An architect insists residual risk must drop whenever any control is linked, even if the control failed testing. What correction is required?
Select an answer to reveal the explanation.
Short Explanation
Linking a broken lock to the risk does not make the building safer. Controls only earn residual credit when they are effective—failed results should keep residual honest, not paint a rosy score.
Full Explanation
An architect who insists residual must drop whenever any control is linked—even if the control failed testing—needs correction: controls reduce residual only when effective, and architecture must link control results so ineffective controls do not falsely lower residual. Linking a failed access control to a clinic risk must not paint a safer picture. Agreeing that linkage alone always zeros residual fails by concept because presence is not effectiveness. Claiming residual may only increase when controls pass and failures never affect scoring fails by concept because failures should prevent unjustified residual reduction. Claiming controls and risks must never be linked fails by concept because linkage is required for informed residual—when results are honored. Exam caveat: CIS-RC residual credit requires effective controls, with failed results keeping residual honest. Operational check: link a failed control test to a risk, recalculate residual, confirm residual does not improve solely due to linkage, then remediate, retest to effective, and confirm residual may then decrease. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.