Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “Exit & Concentration Risk”
Provider Exit Plan
A documented and tested plan for moving a workload off a provider, whose credibility is measured by what has actually been rehearsed rather than described.
Capital One's Data Centre Exit
A major US bank closed all eight of its data centres and moved fully to public cloud, treating governance automation as the enabling technology rather than a constraint.
Cloud Exit Plan
A documented, costed assessment of what leaving a provider or service would require — increasingly a regulatory expectation and a better lock-in control than portability itself.
Fourth Party Risk
The dependencies of your dependencies, which you did not choose, may not know about, and remain accountable for.
Licence Metric Risk
The exposure created when a software licence is priced on a unit that cloud architecture changes unpredictably, such as cores, sockets or instances.
Migration Risk Register
A maintained record of what could go wrong in a migration, with likelihood, impact, owner and mitigation, reviewed as the programme progresses.
Quantified Risk Estimate
Expressing a risk as a probability distribution over financial loss rather than as a colour, which makes risks comparable and mitigations arguable on cost.
Re-Identification Risk
The probability that pseudonymised data can be linked back to individuals, which is what keeps such data within the scope of data protection law.
Risk Tolerance Statement
The board-level declaration of how much of each risk type the organisation will accept, which is what tells an architect which risks may be accepted without escalation.
Use Case Risk Classification
Assigning an AI application to a risk tier based on the consequence of it being wrong, which then determines the obligations that apply.
Assurance Map
A single view of which risks are covered by which assurance activity, exposing both the gaps nobody is looking at and the duplication several parties are paying for.
Attack Surface
The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
Business Case Structure
The argument format that gets technical investment funded — problem, options, quantified benefit, cost, risk and a recommendation.
Canary Release
Routing a small fraction of traffic to a new version, watching its metrics, and expanding or rolling back based on what they show.
Capability Heat Map
A capability map coloured by a chosen dimension — maturity, cost, risk, or strategic importance — to make patterns visible to non-technical stakeholders.
Commitment Coverage
The proportion of steady-state usage covered by discounted commitments, balanced against the risk of committing to capacity that is no longer needed.
Database Migration Strategy
The approach for moving data to a new store, which is usually the longest pole and the highest risk in any modernisation.
Decision-Making Under Uncertainty
Choosing well when the information is incomplete — by bounding the downside and buying information, rather than by waiting for certainty.
Degradation Mode
A defined, intentional reduced state of service that the system enters under specified conditions, with known behaviour and known exit criteria.
Legacy System Assessment
A structured evaluation of a system's business value, technical condition and risk, used to decide what to do with it rather than to describe it.
Lift and Shift
Moving an application to new infrastructure with minimal change, trading optimisation for speed and low migration risk.
Model Inventory
A complete register of models in use with their purpose, owner, risk tier and validation status — the artifact everything else in model governance depends on.
Parallel Run
Running the old and new systems side by side on the same inputs and comparing outputs, before the new one is trusted.
Pre-Mortem
An exercise in which a team imagines a project has already failed and explains why, surfacing risks that a forward-looking risk assessment misses.
A regulator asks for evidence that your exit plan from your primary cloud provider is credible. The plan is a twelve-page document. What will they find, and what should you do?
What they will find A document describing an intention. Supervisors have moved from accepting exit plans to asking what has been tested, precisely because most
A CDC pipeline feeding your warehouse falls three hours behind during a source system's batch job, and the source's transaction log retention is 24 hours. What is the risk and what do you change?
The immediate risk Lag consumes the retention window. At three hours behind against a 24 hour retention, you have 21 hours of margin. If the consumer stops enti
You inherit an estate of roughly 400 applications, no reliable inventory, and a mandate to reduce cost and risk. What do you do in the first ninety days?
What the interviewer is testing Whether you can sequence work at portfolio scale, and whether you go for evidence before strategy. This is the enterprise archit
A 15-year-old monolith runs the core of the business. Leadership wants microservices. How do you approach it, and what would make you refuse?
What the interviewer is testing Whether you start from the business problem or from the target architecture, and whether you are willing to say no. First, estab
A deployed model performed well in validation and its business metric has declined over four months. Nothing has been deployed. What do you investigate?
The model did not change; its world did Three distinct causes, and they need different responses: Data drift. The input distribution has moved — a new customer
A team proposes rewriting a critical system from scratch, arguing the existing one is unmaintainable. How do you evaluate this?
Test the diagnosis before the prescription "Unmaintainable" usually means one of several different things, and they have different remedies: Nobody understands
A twenty-year-old core system supports most of the business. It is on unsupported technology, three people understand it, and the last replacement attempt was abandoned after two years. Design the programme.
Learn from the abandoned attempt first The most important input is why the last one failed, and the reasons are usually structural rather than technical: a big
A vendor SaaS product embeds a model that scores customers, and its output drives an automated decision in your process. Your model governance framework covers models you build. What do you do?
The obligation does not transfer with the outsourcing You are accountable for the decision. That the scoring is performed by a vendor changes who operates the m
Finance wants a three-year commitment on cloud spend for the discount. Engineering is nervous. How do you advise?
Commit to the floor, not to the forecast The safe commitment is the portion of usage that will exist regardless of what happens: the steady baseline, evidenced
Exit & Concentration Risk
Being able to leave a provider, and what the regulator asks when you cannot.
AI Risk Tiering
Classifying a use case by potential harm, and the obligations each tier triggers.
Assurance, Audit & Model Risk
General material on assurance, architectural governance and risk oversight.
Migration Risk
Bounding blast radius, staging by cohort, and honest readiness reporting.
Model Risk Management
Inventory, validation, monitoring and challenge for models that make consequential decisions.
Risk Appetite
The stated tolerance that tells you which risks you are allowed to accept.
Risk Assessment Methods
Qualitative matrices, FAIR and scenario analysis, and the illusion of a precise score.
Third-Party Risk
Assessing, contracting and monitoring the vendors your architecture now depends on.
Architecture Compliance Checks
Automating conformance to standards so review effort goes to the genuinely novel.
Audit Evidence
Producing durable, tamper-evident proof as a by-product rather than as a project.
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Build vs Buy
Differentiation, five-year TCO, and the exit cost of each option.
Certification Impact on Architecture
What SOC 2 and ISO 27001 actually require of a design, and what they do not.
Change Advisory vs Automated Gates
Replacing a weekly board with evidence a machine produces on every change.
Change Data Capture
Turning a database's replication log into a stream, and its coupling risk.
Communicating Threat Models
Making risk legible to people who will fund or accept it.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.
Design Authority
How an ARB should decide, what it should not review, and how it avoids becoming a queue.
Exception & Waiver Management
Time-boxed, owned deviations with a remediation date, rather than permanent silence.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.
Mainframe Modernization
Batch windows, COBOL, and the risk profile of core banking systems.
Model Documentation
Model cards, intended use, limitations, and the record a regulator will ask for.
Model Evaluation & Red-Teaming
Adversarial testing of a probabilistic system with no fixed expected output.
Modernisation Business Case
Pricing tail risk so deferred maintenance becomes fundable.
OWASP Risks
The recurring web and API risk classes, several of which are design flaws.