The control nobody could use
A firm adds a very strong login for all staff. It needs three steps and a code on a second phone. The cleaners and the delivery staff cannot manage it. They write passwords on notes.
The control was strong. The plan was weak, because it forgot the people.
By the end of this lesson
Note
I can list what a good plan to lower risk considers and weigh cost against benefit.
Key words
| Word | What it means |
|---|---|
| Strategy | a plan for reaching a goal |
| User profile | what the people who use a control need and how well they can use it |
| Cost and benefit | what a control costs, set against the harm it saves |
| Owner | the one person who makes sure an action is done |
| Escalation | passing a risk up to someone with more power to decide |
| Contingency plan | a plan B for when a control fails or the risk happens |
| Mitigation | an action that makes a risk smaller |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsHave a go: your answers are marked here and then forgotten. Sign in if you would like your score kept, and to pick up where you left off.Sign in to keep your score
Your answers are marked here and are not kept. A college account keeps every student’s marks.
Seven things a good strategy covers
- The response: accept, avoid, mitigate or transfer.
- The user profile: what users need and how well they can cope.
- Cost and benefit: is the control worth its price?
- An owner: one named person.
- Escalation: who to tell if it is too big for you.
- Contingencies: plan B.
- Monitoring and review: check it works, and look again.
The seven considerations with a question each
| Consideration | The question to ask | Example |
|---|---|---|
| Response | Which of the four fits? | Mitigate: add a backup |
| User profile | Can the users really use it? | A simple login for part-time staff |
| Cost and benefit | Does it save more than it costs? | Saves 1800 pounds a year, costs 500 |
| Owner | Who is responsible? | The IT manager |
| Escalation | Who decides if it is too big? | The head of IT, then the directors |
| Contingency | What if it fails? | Keep an older copy as a spare |
| Monitor and review | How will we know it works? | A monthly test and a yearly review |
The cells students fill in are left blank in this preview.
Worked example: is the backup worth it?
| Item | Amount |
|---|---|
| Yearly loss without a control (ALE) | 2400 pounds |
| Yearly loss with the control | 600 pounds |
| Saving from the control | 1800 pounds |
| Yearly cost of the control | 500 pounds |
| Net benefit | 1300 pounds, so yes |
The cells students fill in are left blank in this preview.