An architect insists residual risk must drop whenever any control is linked, even if the control failed testing. What correction is required?
Select an answer to reveal the explanation.
Short Explanation
Linking a broken lock to the risk does not make the building safer. Controls only earn residual credit when they are effective—failed results should keep residual honest, not paint a rosy score.
Full Explanation
Architectural integrity requires that residual risk reflect control effectiveness, not mere association. Linking ineffective or failed controls should not artificially reduce residual. IRM designs that ignore test results, forbid risk–control links, or always zero residual on linkage misstate exposure.