Mandate and risk diagnosis

This module turns a request that assumes its conclusion into a bounded mandate with an evidence scope and decision owner. Learners separate observation from explanation: more alerts can coincide with a lower alert rate, and neither figure establishes monitoring quality. They build rival hypotheses and select tests that could weaken each one, such as reconciling feeds or comparing stable cohorts. They distinguish inherent exposure from control design, demonstrated operation and residual risk, writing conditional judgments when effectiveness is unproven. Finally, they allocate limited analyst days to evidence that could change an urgent decision, defer lower-value work with a review date and set an escalation gate. The outputs are an engagement charter, evidence ledger, risk register and test plan, rather than a predetermined failure verdict or legal compliance certificate.

Read the whole first subject without an account: its lessons, summary and review questions.