Chapter 19 — Security governance, risk and compliance: scope and theory
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Definitions"]
N2["19.2 Scope"]
N3["19.3 Theory"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Definitions"]
N2["19.2 Scope"]
N3["19.3 Theory"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 Definitions]
|
v
[19.2 Scope]
|
v
[19.3 Theory]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) define governance, risk management and compliance; (2) set the scope of a GRC programme; (3) explain key theory behind risk management.
19.1 Definitions
Sofia now begins the GRC courses. Governance means direction and oversight: who decides what level of risk is acceptable and how performance is checked. Risk management means identifying, analysing, evaluating and treating risks, a process ISO 31000:2018 describes in general terms for any organisation. Compliance means meeting obligations from law, contracts and adopted standards. She learns that the three support each other: governance sets direction, risk management informs decisions and compliance confirms obligations are met. At Elmfield, for example, the board's appetite sets direction, the register informs the director and the statement of applicability later shows compliance.
19.2 Scope
Elmfield must decide what its programme covers. Sofia proposes a scope including all staff, devices, cloud services and suppliers that handle tenant data, plus the board portal. Excluded items, such as tenants' own devices, are listed with reasons. ISO/IEC 27001:2022 requires a defined scope for the management system, and she learns that clear scope prevents both gaps and wasted effort. A scope that is too narrow misses risks; one too broad cannot be managed with Elmfield's resources. Dr. Haddad asks why tenants' own devices are excluded, and Sofia answers that Elmfield cannot control them but can limit what the tenant portal exposes.
19.3 Theory
Sofia reads about risk theory. Risk combines uncertainty about events with their consequences for objectives. Treatment options include avoiding, reducing, sharing and accepting risk. Cox (2008) shows that simple matrices can rank risks poorly, while Hubbard and Seiersen (2016) argue for quantitative estimates even with limited data. She learns that theory warns against false precision and false simplicity alike, and that small organisations should choose methods they can apply consistently and explain to their boards. Her later lab comparing matrix scores with expected loss tests exactly this warning on Elmfield's own risks.
Worked example
Sofia defines the three disciplines, proposes Elmfield's scope with exclusions and reviews core risk theory and treatment options.
Synthetic case. Elmfield's scope is synthetic; ISO 31000:2018, ISO/IEC 27001:2022, Cox (2008) and Hubbard and Seiersen (2016) are real.
Errors and limits
Definitions vary by source. Scope decisions need review.
Exercises
- EX055 — Discipline roles. How do the three disciplines support each other? Rubric: 3 = governance sets direction, risk informs decisions, compliance confirms obligations;; 2 = roles;; 1 = vague;; 0 = none.
- EX056 — Excluded item. What item was excluded from scope? Rubric: 3 = tenants' own devices;; 2 = tenant devices;; 1 = vague;; 0 = none.
- EX057 — Treatment options. List the four treatment options. Rubric: 3 = avoid, reduce, share, accept;; 2 = four;; 1 = vague;; 0 = none.
Synthesis
Clear definitions, scope and theory form the foundation of a GRC programme.
Continue studying — chapter 19 of 40
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →