FRR021
Reassess finding severity against current exposure parameters at each status review, not solely by historical precedent.
CyberTRIZ analysis · Audit contradiction FRR021 · one of 8,235 worked contradictions published by CyberTRIZ.AI
Regulations
Finding Severity Consistency vs Changing Risk Exposure
Business ContextConsistent severity ratings allow findings to be compared across engagements and periods. The significance of the same control weakness can change as transaction volumes, external threats, regulations, dependencies, or business importance evolve.
Audit TRIZ ResolutionPreserve consistent rating dimensions while allowing current exposure parameters to determine severity. Findings are reassessed using present consequence, likelihood, control dependency, and risk conditions rather than historical precedent alone.
Applicable TRIZ Principles
Principle 35 – Parameter Changes adjusts severity according to current exposure characteristics.
Principle 3 – Local Quality incorporates the specific risk context of each finding.
Principle 23 – Feedback updates significance when risk conditions materially change.
Expected Outcome
More consistent rating logic
Better current-risk representation
Improved prioritization
More defensible severity decisions
Decision Indicators
Similar historical findings automatically receive identical ratings.
Severity remains unchanged after material changes in exposure.
Management challenges ratings because current context is ignored.
Different auditors apply contextual adjustments inconsistently.
Rating precedent outweighs present risk evidence.