Chapter 34 — Comparative project

Chapter 34 — Comparative project

Lesson map

Lesson 34 published. Map, example, EX100.

flowchart TD
  N0["Learning outcomes"]
  N1["34.1 Two organisations"]
  N2["34.2 Fair criteria"]
  N3["34.3 Findings"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX100"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["34.1 Two organisations"]
  N2["34.2 Fair criteria"]
  N3["34.3 Findings"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX100"]

[Learning outcomes]
    |
    v
[34.1 Two organisations]
    |
    v
[34.2 Fair criteria]
    |
    v
[34.3 Findings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX100]

Learning outcomes

You will (1) compare governance approaches across organisations; (2) choose fair comparison criteria; (3) avoid misleading league tables.

34.1 Two organisations

Sofia compares Elmfield with a second fictional organisation, Corbridge Community Trust, a charity of similar size. Both agree to share anonymised summaries of their governance practices. Corbridge uses a managed service provider for IT and security, while Elmfield has an in-house IT lead. Sofia wants to understand how the different models affect governance: who owns risks, how evidence is gathered and how boards are informed. Using anonymised summaries lets both organisations share honestly without exposing staff names or specific weaknesses.

34.2 Fair criteria

Sofia chooses criteria that make sense for both: existence of an approved risk appetite, register review frequency, access review completion, backup testing and board reporting. She avoids comparing raw incident counts, because reporting cultures differ: a higher count may reflect better reporting rather than worse security. She learns that comparisons must account for context and measurement differences, or they will mislead the very people they aim to inform. Register review frequency, for example, can be compared directly because both organisations keep a dated register.

34.3 Findings

Corbridge has stronger technical monitoring through its provider but weaker ownership, since staff assume the provider handles everything. Elmfield has clearer ownership but less monitoring. Sofia presents these as complementary lessons rather than a ranking. She recommends that Elmfield consider buying monitoring services while keeping in-house ownership, and that Corbridge clarify which risks remain its own. Both organisations find the comparison useful because it avoided judging one as better. Dr. Haddad notes that Corbridge's provider model shows ownership cannot be outsourced even when operations are.

Worked example

Sofia compares two organisations on five fair criteria, avoids raw incident counts and presents complementary lessons.

Synthetic case. Both organisations are synthetic.

Errors and limits

Two cases cannot generalise. Shared summaries may be optimistic.

Exercises

• EX100 — Model difference. How do the two organisations' IT models differ? Rubric: 3 = managed service provider versus in-house IT lead;; 2 = models;; 1 = vague;; 0 = none.
• EX101 — Incident counts. Why avoid comparing raw incident counts? Rubric: 3 = reporting cultures differ;; 2 = culture;; 1 = vague;; 0 = none.
• EX102 — Corbridge weakness. What weakness did Corbridge show? Rubric: 3 = weak ownership because staff assume the provider handles everything;; 2 = ownership;; 1 = vague;; 0 = none.

Synthesis

Fair comparisons use context-aware criteria and yield lessons rather than rankings.

Continue studying — chapter 34 of 40

← Chapter 33 (draft) · Course chapter index · Chapter 35 (draft) →