Agency with 27 critical vulnerabilities and a self-assessed 98% compliance dashboard
The National Transport Services Agency employs 4,000 staff and operates licensing, enforcement and payment systems. Its assurance map has three layers: the IT security operations team implements controls and produces a monthly '98% compliant' dashboard; the enterprise risk team aggregates the dashboard into the corporate risk register; and an outsourced internal audit provider delivers a financial controls audit each year with no IT specialist. The audit committee, which oversees IT risk on the board's behalf, receives the dashboard and a one-page management assurance statement. A recent external penetration test found 27 critical vulnerabilities, nine on internet-facing systems; the average remediation age is 120 days. The CIO wants to brief the board that the control environment is 'substantially sound'. The board chair asks whether the assurance is independent enough to rely on.
1. Assess the assurance arrangement against the three lines model and ISO/IEC 38500 Monitor.
Read the worked answer
The arrangement does not provide independent assurance. The IT security operations team is line one: it owns controls and reports on them. The enterprise risk team is aggregating line-one data, not challenging it, so it behaves as an extension of line one rather than a separate line two. Internal audit is line three, but an outsourced financial-controls audit with no IT specialist cannot give the audit committee assurance over 27 critical vulnerabilities. The '98% compliant' dashboard is a self-assessment, and the one-page management statement is not evidence. ISO/IEC 38500 Monitor requires the board to monitor performance and conformance through adequate assurance, not to accept management's self-report. The board can rely on management for delivery, but it cannot rely on the same management team as its only source of assurance. The penetration test is the first independent signal, and it contradicts the dashboard.
2. What should the board require before accepting the 'substantially sound' statement?
Read the worked answer
Before accepting 'substantially sound', the board should require four things. First, an independent review of the nine internet-facing critical vulnerabilities, with evidence of remediation or a formally accepted risk owned by a named accountable executive. Second, a remediation plan with dates, owners and verification, not just a count. Third, a root-cause analysis of why the dashboard reported 98% while external testing found 27 critical issues; that gap is itself a governance finding. Fourth, an internal audit capability review, with IT audit co-sourced or contracted for the next cycle. The board should also ask whether the CIO's statement is a reasonable conclusion on the evidence. On the facts given, it is not. The board can accept that remediation is underway without accepting that the control environment is sound. That distinction protects the board from false comfort and protects management from an unfair standard.
3. Recommend role and reporting changes, being explicit about accountability.
Read the worked answer
Accountability should remain with the board and be delegated clearly. The CIO should be accountable for remediation and for the control environment, with a dated plan and regular reporting. The security operations team should continue to operate controls but should not produce the board's only assurance. A separate security assurance or risk function should challenge control effectiveness, and internal audit should have an IT audit plan approved by the audit committee, with a direct reporting line to the committee chair. If the agency is too small to separate every role, it should buy independent assurance rather than combine line one and line three. The audit committee should receive a dashboard that distinguishes management self-assessment from independent testing, and it should see critical vulnerabilities, remediation age and risk acceptances. The test is not org-chart purity; it is whether a challenged, independent view reaches the board.