The situation
I was asked to review whether a major transformation affecting critical payments infrastructure and operations had a sound approach to managing risk. The review included its risk-based testing.
What I found
The risk assessments relied on one person’s judgement, which had not been validated. The evidence therefore gave no sound basis for the confidence expressed in how much risk the testing had mitigated.
What the finding meant
The evidence did not substantiate the claimed reduction in risk and could not justify the assurance being given. The review did not establish that the testing itself was insufficient. I made that limit explicit so the finding could be assessed accurately.
Limits of this account
No subsequent remediation result is claimed here. The finding concerns the basis of the assurance given, with the limit on conclusions about testing stated above.
A question for your decision
What evidence would justify the confidence we are placing in this conclusion?
Related work and questions
Independent Review · How can a board independently verify programme readiness?