Chapter 26 — Security governance, risk and compliance: architecture alternatives
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Alternatives"]
N2["26.2 Criteria and weights"]
N3["26.3 The choice"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Alternatives"]
N2["26.2 Criteria and weights"]
N3["26.3 The choice"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Alternatives]
|
v
[26.2 Criteria and weights]
|
v
[26.3 The choice]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) compare alternative architectures for a GRC capability; (2) weigh criteria transparently; (3) document the choice and its risks.
26.1 Alternatives
Ardwell must decide how to run its GRC programme day to day. Nadia compares three alternatives. The first keeps spreadsheets and shared folders, improved with validation scripts. The second buys a commercial governance platform that holds risks, controls and evidence in one place. The third builds light tooling on Ardwell's existing ticketing system, where controls become recurring tasks and evidence attaches to tickets. Each has different costs, skills needs and risks of failure. Spreadsheets cost least to start but depend on validation scripts that someone must maintain.
26.2 Criteria and weights
Nadia agrees criteria with the security manager: data integrity and audit trail, effort for control owners, reporting to the board, cost over three years and dependence on scarce skills. She weights integrity and owner effort highest. Spreadsheets score poorly on integrity. The commercial platform scores well on reporting but needs a specialist administrator. The ticketing option scores well on owner effort because staff already use the system. She publishes the scores and weights so reviewers can challenge them. Weighting owner effort highly reflects the earlier finding that controls fail when owners lack time.
26.3 The choice
The ticketing option wins narrowly over the platform. Nadia documents the decision with its alternatives and accepted risks: reporting will need extra work, and the ticketing vendor's roadmap could change. She recommends reviewing the choice after a year using measures such as overdue control tasks and time to prepare audit evidence. She notes that the close result means the weights matter, and records that a different weighting favouring board reporting would have chosen the platform instead. Recording the alternative weighting lets the board see the choice was close and revisit it if reporting becomes the priority.
Worked example
Nadia compares three GRC tooling options on weighted criteria, chooses the ticketing approach narrowly and records the sensitivity to weights.
Synthetic case. Options, scores and costs are synthetic.
Errors and limits
Weights reflect opinion. Vendor claims need verification.
Exercises
- EX076 — Three options. What are the three alternatives? Rubric: 3 = spreadsheets with scripts, commercial platform, ticketing-based tooling;; 2 = three;; 1 = vague;; 0 = none.
- EX077 — Heaviest criteria. Which criteria received the highest weights? Rubric: 3 = data integrity and owner effort;; 2 = integrity;; 1 = cost;; 0 = none.
- EX078 — Sensitivity note. What would a weighting favouring board reporting have chosen? Rubric: 3 = the commercial platform;; 2 = platform;; 1 = spreadsheets;; 0 = none.
Synthesis
Transparent criteria and sensitivity notes make architecture choices defensible.
Continue studying — chapter 26 of 50
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →