Book a demo →
Risk & Compliance

Assessments Don't Reduce Risk. Decisions Do.

Why a closed finding and a reduced risk are not the same thing, and what has to happen in between

Zeeshan MahmoodSecurity Assessment, Architecture & AI ·6 min read
Risk & ComplianceSecurity AssessmentGovernment of Canada

The assessment completed. The report was accepted. Every finding was marked closed. Eighteen months later the next assessment found the same weakness in the same place.

Nothing was dishonest. The process ran correctly. The risk never moved.

An assessment is an instrument. It measures. Measuring a thing does not change it.

What an Assessment Actually Produces#

Evidence, and a judgment about it. Nothing else.

That is not a limitation; it is the design. An assessor who decides what to do about a finding has stopped being independent — they now have a stake in the answer. The value of an assessment rests on its being only a description of what is true, handed to someone else.

Assessments identify risk, the register manages it Two panels. The left panel, labelled point in time, is the assessment: it answers what the state of risk is today, running assess controls to findings to residual risks, fed by sources including security assessment and authorization, manually raised risks, SOC findings, vulnerability management and patch management. An arrow labelled promote carries risks to the right panel, the register, labelled continuous: it answers what risks we are actively managing, cycling own, treat, decide, review, updated for the life of the system regardless of the risk's source. A footnote notes the plan of action and milestones tracks one assessment's remediation while the register carries every risk the organization is managing. ASSESSMENTS IDENTIFY RISK — THE REGISTER MANAGES IT POINT IN TIME The assessment identifies What is the state of risk today? Assess controls → Findings → Residual risks SOURCES SA&A Manual SOC Vulnerability Patch Mgmt PROMOTE CONTINUOUS The register manages What risks are we actively managing? Own → Treat → Decide → Review Updated for the life of the system — ownership, treatment, acceptance and closure, whatever the risk's source. The POA&M tracks one assessment's remediation. The register carries every risk the organization is managing — and survives the report that found it.
Figure 1: An assessment is a point-in-time view; a register is a continuous one. The decision happens at the handoff between them.

Scroll sideways to see the full diagram →

The failure in the opening story is not that the assessment was wrong. It is that nothing was designed to happen next.

"Findings Closed" Is Not a Risk Metric#

Closing a finding means the paperwork is resolved. That can happen four ways:

The finding closed because…Did the risk move?
The weakness was remediatedYes
The scope was redrawn to exclude itNo
Someone accepted the residual riskNo — it was chosen, not reduced
The assessment ended and the tracker was archivedNo

A program reporting closure rates to an executive committee is reporting its own throughput and calling it security. It is an honest number about the wrong thing.

The Four Decisions#

Every finding that becomes a risk faces exactly four options.

  1. MitigateChange the system or its controls so the risk is smaller
  2. ShareMove some of the consequence to someone else — insurance, a contract, a provider. NIST calls this transfer
  3. AvoidStop doing the thing that creates the risk
  4. AcceptCarry it, knowingly, with a named person's signature

Two things worth saying that are usually skipped. Accept is legitimate. A risk accepted explicitly by someone with authority, recorded and revisited, is a sound decision — often the right one. What is not legitimate is acceptance by default, where the risk is carried because nobody chose anything.

And sharing moves less than people think. A contract can move financial consequence; it cannot move a privacy breach off your organization's name.

Who Is Allowed to Decide#

Whoever owns the consequence.

An assessor recommending is not deciding. A security team escalating is not deciding. A project manager marking the item done is certainly not deciding. The decision belongs to the person on whom the risk actually lands, and that is usually a business owner, not a technical one.

The NIST definition of the role is short enough to memorize:

Official with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to agency operations.

FIPS 200, via the NIST glossary

Assume responsibility.2 Not review, not approve — assume. The word choice is the whole point. ITSG-33 frames the authorizer's role the same way,1 and the TBS Directive on Security Management makes it a requirement: departments must document "the formal acceptance of residual risk by an individual who has the required authority".4

What Has to Happen in Between#

Four steps, each with an owner:

  1. A finding becomes a risk statement — what is wrong, what it exposes, what could follow, for whom.
  2. The risk statement gets an owner — one person, by role.
  3. The owner makes one of the four decisions, with the residual risk rated so it can be compared.3
  4. The decision is recorded and revisited — because acceptance decays and mitigations slip.

This post is about why those steps exist. How they work is written up elsewhere: the translation in From Finding to Risk Statement, the ownership model and lifecycle in A Risk Register That Actually Works, and the decision itself in Authorization Decisions.

Where CtrlFort Fits#

The gap between "found" and "decided" is where risks go to die, and it is usually a tooling gap: the finding lives in a report, the decision lives in an email, and nothing joins them.

CtrlFort closes it structurally. A finding in CtrlFort Assess is promoted into a risk with its rating, rationale and evidence attached, so the owner is deciding about the same object the assessor described. The decision — mitigate, accept, share, avoid — is recorded on that object, with a review date, by the person who holds the role.

What the platform does not do is decide. CtrlFort assembles the evidence and rates the residual risk; the choice about what to carry remains a human signature, as it must.5 Automation shortens the path to the decision. It does not become the decider.

Final Thoughts#

Assess so that someone can decide. Judge the program by whether they did.

Previous: SA&A Terminology Explained · Next: What Makes Assessment Evidence Defensible?

Frequently Asked Questions#

If assessments don't reduce risk, why do them?#

Because you cannot make a good decision about a risk you have not measured. The assessment is what makes the decision informed. It is necessary; it is just not sufficient, and treating it as sufficient is the error.

Is accepting a risk the same as ignoring it?#

No. Ignoring is the absence of a decision. Accepting is a decision — made by someone with authority, recorded, and revisited on a date. The two look identical on the day and completely different a year later.

Who should own a risk that crosses several teams?#

One person, by role, on whom the consequence lands. Shared ownership is no ownership. If the consequence genuinely lands in two places, it is probably two risks.

What is a better metric than findings closed?#

Decisions made, and time from finding to decision. A program that can say "every risk from this cycle has a named owner and a recorded decision" has measured something real. Closure rate is a byproduct.

References#

  1. ITSG-33 — IT security risk management: A lifecycle approach ↩Canadian Centre for Cyber Security · https://www.cyber.gc.ca/en/guidance/it-security-risk-management-lifecycle-approach-itsg-33
  2. Authorizing Official — glossary entry, citing FIPS 200 ↩National Institute of Standards and Technology · https://csrc.nist.gov/glossary/term/authorizing_official
  3. NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments ↩National Institute of Standards and Technology · https://csrc.nist.gov/pubs/sp/800/30/r1/final
  4. Directive on Security Management ↩Treasury Board of Canada Secretariat · https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32611
  5. NIST SP 800-37 Rev. 2 — Risk Management Framework for Information Systems and Organizations ↩National Institute of Standards and Technology · https://csrc.nist.gov/pubs/sp/800/37/r2/final
On this page

On this page

  1. What an Assessment Actually Produces
  2. "Findings Closed" Is Not a Risk Metric
  3. The Four Decisions
  4. Who Is Allowed to Decide
  5. What Has to Happen in Between
  6. Where CtrlFort Fits
  7. Final Thoughts
  8. Frequently Asked Questions
  9. References

Zeeshan Mahmood

Security Assessment, Architecture & AI

Zeeshan is a security advisor and senior IT security risk analyst who works at the seam between assessment and design. He runs the full authorization lifecycle — security categorization, threat and risk assessment, control profile selection, and the evidence behind an authority to operate — and designs the solution, cloud and security architecture that has to survive it, from landing zones and network segmentation to Zero Trust and cross-domain solutions. His current focus includes AI security and the assessment of AI-enabled systems. He holds CISSP, CCSP, CISM, CKS and Azure Solutions Architect Expert, and leads assurance methodology at CtrlFort.

Run this framework against your own control library.

CtrlFort Assess maps cloud control profiles, ITSG-33 baselines and certification regimes to one shared evidence base — so a control you evidence once satisfies every obligation it maps to.

Book a demo → Explore the platform

Keep reading

Risk & Compliance01

From Assessment to Accountability: A Risk Register That Actually Works

Assessments identify risk; the register manages it — the ownership model that turns findings into decisions, and how CtrlFort runs it

·17 min Read →
Risk & Compliance02

How Dangerous, How Exposed, What Remains: A Working Model for Residual Risk

The three-formula risk model inside CtrlFort Assess — threat from likelihood and capability, vulnerability from prevention and response weakness, and the residual risk left at their intersection

·19 min Read →
AI & Governance03

How CtrlFort Uses AI to Deliver Repeatable, Explainable and Defensible Assessments

Code evaluates, AI explains, humans decide — inside the assessment intelligence architecture behind CtrlFort Assess

·11 min Read →