Chapter 22 — Security governance, risk and compliance: system and data models
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Core entities"]
N2["22.2 Relationships"]
N3["22.3 Answering questions"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Core entities"]
N2["22.2 Relationships"]
N3["22.3 Answering questions"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Core entities]
|
v
[22.2 Relationships]
|
v
[22.3 Answering questions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) model the entities of a GRC programme; (2) define relationships between risks, controls, obligations and evidence; (3) use the model to answer governance questions.
22.1 Core entities
Nadia designs a data model for Ardwell's programme. Its core entities are assets, risks, controls, obligations, tests, findings and owners. Each entity has defined attributes, such as a control's type, frequency and owner, or a finding's severity and due date. Defining entities clearly prevents the confusion common in spreadsheets, where one column might hold a risk in one row and a control in another. A clear model is the foundation for any governance tool, whether bought or built. Prof. Brenner notes that a defined finding entity with a due date, for instance, is what lets overdue items be counted automatically.
22.2 Relationships
The value lies in relationships. A risk affects assets and is treated by controls. A control satisfies obligations and is checked by tests. A test produces evidence and may raise findings, each owned by a person. Nadia draws these as a diagram and notes that many-to-many links are common: one control can treat several risks and satisfy several obligations. This explains why a single failed control can create findings across several audits, a pattern Ardwell's managers had noticed but not understood. The backup control, for example, may satisfy card, resilience and certification obligations at once, so one failure appears in three audits.
22.3 Answering questions
With the model, Nadia shows how to answer questions that used to take days. Which obligations depend on the backup control? Which risks are treated only by controls that failed their last test? Which owners hold overdue findings? She writes example queries in plain language and in pseudocode. Prof. Brenner notes that good models make governance questions cheap to answer, which encourages managers to ask them more often, strengthening oversight across the organisation. The question about controls that failed their last test is the kind the old spreadsheets could not answer at all.
Worked example
Nadia defines seven core entities, maps many-to-many relationships and shows queries that answer governance questions.
Synthetic case. The model is a teaching design; Ardwell's data are synthetic.
Errors and limits
Models simplify messy reality. Data quality limits query value.
Exercises
- EX064 — Entity list. Name four core entities in the model. Rubric: 3 = assets, risks, controls, obligations;; 2 = entities;; 1 = vague;; 0 = none.
- EX065 — Cascading findings. Why can one failed control create findings in several audits? Rubric: 3 = it satisfies several obligations;; 2 = many-to-many;; 1 = vague;; 0 = none.
- EX066 — Example query. Give one governance question the model answers quickly. Rubric: 3 = which risks rely only on controls that failed testing;; 2 = query;; 1 = vague;; 0 = none.
Synthesis
A clear data model of risks, controls, obligations and evidence makes governance questions answerable.
Continue studying — chapter 22 of 50
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →