FRR018
Quantify expected risk reduction against remediation cost using existing capabilities before approving any new investment in corrective action.
CyberTRIZ analysis · Audit contradiction FRR018 · one of 8,235 worked contradictions published by CyberTRIZ.AI
Regulations
Remediation Cost vs Risk Reduction
Business ContextCorrective actions can require new technology, additional personnel, process redesign, external expertise, or stronger controls. High-cost remediation may reduce exposure substantially, but organizations can also spend heavily correcting risks whose consequences do not justify the investment.
Audit TRIZ ResolutionDesign remediation around the mechanism creating the exposure rather than the scale of the proposed investment. Existing resources, process simplification, control redesign, automation, and removal of harmful functions should be evaluated before additional resources are added.
Applicable TRIZ Principles
Principle 2 – Taking Out removes unnecessary risk-generating activities or control complexity.
Principle 22 – Blessing in Disguise uses existing failures and exceptions as information for redesign.
Principle 25 – Self-Service uses existing system and process resources to perform corrective functions where possible.
Expected Outcome
Greater risk reduction
Lower remediation cost
Better use of existing resources
Improved corrective-action efficiency
Decision Indicators
Significant findings automatically generate major investment requests.
Remediation cost is not compared with expected risk reduction.
Existing capabilities are overlooked when corrective actions are designed.
Expensive solutions address symptoms rather than causes.
Management delays important remediation because proposed solutions are unaffordable.