Risk and Issue Updates¶
Example purpose¶
This artifact records how ES-113 monitoring changed the LMU/COICP risk picture.
Some risks were reduced because monitoring showed controls held. Other risks remain unchanged because known defects are still unresolved. One new evidence concern emerged from the Facilities / Residence Life handoff exercise.
Project¶
LMU Campus Operations and Incident Coordination Platform
Document control¶
| Field | Value |
|---|---|
| Artifact owner | LMU COICP Product Owner |
| Primary reviewers | Product engineer, Architecture Review Board chair, IT security reviewer, AI reviewer, Compliance reviewer |
| Status | Accepted with open risks carried forward |
| Last updated | 2026-07-06 |
| Related Engineering Stage | ES-113 — Monitoring and Operations |
| Project workspace target | docs/project-workspace/monitoring/risk_and_issue_updates.md |
Risk / issue register¶
| ID | Risk / Issue | Source | Change | Impact | Action | Owner | Status |
|---|---|---|---|---|---|---|---|
| OR-001 | Reviewers may treat environment as operational. | Operations | Reduced | Medium | Daily scope reminders worked; continue. | Product owner | Monitoring |
| OR-002 | Real or sensitive data may be entered. | Operations | Reduced | High | Synthetic dataset controls held; continue. | Compliance reviewer | Monitoring |
| OR-003 / DEF-003 | Evidence write failure behavior unresolved. | Testing / Release | Unchanged | High | Carry to Stewardship as release blocker. | Architecture Review Board | Open |
| OR-004 / DEF-002 | Access-control matrix incomplete. | Testing / Release | Unchanged | Medium | Complete role matrix before pilot. | IT security reviewer | Open |
| DEF-001 | Invalid status transition defect. | Testing | Unchanged | Medium | Fix and retest. | Product engineer | Open |
| MON-OBS-003 | Two handoff updates lacked expected evidence events. | Monitoring | New | High | Create stewardship improvement action. | Architecture Review Board | Open |
| MON-FB-002 | Closure rationale field needs examples. | Feedback | New | Medium | Add field guidance. | Product engineer | Open |
| MON-FB-004 | Emergency-boundary warning needs stronger language. | Campus Safety feedback | New | Medium | Revise warning language. | Product owner / Campus Safety | Open |
| AI-001 | AI Incident Summary accidentally enabled. | AI monitoring | Reduced | High | AI remained disabled. | AI reviewer | Monitoring |
| COMP-001 | Retention unresolved for real data. | Compliance review | Unchanged | High | No real data until resolved. | Compliance reviewer | Open |
Risks reduced¶
| Risk | Evidence |
|---|---|
| Scope confusion risk | Daily scope reminders and reviewer feedback showed review-only understanding. |
| Real/sensitive data risk | Spring Semester Synthetic Incident Dataset remained the only dataset. |
| AI accidental activation risk | AI Incident Summary remained disabled across all review days. |
Risks unchanged¶
| Risk | Reason |
|---|---|
| Evidence write failure behavior unresolved | No failure-path verification completed. |
| Access-control matrix incomplete | Monitoring confirmed reviewer access only, not full role matrix behavior. |
| Invalid status transition defect open | Defect still requires fix and retest. |
| Retention unresolved | Compliance still blocks real data. |
New monitoring issues¶
| Issue | Why It Matters |
|---|---|
| MON-OBS-003 — handoff evidence gaps | Handoff evidence is central to COICP’s accountability story. |
| MON-FB-002 — closure rationale needs examples | Closure quality depends on reviewer understanding. |
| MON-FB-004 — emergency-boundary wording needs strengthening | COICP must not be mistaken for dispatch or emergency workflow. |
Stewardship priority queue¶
- Fix evidence completeness for handoff updates.
- Verify evidence write failure behavior.
- Complete access-control matrix testing.
- Fix invalid status transition validation.
- Improve emergency-boundary warning language.
- Add closure rationale examples.
- Resolve retention before real-data discussion.
- Keep AI disabled until a future AI readiness cycle.
Risk update decision¶
The risk picture supports transition to Stewardship for structured learning and improvement planning.
It does not support operational pilot expansion.