Control Effectiveness Haircut

A risk register records an inherent loss of £4M for unencrypted customer data at rest, notes that an encryption-at-rest control exists, and records residual risk as Low. Nobody asks the only question that matters: on what share of the estate is that control operating, and how long does a gap stay open before anyone acts.

When the question is asked, the answer is usually available. A policy evaluation already reports how many in-scope resources it covers and how many pass. Remediation tickets already have timestamps. Those two numbers - coverage and time-to-remediate - are the measured effectiveness of the control, and they are far better than the adjective the workshop agreed on.

The practice is to apply them as an explicit discount. If the control covers 85% of the estate and a violation stays open for a median of 6 days, the residual is not Low; it is the inherent loss weighted by the 15% that is uncovered plus the exposure the covered part carries during its remediation window.

Why it matters

Residual risk is the number that decides funding, and in most registers it is produced by assertion. Two consequences follow. Risks whose controls have quietly stopped covering new estate keep their green status for years, which is how coverage drift becomes invisible. And teams cannot argue for investment, because "improve the control" has no denominator.

A measured haircut also makes the right conversation possible: raising coverage from 85% to 99% is a concrete piece of work with a cost, and its benefit is now a number on the same register the board reads.

Implementation patterns

• Define the denominator first. In-scope resources according to an inventory the control does not own. A control reporting 100% compliance over the resources it knows about is the standard way to overstate coverage.
• Take coverage from the control, not the owner. The policy engine's evaluated-population count against the inventory count, refreshed weekly.
• Take detection and remediation latency from tickets: median and 90^th percentile time from violation detected to resolved. The 90^th percentile is the one that matters, because tail exposure is where losses live.
• Compute the residual arithmetically. Inherent annualised loss × uncovered share, plus inherent loss × covered share × the fraction of the year a covered resource spends in violation. State the formula on the register entry so the number can be challenged.
• Set a review trigger rather than a review date. Re-estimate when coverage falls 5 percentage points or the 90^th-percentile remediation time doubles - a change in the input, not a calendar event.

Industry example

Industry reporting on cloud misconfiguration keeps finding it persisting in estates that already have a control for it, which is what a coverage-weighted residual predicts and an adjective-based register cannot represent. The version familiar to anyone who has operated a control in production is the same arithmetic seen from inside: a monthly compliance report at 99% against the resources the scanner enumerates, and a quarterly independent inventory finding several hundred resources the scanner never saw. The reports were never wrong about their own population; the population was the problem.

Failure scenarios

• False precision. A loss distribution built on three guesses, presented to a board as £4.1M. The haircut is a discount on an estimate, and the estimate's range must travel with it.
• The control's own inventory as the denominator, which makes coverage 100% by construction.
• Gaming through scope. An owner narrows the in-scope definition to raise coverage, and the register improves while the exposure does not.
• A haircut applied once. Coverage decays as new estate arrives; a residual computed in January and never recomputed is the same assertion it replaced, with arithmetic on top.

Trade-offs

When not to use it

When the control is binary and verifiable, a haircut adds nothing. A payment flow that cannot accept an unauthenticated request either rejects them or does not; coverage is 100% by construction and the register should say so. Skip it too where the inherent loss estimate is weaker than the coverage number - discounting a wild guess by a precise percentage produces a precise wild guess. In both cases the honest entry is the measured coverage itself, stated without a money figure around it.

Interview question

Q: A register shows residual risk as Low because a control exists. The control covers 85% of the estate with a 90^th-percentile remediation time of 19 days. How would you restate the entry, and what would you ask for?

What a strong answer covers: residual risk as inherent loss discounted by measured coverage and exposure time, with the formula on the entry · the denominator taken from an independent inventory · the 90^th percentile rather than the median because tail exposure carries the loss · a re-estimation trigger tied to a coverage drop rather than a calendar · and the limit: the discount cannot be more credible than the inherent estimate it is applied to.

Quick check

Quiz: Where should the denominator for a control's coverage come from, and why not from the control? From an inventory the control does not own; otherwise coverage is measured over the resources the control already knows about and is 100% by construction.

Flashcard: Which two measured numbers convert "the control is effective" into a residual risk? - Coverage, the share of the in-scope population the control actually evaluates, and remediation latency at the 90^th percentile, which sets how long a covered resource stays exposed.