An illustration of the method, not a client engagement.
A high-security facility installs a biometric entry system. In operation it stops unauthorised access 95% of the time.
After a breach, investigators ask how people were enrolled and who reviewed the access logs. Neither was ever written into an audited procedure. The system worked; the reasoning behind it was never recorded.
Three documents: enrolment criteria tied to named threats, a schedule for log review with a named role, and a record of each review. None requires new hardware.
The money went on the equipment. The exposure was in the paperwork.
Confidential Risk Consulting