APC028
Require written evidence and rationale for every material override of the standardised risk model to keep professional judgment auditable.
CyberTRIZ analysis · Audit contradiction APC028 · one of 8,235 worked contradictions published by CyberTRIZ.AI
Regulations
Risk Model Standardization vs Professional Judgment
Business ContextStandardized scoring models improve consistency and make prioritization easier to explain. Audit risks, however, often contain contextual factors that cannot be represented adequately through predefined numerical criteria. Excessive model reliance can produce precise rankings that do not reflect actual assurance need.
Audit TRIZ ResolutionUse standardized models as a common analytical baseline while creating controlled mechanisms for professional adjustment. Material overrides require documented evidence and rationale, allowing judgment to correct model limitations without turning prioritization into an arbitrary process.
Applicable TRIZ Principles
Principle 6 – Universality provides a common assessment structure across the audit universe.
Principle 3 – Local Quality incorporates risk characteristics specific to individual areas.
Principle 23 – Feedback compares model predictions with actual audit results to improve future assessments.
Expected Outcome
Greater prioritization consistency
Preserved professional judgment
Better risk differentiation
More defensible audit selection
Decision Indicators
Audit teams follow numerical rankings despite contradictory evidence.
Professional overrides occur frequently without documentation.
Similar risk scores conceal materially different exposures.
Experienced auditors consider formal rankings operationally unrealistic.
Audit results repeatedly reveal weaknesses in low-ranked areas.