Security, Risk, and Compliance
Risk language is precise
Learn these distinctions, because questions are built on them:
- Hazard/uncertainty versus risk (risk is the effect of uncertainty on objectives, expressed as likelihood and impact).
- Inherent risk (before controls) versus residual risk (after controls). Improvement cases are judged on residual risk against risk appetite and risk tolerance.
- Risk owner (accountable for the exposure, usually a manager) versus action owner (delivers a mitigation). These are routinely swapped in distractors.
- Mitigation options: avoid, reduce, transfer, accept. Acceptance must be explicit, recorded and within delegated authority.
Security and compliance concepts
Confidentiality, integrity and availability frame information security. Controls are administrative, technical or physical. Segregation of duties prevents one person from initiating, approving and recording a transaction. Least privilege and audit trails support both security and evidential compliance. Know that personal data handling rests on lawful basis, minimisation, retention limits and subject rights; supplier and third-party risk extends your exposure boundary. Compliance is not security - a compliant process can still be exploited.
Traps
Assuming a control eliminates risk (it reduces it to residual); treating the risk register as a static document; and approving a change that improves efficiency while silently weakening a control.
Worked example
A team removes a manual approval step to cut cycle time by 40%. The correct test is not "is it faster?" but "what is the residual risk now, who owns it, and is it within appetite?" If the step was the only segregation-of-duties control, the change moves risk above tolerance and must be redesigned, not approved.