Risk Register Disagreement Before Board Approval
Calder Retail Bank is renewing a contract with Vantix, which hosts its card authorization switch. The bank processes 12,000 transactions per minute at peak and the SLA is 99.99% monthly availability. The internal risk team scored the vendor as low on a 5x5 heat map (likelihood 2, impact 3) because controls are mature. A second team using FAIR estimated a mean annualized loss of $2.4M, with a 95th-percentile loss of $9.1M, driven by a 12% annualized chance of a four-hour outage and a 3% chance of a card-data breach. The vendor's SOC 2 Type II report has an exception: 14 of 40 sampled changes lacked approval. Cyber insurance covers $1M per incident with a $250,000 deductible. The risk appetite statement says annual loss exceedance at the 95th percentile must stay below $1.5M for any single third party. Termination requires 90 days' notice, but migrating the switch would take nine months. The board asks for a recommendation.
1. Reconcile the qualitative heat map and the FAIR analysis. Which should the board rely on, and what should be checked?
Read the worked answer
The two assessments are not measuring the same thing, and the heat map is not calibrated to the appetite statement.
The 5x5 matrix is ordinal. Likelihood 2 and impact 3 are labels, not measurements; the mapping from a cell to a dollar range is undefined, and different assessors anchor the scale differently. A score of 6 can mean medium in one workshop and low in another. The matrix also compresses the tail: a 3% chance of a very large breach and a 30% chance of a small outage can land in similar cells.
The FAIR analysis decomposes frequency and magnitude and produces a distribution: mean annual loss $2.4M and 95th-percentile $9.1M. That is directly comparable to the appetite statement, which is written at the 95th percentile. The heat map cannot be compared to a $1.5M threshold at all, so it should not be used to approve the vendor.
Check the FAIR inputs before relying on them. If the 3% breach scenario assumes an $80M loss, is that supported by card-data breach costs, scheme fines, and customer remediation? If the four-hour outage cost is $500k, the outage contribution is only $60k. The result is sensitive to the breach magnitude; run a sensitivity analysis. The SOC 2 change-management exception should raise the frequency of both outage and breach, not be averaged away.
2. Is the residual risk within appetite after insurance and contractual mitigations? Show the reasoning.
Read the worked answer
No, it is not within appetite.
The appetite is explicit: annual loss exceedance at the 95th percentile must stay below $1.5M for any single third party. The assessed 95th percentile is $9.1M, six times the limit. That breaches appetite even before insurance.
Insurance transfers financial impact, not likelihood, and it is capped. A $1M per-incident limit with a $250k deductible means maximum recovery on a single event is $1M, less the deductible and any exclusions. At the 95th percentile the retained loss is still roughly $8.1M or more, and if the tail event involves multiple incidents, contractual penalties, or an exclusion such as regulatory fines, recovery may be lower. The expected recovery is small: a 3% annual breach probability times $1M is about $30k, so the mean residual remains around $2.4M.
The 90-day termination clause is not an effective mitigant when migration takes nine months. During that period the bank is operationally locked in, so the realistic options are reduce, transfer more, or accept with board approval. The concentration risk - one vendor hosting the authorization switch with no alternate - is part of the same risk, not a separate line item.
Conclusion: approve only with conditions that bring the 95th percentile inside appetite, or with an explicit, time-bound board risk acceptance after an appetite exception.
3. Recommend a treatment plan and the monitoring that should accompany board approval.
Read the worked answer
Treat with conditions, not an unconditional renewal.
Reduce (primary):
- Require the vendor to remediate the change-management exception within 90 days: 100% approval for sampled changes, automated evidence, and a bridge letter covering the gap period.
- Contract for continuous control monitoring and SIEM integration, with 24x7 notification of incidents within a defined window (for example 1 hour for suspected breach, 4 hours for material outage).
- Require a tested failover or standby authorization path and a recovery time objective consistent with the 99.99% SLA. Test it in a joint exercise before renewal.
- Minimize card data at the vendor; confirm tokenisation scope covers the switch and that the bank retains no unnecessary PAN.
- Add a right to audit, a right to terminate for failed remediation, and SLA credits meaningful relative to the loss.
Transfer: increase cyber insurance toward the tail (for example $10M) if the market will write it, and confirm the policy covers vendor-caused outages and regulatory defense. Do not treat insurance as the control that closes the appetite gap.
Avoid/exit: start the nine-month migration assessment now and require an exit plan with data return, escrow of configuration, and knowledge transfer. Set a decision gate at six months.
Governance: because the residual 95th percentile remains above $1.5M, the board must either approve a time-bound exception with a remediation plan or direct an exit. Monitor change-approval rate, availability against SLA, mean time to detect, open critical findings, incident notification times, and insurance adequacy. Re-score quarterly; the exception should expire automatically if conditions are not met.