Volatility, and the risk it brings

What the draft means by volatility

How quickly the data goes stale, which is why a data set stops suiting the current analysis and why an audit trail can lose its integrity. The definition sits in clause 3.1.20 and the risk it brings is described in the public clause 5.2, with the paired threats and controls in clause 6.5.

The risk the draft names

Data kept because storage is cheap, an audit trail whose timestamps no longer line up with the decision it explains, and a retention rule that has drifted from the analysis it serves.

What to check in the estate

Reconcile the retention schedule with the audit trail. If the trail outlives or underlives the data it explains, one of them is wrong. Test deletion for a completed period and keep the evidence. Ask what still needs the data after the analysis closes.

What an auditor samples for volatility

• Retention schedule
• Audit trail configuration
• Reconciliation note
• Deletion evidence for a closed period

These are the artefacts that show the characteristic is managed, not only named. Name them before the audit, because an evidence list written afterwards is a description of what happened, not a control.

The definition in this draft

The first draft treated volatility as a retention question. This draft defines it as how quickly the data changes, and moves the storage question into the risk.

The clause behind the pairing is clause 6.5, and the definition is term 3.1.20. The wider change table is on the changes page.

Buy the kit, USD 799See the five free rows