Part IV · Chapter 8 · The Second Year · lesson 8
Defend a risk whose world moved
15 min
Builds on Write down what your middle band actually means
Part IV · Chapter 8 · The Second Year · lesson 8
15 min
Builds on Write down what your middle band actually means
Here is a row from a register, written in January and never touched since.
An invoice is paid to an attacker because payment approval happens in a chat message. Likelihood: would surprise me. Impact: a bad week.
In January that was defensible. Finance was two people who sat next to each other, and the chat message was a formality on top of a conversation they had already had out loud.
By September finance is five people across two time zones, approvals arrive in a shared inbox, and two of the five have never met the person whose messages they are approving. The sentence in the register is word for word correct. The band beside it is describing a company that no longer exists.
Predict
Every band in a register is a claim about a world, made on a date, and the date is not written down anywhere.
That is the whole problem. The sentence describing the risk is durable — a well-written risk is still accurate years later, because it names a mechanism. The band is perishable, because it describes the organisation around the mechanism, and the organisation changes every quarter.
So a register that has not been re-scored is not neutral or out of date in a harmless way. It is actively asserting last year's company. And because the sentences are all still correct, it reads as current.
Re-scoring is therefore not tidying. It is the only moment in the year when somebody says out loud what changed about the company, in a document where that statement has consequences.
The first is the new band, with the reason attached. Likelihood moved from would-surprise-me to happens-occasionally because approval moved from a room to a shared inbox in March. One sentence, one date, one cause.
The second is harder and gets skipped: why nobody noticed for seven months.
That one feels like a confession and it is not. It is a statement about your own detection, and it has a factual answer. Nothing was watching, because nothing in the register points at the thing that moved — the register knows about payment approval and knows nothing about the shape of the finance team. The honest version names what would have told you: a re-score triggered by the org change, a quarterly read-through, or an owner who sits close enough to the work to feel the difference.
A register that gets re-scored once a year, in the month before fieldwork, is a register where every band is up to eleven months stale by design. That is a choice, and it is defensible, and it should be written down as a choice rather than discovered as a surprise.
Re-score one of yours now. There are two places a band can move and they are not the same exercise.
The inherent position — how often and how bad before anything is done about it — changes by removing the row and putting it back. Retyping the sentence is part of the point: you are restating it as something true about the company today rather than editing a field.
The residual position — where it has got to now that something is addressing it — appears on the saved row, once you have ticked a control against it. That one is the second-year question.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
What could go wrong
A sentence with a victim in it, not a category. There is no score field here and there is nowhere to put one: the two bands are never multiplied.
Once a year or so
A customer notices
What will you do about it?
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
If the treatment you picked was to reduce it, the question coming back is what is doing the reducing — and the saved row carries a button for every control you have decided on, so the answer is a tick rather than an essay. Tick the one that does the work.
If nothing in your own register fits, that is not a gap in the form. It is the finding. A risk you cannot attach a control to in one breath — a thing that happens, on a cadence, with an owner — has a treatment that is an intention, and reduce it with nothing named is the most common row in the registers people bring to a first audit.
Tick a control and a second pair of bands appears: where the risk has got to now that something is addressing it. Leave those where they started and the engine will say so, and the question it asks has exactly two answers — either the control does not address this risk, or nobody re-scored it. In a second year the second answer is nearly always the true one, which is why this lesson exists at all.
If you marked it accepted, you were made to name somebody before the row would save. That is deliberate, and it is the second most common real finding in this field. The useful exercise is not entering the name; it is imagining showing that person the row.
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
Here is the part that surprises people. Re-scoring one risk made the engine notice your controls, because a register with risks in it can finally be asked whether anything in it names them.
Every control you have marked as in place that no risk of yours names is now listed. That is not an accusation of waste — some of those controls are there because a contract names them, or because a platform you do not operate provides them, and both are legitimate reasons that the engine has no field for.
What it is, reliably, is the list of controls you cannot currently explain. In a second year that list matters more than it did in a first, for an unglamorous reason: a control nobody can explain is a control nobody will defend when the quarter gets busy, and that is the same ranking you built in the second lesson of this track arriving from a different direction.
Check