ACCA Strategic Professional · Strategic Business Leader · Cloud, mobile and smart technology
Orrin Health plans a mobile app letting patients view test results. A non-executive director notes that the board's governance responsibilities include ensuring that mobile business risks are overseen. Management proposes launching quickly, with security testing after release, because competitors are already live. Which response best reflects sound governance and risk management?
The board should require security and privacy risk assessment and testing before launch, with results reported against risk appetite. Health data is sensitive, so post-release testing exposes patients and the company to avoidable harm, while delegating to developers or abandoning the feature avoids accountable, proportionate risk management.
- AAccept the proposal because speed to market outweighs all other considerations
- BRequire security and privacy risk assessment and testing before launch, with the risk reported to the board and aligned to risk appetite for sensitive health dataCorrect
- CDelegate the decision entirely to the app developers
- DLaunch without the results feature to avoid any data risk, and never add it
Explanation
Health data is highly sensitive, so risk should be assessed and tested before exposure, with board oversight against its stated risk appetite. Testing afterwards exposes patients to preventable harm and regulatory breach. Delegating to developers removes accountability, and permanently abandoning the feature is an over-reaction that ignores mitigation.
Did you get it right without looking?
One question tells you little. A timed set on Cloud, mobile and smart technology shows your real accuracy, how long you take and where you lose marks.
More Cloud, mobile and smart technology questions
- Harbour Logistics, a regional freight firm, replaces its in-house servers with a provider's platform where it rents virtual machines, storag…
- Marlow Retail launches a mobile app that lets customers order, pay and receive personalised offers based on their location. The board wants …
- Harbor Legal LLP, a mid-sized law firm, wants to stop running its own email, document management and practice-billing software. It wants sta…
- Brightwell Hospital Group plans to move patient records to a public cloud provider based in another country. The board is worried that it ma…
- Verano Retail uses in-store beacons that detect shoppers' phones and send personalised offers. Management is concerned about customer reacti…
- Verdant Retail has 40 stores with highly seasonal demand. Its board wants to move its e-commerce platform to a public cloud mainly to avoid …