Chapter 21 — Security governance, risk and compliance: system models
Lesson map
Lesson 21 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["21.1 Roles and processes"]
N2["21.2 RACI"]
N3["21.3 Fixing gaps"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["21.1 Roles and processes"]
N2["21.2 RACI"]
N3["21.3 Fixing gaps"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX061"]
[Learning outcomes]
|
v
[21.1 Roles and processes]
|
v
[21.2 RACI]
|
v
[21.3 Fixing gaps]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) model Elmfield's governance system as roles, processes and information flows; (2) identify accountability gaps; (3) use a RACI chart.
21.1 Roles and processes
Sofia models Elmfield's governance as a system of roles and processes. The board approves risk appetite and receives reports. The director is accountable for the programme. The IT lead runs technical controls. Team managers own risks in their areas. A part-time data protection lead handles privacy. Processes link them: risk review, policy approval, incident handling and access review. Drawing the model shows who passes information to whom and where decisions are made. The drawing shows, for instance, that team managers own risks but have no defined route for reporting them to the board.
21.2 RACI
Sofia builds a responsibility chart listing who is responsible, accountable, consulted and informed for each process. For access review, managers are responsible, the director is accountable, IT is consulted and the board is informed. She finds two problems. No one is accountable for supplier security, and incident handling has three people marked accountable, which means in practice no one is. COBIT 2019 uses similar responsibility mapping to clarify governance and management roles. Dr. Haddad points out that the supplier gap matters most because the repairs contractor connects remotely to the housing system.
21.3 Fixing gaps
Sofia proposes that the director be accountable for supplier security, with the finance manager responsible for contracts and the IT lead consulted. For incidents, the IT lead becomes accountable, with the data protection lead responsible for breach notifications. The board approves the chart. She learns that accountability must rest with one role per process, and that charts are only useful if people know about them and they are reviewed when roles change. A review whenever roles change would, for example, have caught the three accountable names for incident handling earlier.
Worked example
Sofia models Elmfield's governance roles and processes, finds two accountability gaps with a RACI chart and fixes them.
Synthetic case. Roles and chart are synthetic; COBIT 2019 is real.
Errors and limits
Charts describe intended roles, not behaviour. Small teams blur roles.
Exercises
- EX061 — RACI letters. What do the four RACI letters mean? Rubric: 3 = responsible, accountable, consulted, informed;; 2 = four;; 1 = vague;; 0 = none.
- EX062 — Incident problem. What was wrong with incident handling? Rubric: 3 = three people accountable meant no one was;; 2 = too many;; 1 = vague;; 0 = none.
- EX063 — Accountability rule. How many roles should be accountable per process? Rubric: 3 = one;; 2 = single;; 1 = several;; 0 = none.
Synthesis
System models and RACI charts make accountability clear and reveal gaps.
Continue studying — chapter 21 of 40
← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →