SkarpChapter 1 of 3
Turn an uncertain risk into a defensible decision · New case 13
Develop contracts, governance and advice while working to advise boards and product teams.
1. Make the decision, not the uncertainty, visible
Turn debate into a decision
Use one decision sentence: `Approve, defer, or limit [activity] because [risk judgment], subject to [controls and evidence].`
Separate what is known, the consequence if true, and the fact that could reverse the outcome. A defensible decision is not a no-risk guarantee.
2. Build a short evidential record
The four columns
Record established facts, contested facts, the current inference, and a verification owner with a production stop condition.
Rank evidence by quality. Dated technical evidence and executed contract schedules normally carry more weight than untested assurances.
3. Connect facts to the applicable legal consequence
Do not collapse the tests
GDPR Article 32 asks whether security is appropriate to personal-data risk. Later breach notification and individual communication use separate risk thresholds.
For this DORA-covered payment institution, DORA generally governs the corresponding ICT governance and risk-management duties instead of NIS2 Articles 20 and 21. Assess any separate national obligations and whether the service supports a critical or important function.
4. Case file: Helix Harbor Payments
Conflicting evidence
Product says identifiers are pseudonymous. Security says retrieval can reconnect them to account history and logs may expose names and payment references. If present as described, these are personal data.
The provider may add an analytics subcontractor in another region. The service is operationally useful, but a manual fallback exists for several days.
5. Compare options by reversibility
Option A: launch now
Immediate production creates speed, but embeds uncertain data, dependency and subcontracting risks before the facts have been verified.
Option B: bounded pilot
A synthetic-data or non-production pilot preserves learning and reversibility. It is a proposed governance practice, not an independent legal mandate.
6. Convert the recommendation into conditions
Production gates
Verify what personal data the actual configuration transmits or records in provider-accessible logs, map processing and service locations, test safeguards and fallback, then complete and record the DORA function classification.
DORA Article 30: three layers
Article 30(1) concerns written allocation and form. Article 30(2) contains baseline ICT contract terms. Article 30(3) adds terms for critical or important functions.
Pilot evidence can inform DORA resilience testing. It does not replace the financial entity's testing programme under Articles 24 and 25.
7. Give the board a decision it can own
A board-ready recommendation
Approve a non-production pilot, not customer-data production use, subject to named gates, an executive owner and a return for production approval.
Record meaningful management-body oversight under DORA. Reverse the recommendation if evidence shows exposed personal data, unapproved locations or subcontracting, failed fallback, or unmet Article 30(3) terms after classification.
8. Fact-flip exercise
Identify the fact that changes the advice
Choose one additional fact that would most change your recommendation:
- The diagnostic logs are irreversibly anonymised before leaving the institution.
- The provider refuses to disclose all processing locations and subcontractors.
- The manual fallback can operate for two weeks rather than several days.
Then complete this sentence: `This fact matters because it changes [legal test or operational dependency] by [specific mechanism].`
The strongest answer is usually the fact that changes the applicable obligation, the evidence quality, or the reversibility of harm—not merely the estimated commercial benefit.
Scenario quiz: choose the best next decision
The missing contract evidence
Two days before planned production use, Helix Harbor confirms that real customer complaint data will be processed. The provider still cannot provide a complete processing-location schedule and says audit rights must be limited to an annual assurance report. The DORA critical-or-important-function assessment is incomplete.
What is the best next decision?
- Approve production because the provider has strong market reputation and the service can be manually bypassed.
- Defer production, preserve a synthetic-data pilot if safe, and require location, subcontracting, classification and contractual evidence before reconsideration.
- Approve production only if the product team accepts responsibility for any future data-protection or resilience issue.
Show Answer
Answer: B) Defer production, preserve a synthetic-data pilot if safe, and require location, subcontracting, classification and contractual evidence before reconsideration.
The unresolved facts directly affect data-flow risk, supplier oversight and whether Article 30(3) applies. A bounded synthetic-data pilot may remain proportionate if independently safe, but production should wait for verifiable evidence and completed classification. Reputation and internal allocation of responsibility do not cure missing contractual or governance evidence. DORA Article 30(2) requires location and other baseline ICT contract elements; Article 30(3) adds audit and transition-related protections for services supporting critical or important functions.
Key Terms
- Reversibility
- The extent to which an activity can be stopped or corrected before uncertain facts create material legal, customer or operational harm.
- Production gate
- A proposed governance condition that must be evidenced before moving from testing or pilot use to live customer-data use.
- Defensible decision
- A documented, proportionate decision that identifies evidence, assumptions, residual risk, accountable owner and conditions for reversal.
- Critical or important function
- A DORA classification that determines whether the additional contractual requirements in Article 30(3) apply.