Chapter 32 — Security governance, risk and compliance: interdisciplinary interfaces

Lesson map

Lesson 32 published. Map, example, EX094.

flowchart TD
  N0["Learning outcomes"]
  N1["32.1 Legal"]
  N2["32.2 Finance and HR"]
  N3["32.3 Conflicting priorities"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX094"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["32.1 Legal"]
  N2["32.2 Finance and HR"]
  N3["32.3 Conflicting priorities"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX094"]

[Learning outcomes]
    |
    v
[32.1 Legal]
    |
    v
[32.2 Finance and HR]
    |
    v
[32.3 Conflicting priorities]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX094]

Learning outcomes

You will (1) work with legal, finance and HR on governance; (2) translate between professional languages; (3) handle conflicting priorities.

32.1 Legal

Sofia works with Elmfield's external solicitor on data sharing agreements with councils. The solicitor focuses on lawful basis and liability; Sofia focuses on security controls and evidence. They agree a template that covers both. She learns that GRC staff should not give legal advice but must understand legal requirements well enough to ask the right questions and translate them into controls. The boundary between legal and security roles needs to be clear and respected. In the council agreements, the solicitor sets the lawful basis while Sofia specifies controls such as encryption in transit.

32.2 Finance and HR

Finance cares about cost, insurance and fraud; HR cares about fair treatment of staff and accurate records. Sofia learns to frame security in their terms. For finance, she presents controls as reducing expected loss and insurance premiums. For HR, she presents the leaver process as protecting former staff from misuse of their accounts as well as protecting tenants. Framing in each discipline's language increases cooperation without changing the substance of the controls. For finance, the size of a fake invoice payment is a familiar loss to weigh against the cost of payment approval controls.

32.3 Conflicting priorities

Conflicts arise. Housing managers want staff to work quickly from anywhere; IT wants tighter device controls. Sofia facilitates a meeting where each side explains its concerns. They agree that managed devices may work from anywhere, while personal devices get access to email only. She learns that conflicts are best resolved by understanding underlying needs and agreeing a documented compromise, which the director approves as a risk decision with a review date. The review date lets the compromise on personal devices be revisited if email-only access proves too restrictive.

Worked example

Sofia co-writes a data sharing template with legal, frames controls for finance and HR and mediates a device conflict.

Synthetic case. The collaborations are synthetic.

Errors and limits

Translation can oversimplify. Compromises may drift.

Exercises

• EX094 — Legal boundary. What should GRC staff not do in legal matters?
  Show marking criteria

  Rubric: 3 = give legal advice;; 2 = advice;; 1 = vague;; 0 = none.
• EX095 — HR framing. How did Sofia frame the leaver process for HR?
  Show marking criteria

  Rubric: 3 = protecting former staff from account misuse;; 2 = fairness;; 1 = vague;; 0 = none.
• EX096 — Device compromise. What compromise was agreed for devices?
  Show marking criteria

  Rubric: 3 = managed devices anywhere, personal devices email only;; 2 = compromise;; 1 = vague;; 0 = none.

Synthesis

GRC work depends on translating between disciplines and documenting compromises.

Continue studying — chapter 32 of 40

← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →