Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Validating Risk Data Quality
Dimensions of quality
Bad data produces confident but wrong decisions. Validate data before aggregating or reporting it.
Validation checks
| Check | Example |
|---|---|
| Completeness | Does the scanner cover all servers in the CMDB? |
| Accuracy | A sample of records checked against the source |
| Consistency | The same definition of “critical” as last quarter? |
| Reasonableness | Outliers and sudden jumps investigated |
| Timeliness | Data date shown, and recent enough |
Be honest about limits
Sometimes the data isn’t perfect and a decision can’t wait. That’s fine, as long as the report says so: which data is missing, how estimates were made and how confident the practitioner is.
Example. The patching KRI showed 98% compliance. Validation found the scanner covered only servers on the main network; cloud servers weren’t included. Including them dropped compliance to 81%, and the KRI turned amber.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Before reporting a metric | Validate the underlying data |
| KRI suddenly improves sharply | Check the data and definitions before celebrating |
| Data has known gaps | Disclose the limitations in the report |
| MOST important data quality attribute for a decision | Accuracy and completeness |
In short
- Risk data should be accurate, complete, consistent, timely, traceable and relevant.
- Validate data before aggregating or reporting; bad data produces confident but wrong decisions.
- Reconcile data with independent sources and check for gaps, duplicates and outliers.
- Every metric and data feed needs a defined source, owner and calculation method.
- Disclose known data limitations in reports rather than hiding them.
Exam traps
- Reporting tool output without checking completeness.
- Mixing definitions between periods so trends are false.
- Hiding data gaps to make a report look cleaner.
- Assuming automated data is always accurate.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Dimensions of quality
1 / 7