the risk committee.
Compensating controls: customer-managed encryption keys, network segmentation between the credit union and the SaaS environment, just-in-time privileged access, and enhanced logging to the SIEM.
Recalculate residual risk explicitly. If all conditions operate for 90 days and are independently validated, residual risk may fall from 9 to 6. If only contractual controls exist, residual remains 9 to 10 because the same failure modes persist. Require evidence, not promises, before the board relies on a lower score.
3. How should you prepare for the regulatory examination and communicate the board decision?
Read the worked answer
Prepare an examination package containing the board minutes, the risk assessment, the conditions, the remediation plan, and evidence of oversight. Do not describe the exceptions as administrative; regulators often view that as minimizing. Explain that the board accepted risk conditionally and set a 90-day remediation gate.
Provide the vendor's SOC 2 report and bridge letter, and show that the CISO independently escalated the issue. If the regulator asks about third-party risk, demonstrate contract clauses, monitoring, and reporting to the board. Coordinate with legal and compliance before responding.
The communication should show governance, not perfection. Avoid claiming the vendor is fully compliant. If the examination begins before remediation is complete, disclose the open items and the timeline. The goal is to demonstrate that risk was identified, owned, and monitored, and that the board exercised its authority rather than deferring to the vendor or the business sponsor.