Assurance, Audit & Model Risk
General material on assurance, architectural governance and risk oversight.
4 to work through
-
intermediate
Zoom went from about 10 million daily meeting participants in December 2019 to more than 300 million in April 2020, then froze feature development for 90 days to work on security and privacy. What forced that, and which kinds of control break first when demand grows 30x in four months?
2 min answer -
advanced Multiple choice
A fast-moving engineering organisation must satisfy external assurance requirements without adding a review queue in front of every change. What model works?
1 min answer -
advanced
A regulated firm collects control evidence by hand each year for its certification: screenshots, exported spreadsheets, sampled tickets. It wants continuous controls monitoring instead. The certification cycle is mid-flight and the auditor has accepted the current approach. Give the sequence.
3 min answer -
advanced
How would you provide assurance that controls are operating without a review board?
2 min answer
2 terms in this topic
Assurance and Governance
Providing confidence that controls exist and operate — through automation and evidence rather than through review meetings.
practiceAssurance Map
A single view of which risks are covered by which assurance activity, exposing both the gaps nobody is looking at and the duplication several parties…
Neighbouring topics
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.
Audit Evidence
Producing durable, tamper-evident proof as a by-product rather than as a project.
Certification Impact on Architecture
What SOC 2 and ISO 27001 actually require of a design, and what they do not.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Segregation of Duties
Splitting authority so no single actor can both make and approve a change.
Change Advisory vs Automated Gates
Replacing a weekly board with evidence a machine produces on every change.
Risk Appetite
The stated tolerance that tells you which risks you are allowed to accept.
Risk Assessment Methods
Qualitative matrices, FAIR and scenario analysis, and the illusion of a precise score.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Architecture Compliance Checks
Automating conformance to standards so review effort goes to the genuinely novel.
Exception & Waiver Management
Time-boxed, owned deviations with a remediation date, rather than permanent silence.
Design Authority
How an ARB should decide, what it should not review, and how it avoids becoming a queue.
Three Lines Model
Ownership, oversight and independent assurance, and where architecture sits in it.
Model Risk Management
Inventory, validation, monitoring and challenge for models that make consequential decisions.
AI Risk Tiering
Classifying a use case by potential harm, and the obligations each tier triggers.
Model Documentation
Model cards, intended use, limitations, and the record a regulator will ask for.
Model Evaluation & Red-Teaming
Adversarial testing of a probabilistic system with no fixed expected output.
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.