Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Managing Issues, Findings and Control Deviations
The issue life cycle
Issues come from audits, control tests, incidents, self-assessments and regulators. Manage them in one log, rated by their effect on risk rather than by their source.
A well-described finding
Link issues to risks
- Which risks does the issue affect?
- Does it change residual risk ratings?
- Does it reveal a missing scenario?
- Update the register when issues open and close.
Example. A control test found 12 leavers with active accounts. Instead of disabling just those 12, the root cause (contractors missing from the HR feed) was fixed, and the access risk’s residual rating was updated until the fix was verified.
Tracking to closure
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST basis for prioritising issues | Effect on risk |
| Before closing an issue | Verify the fix with evidence |
| Recurring findings | Address the root cause |
| Issue affects a key control | Re-assess the related risk |
In short
- Issues come from audits, control tests, incidents, assessments and regulators; manage them in one log.
- Rate each issue by its effect on risk, not by its source or how embarrassing it is.
- Every issue needs an owner, an agreed action and a due date.
- Fix the root cause, not just the symptom, so the issue doesn't recur.
- Close issues only when evidence shows the fix works.
- Update the related risks in the register when issues are raised and closed.
Exam traps
- Closing an issue on management's word without evidence.
- Treating audit findings as more important than internal test results by default.
- Fixing the single example found instead of the process.
- Not linking issues to the risks they affect.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The issue life cycle
A well-described finding
Tracking to closure
1 / 8