What is residual risk?

Risk remaining after existing or proposed controls and remediation measures are taken into account.

What is time-limited exception?

A recorded decision to accept defined residual risk temporarily, with an accountable owner, expiry date, and required follow-up.

What is decision-grade evidence?

Technical and business evidence translated into impact, options, residual risk, requested action, owner, and expiry.

What is counterfactual governance test?

An assessment of whether a governance mechanism would have changed a past or pending risk decision, rather than merely documented it.

What is critical or important function?

A DORA classification that affects the depth of contractual and third-party risk-management requirements; it must be assessed on documented facts.

Test whether governance changes the outcome — Next steps: Contracts, governance and advice

1. Frame the governance counterfactual

Use a counterfactual

Ask whether the governance process, if used before the decision, would have changed the product scope, launch timing, risk acceptance, or remediation.

Trace the decision chain

`Product change -> evidence -> accountable decision-maker -> recorded decision -> owner and deadline -> retest`

Look for consequences

A status report after launch is weak governance. A pre-release gate with authority to condition or stop release can alter the outcome.

2. Separate the legal anchors from advisory design

GDPR: effectiveness matters

GDPR Article 32 requires risk-appropriate measures and a regular process to test, assess, and evaluate their effectiveness.

NIS2: check national law

For essential and important entities to which Article 20 applies, it connects management-body approval and oversight to Article 21 measures, but NIS2 requires national transposition.

DORA: preserve the distinctions

Since 17 January 2025, Article 24 has required in-scope financial entities other than microenterprises to integrate the testing programme into ICT risk management and support remediation and internal validation. Microenterprises have proportionate testing requirements under Article 25(3); Article 16's simplified framework applies separately to the specified financial entities.

3. Test decision rights, not job titles

Map real authority

The relevant decision-maker may be a delegated product or business leader, not the board. Map who can release, condition, accept, or exit.

Make escalation executable

For each material risk, record the decision, accountable role, measurable trigger, rationale, expiry, residual-risk owner, and retest.

Preserve challenge

Do not let one delivery lead redefine severity and approve the exception without meaningful independent challenge.

4. Thought exercise: inspect one governance route

Run a five-minute governance stress test

Choose one planned release or outsourced ICT service. Complete these prompts before advising:

What is the irreversible decision? For example, go-live with a new identity-verification feature.
What evidence could change it? For example, a penetration-test finding, a failed recovery exercise, or a supplier location change.
Who receives that evidence before commitment? Name a role, not "management".
What must that person decide? Specify approve, defer, impose conditions, or accept a time-limited exception.
What proves closure? Identify the retest, control owner, and evidence repository.

If any answer is vague, governance probably does not change the outcome yet. Recommend a targeted control point rather than more reporting.

5. Make evidence decision-grade

Package evidence for a decision

Translate findings into service impact, exploitability, options, residual risk, requested decision, accountable owner, and expiry date.

Connect evidence to risk

Decision-grade evidence supports GDPR's risk-based security model and NIS2's appropriate-and-proportionate measures.

Do not overstate the matrix

An escalation threshold matrix is sound advisory practice, not a universally mandated EU format. It works only if applied and reviewed.

6. Apply the test to a DORA supplier decision

Conflicting facts

Payments continue without analytics, but a prolonged outage may prevent fraud detection and investigation. The disputed classification drives the governance response.

Reasoned decision

Choose documented assessment and escalation before contracting. The governance mechanism changes the launch conditions and contractual analysis.

Keep Article 30 distinct

Article 30(1) is written allocation; 30(2) is general minimum terms; 30(3) adds terms for critical or important functions.

7. Give advice that can be tested later

Use four advisory outputs

State the conclusion, conditions, owner and forum, and the facts that would reverse the advice.

Make governance auditable

A recommendation should show how information reaches a decision-maker, produces action, and is checked after implementation.

Reflection

Which additional fact could change your advice, and why?

Scenario quiz: choose the next decision

VelaPay product release

VelaPay is an in-scope financial entity. A new account-recovery feature uses an ICT provider and processes personal data. Engineering says the provider is replaceable and wants launch approval today. Security has evidence that a recovery test failed in one region, while procurement has not confirmed whether a subcontractor will process support logs outside the EEA.

The board receives a monthly dashboard but has not been asked to approve this release. The product sponsor can defer launch for one week.

What is the best next decision?

Approve launch because the provider is replaceable, then add the failed test to the next monthly board dashboard.
Defer launch for the available week; require a documented criticality and data-flow assessment, resolution or accepted treatment of the failed test, and a named accountable decision-maker with an expiry-bound record.
Require the board to approve every product release, regardless of risk, before engineering may deploy.

Show Answer

Answer: B) Defer launch for the available week; require a documented criticality and data-flow assessment, resolution or accepted treatment of the failed test, and a named accountable decision-maker with an expiry-bound record.

The second option creates an outcome-changing governance gate using live evidence: failed resilience evidence, unresolved subcontracting and data-flow facts, and a decision that can still be altered. It does not assume that the service is critical or important, but it requires a documented assessment before relying on that conclusion. Option A merely reports after the decisive event. Option C may be disproportionate and is not a general requirement under GDPR, NIS2, or DORA. The advice could change if the assessment establishes that the service is clearly separable from critical or important functions, the test failure is shown not to affect the release configuration, and the provider's data-processing and subcontracting arrangements are confirmed; GDPR risk-appropriate security obligations would still need assessment.

Key Terms

residual risk: Risk remaining after existing or proposed controls and remediation measures are taken into account.
time-limited exception: A recorded decision to accept defined residual risk temporarily, with an accountable owner, expiry date, and required follow-up.
decision-grade evidence: Technical and business evidence translated into impact, options, residual risk, requested action, owner, and expiry.
counterfactual governance test: An assessment of whether a governance mechanism would have changed a past or pending risk decision, rather than merely documented it.
critical or important function: A DORA classification that affects the depth of contractual and third-party risk-management requirements; it must be assessed on documented facts.