SkarpChapter 1 of 3
Test whether governance changes the outcome · New case 9
Develop contracts, governance and advice while working to advise boards and product teams.
1. Treat governance as an outcome-changing fact
The practical question
Ask whether governance changed the decision path: ownership, challenge, approval, escalation, remediation and validation.
Evidence, not immunity
A policy or board minute can evidence organisational measures, but it cannot make an inadequate technical control adequate.
2. New case 9: LumenPay's launch decision
Product's case
Product relies on encryption, no confirmed extraction and an inventory label calling the new feature "non-critical".
Security's case
Security found an exploitable weakness in a shared identity service that also supports payment authorisation.
The governance gap
A historic policy approval is not the same as an authorised, informed and recorded decision on this specific residual risk.
3. Run the scope and classification gate first
Three separate gates
Determine regime scope, DORA function criticality and any NIS2 entity status separately. One internal label cannot answer all three.
NIS2 nuance
Article 20 creates a management-body governance requirement through national implementation; confirm the applicable domestic rules.
4. Apply the testing and contract rules precisely
Testing programme
For non-microenterprise financial entities, DORA requires a reviewed programme, remediation procedures and validation that findings are addressed.
Article 30 discipline
Separate the written-contract rule in 30(1), baseline terms in 30(2), and additive critical-or-important-function terms in 30(3).
5. Give a reasoned next decision
Best next decision
Withhold production approval while the authorised governance body receives an evidence-based classification and remediation decision.
Do not pause response work
Continue evidence preservation, technical containment and privacy assessment at once. Governance must not become an excuse for delay.
Build the record
Record assumptions, residual risk, ownership, corrective actions, validation evidence and the exact condition for a renewed launch decision.
6. What fact could reverse the advice?
Reflection exercise
Choose one additional fact that would materially change your advice, and explain why:
- Independent validation establishes that the alleged weakness is not exploitable in the production architecture.
- The service assessment shows that the shared identity service does not support a critical or important function.
- The entity is a DORA microenterprise, changing the Article 24 testing-programme analysis.
The strongest reversal fact is usually one that changes the legal classification or disproves the technical premise. A retrospective board approval alone is weaker: it may improve accountability evidence, but it does not establish that the finding was remediated or that the contract is compliant.
7. Decision vocabulary
Flip each card, then apply the distinction to LumenPay.
- Governance evidence
- A record showing accountable ownership, informed approval, oversight, remediation and validation.
- DORA Article 30(2)
- Baseline minimum contractual elements for arrangements using ICT services.
- DORA Article 30(3)
- Additional contractual elements where services support critical or important functions.
8. Scenario quiz: choose the best next decision
LumenPay has an unresolved test finding, an uncertain function classification and no recorded authority for release-specific risk acceptance.
What is the best next decision?
- Launch because encryption and the absence of confirmed extraction prove the risk is acceptable.
- Withhold production approval, preserve evidence, complete the classification and remediation analysis, and obtain an authorised documented decision before reconsidering launch.
- Ask the board to ratify the launch after release because a prior cybersecurity policy already approved the general risk framework.
Show Answer
Answer: B) Withhold production approval, preserve evidence, complete the classification and remediation analysis, and obtain an authorised documented decision before reconsidering launch.
Option 2 addresses the facts that governance can change: classification, authorised ownership, remediation and validation. Option 1 treats incomplete technical evidence as a conclusion. Option 3 may create a record, but retrospective ratification does not resolve the vulnerability, prove adequate testing remediation, or determine whether Article 30(3) applies. GDPR Article 32 also requires risk-appropriate organisational and technical measures, including regular effectiveness testing.
Key Terms
- residual risk
- Risk remaining after controls and corrective measures have been applied or proposed.
- governance evidence
- Contemporaneous records showing how a risk decision was informed, authorised, overseen and verified.
- authorised risk owner
- The person or body with documented authority to accept, escalate or require treatment of a defined residual risk.
- critical or important function
- A DORA classification that determines whether the additional contractual provisions in Article 30(3) apply.