The control that is there because a list said so

A thirty-person company has two risks written down and four controls in place. Here they are, in full.

The risks, both written as sentences with a victim in them, which is the only form that is any use:

1. An invoice is paid into an attacker's account, because a supplier's bank details get changed on the strength of an email and approval happens in a chat message.
2. A former contractor keeps working access to the customer database for months, because contractors arrive through a different process from employees and nobody owns closing it.

The controls, all four marked in place, all four with artefacts attached:

1. An annual awareness course, 94 of 97 people completed, platform report available.
2. Storage encryption on the production database, enabled at the platform layer, settings export available.
3. An asset inventory spreadsheet, generated from the device management tool, refreshed last month.
4. A supplier questionnaire file with eleven completed returns in it.

Nothing on that list is fake. Nothing was done lazily. The company could produce every artefact within the hour.

Predict

Draw the lines. How many of the four controls address either of the two risks?

Choose one answer

Two — awareness covers the invoice risk and the inventory covers the contractorOne — awareness, partially, for the invoice riskNone of themAll four, indirectly — security controls reinforce each other

Lock in answer

Where the four came from

Each of those controls has a plausible origin, and none of the origins is a risk assessment.

The awareness course came with the human resources platform. The storage encryption was a checkbox during setup and is genuinely worth having. The inventory exists because a questionnaire asked whether the company maintained one. The supplier file exists because somebody read a list of controls and started at the top.

That is the mechanism, and it is not negligence. A list is handed over, the list is worked through, and the working-through produces artefacts that look exactly like the artefacts a risk-driven programme produces. The difference is not visible in the folder. It is visible only in the lines, and the lines are the thing a list does not come with.

What would you do

You have the four controls above, the two risks above, and roughly twelve person-days of control effort available in the quarter. The finance lead has three hours a week of patience for process, total. One engineer can be asked to build something small.

A buyer's questionnaire arrives in six weeks and asks, among two hundred other things, whether you maintain an asset inventory and run annual awareness training. You do both.

Optimising for

By the end of the next quarter, both risks in the register have a control pointed at them that somebody would notice failing — without adding hours the company has not got.

You cannot know

• Whether either risk has already happened and nobody noticed
• How many contractors currently hold database access, which nobody has counted
• Whether the buyer reads the answers or only checks that they are present
• What a supplier's finance team would do if you rang to verify a bank change

Choose an option

Keep all four, and add two controls aimed at the two named risks.Add a verification step in the payment path and a contractor leaver trigger; keep the encryption and the inventory; stop maintaining the supplier questionnaire file and move awareness to a shorter, role-targeted thing.Write the risks that the four existing controls address, so every control has a line.Spend the quarter on the invoice risk only, and leave the contractor risk explicitly accepted with a name against it.

The detector, in one question

For each control you have in place: which risk in your own register does this address? Not which risk it could be argued to help with. Which one, by number.

Where the answer takes more than a few seconds, you have found one. Where the answer is a risk you had to invent while answering, you have found one with a decision attached: either write the risk properly, or stop paying for the control, and both are legitimate.

The condition under which this whole exercise misleads you is a control named explicitly in a customer contract. Those do not need a risk in your register to justify them — the obligation is the justification — and a coverage check will flag them forever. The fix is a reason recorded against the control, not a risk reverse-engineered to cover it.

Check

Why is a control that no risk names more informative than a risk that no control covers?

Choose one answer

Because it is the only finding in this subject whose remedy might be to do lessBecause an uncovered risk is less serious than a pointless controlBecause unlinked controls are usually not operating anywayBecause it means the risk assessment was done badly

Check answer

Worth remembering

• Compliance theatre is not a folder of fake artefacts; it is a folder of real artefacts with no line to anything the organisation decided it was worried about.
• Two gaps fall out of comparing the two lists, and the control that no risk names is the one nobody looks for.
• An unlinked control is the only finding in this subject whose remedy might be to do less.
• Deriving risks from the controls you already run makes the register consistent and removes its ability to be wrong.
• Indirect coverage is unfalsifiable: once any control can be said to help with any risk, the register can no longer say where to spend the quarter.
• A control named in a customer contract needs a recorded reason rather than a reverse-engineered risk, and a coverage check will keep flagging it either way.