Map Exceptions by Exposure and Control Strength

Control strength Weak control Strong control Exposure Low exposure High exposure Escalate now High exposure and weak control Examples: government-touching reseller missing ownership data, unresolved sanctions match, or retaliation-risk work change without independent review. Requires senior owner, interim containment, and dated remediation evidence. tl Monitor tightly High exposure and strong control Examples: high-risk process with a late attestation but active system blocks and daily exception reporting. Keep leadership visibility and verify closure, but do not treat it like an uncontrolled breach. tr Fix locally Low exposure and weak control Examples: small file gaps, outdated local procedure, or missing evidence field…

Sign up free — one personalized lesson every day, matched to your role and goals.

Already have an account? Sign in