Chapter 31 — Security governance, risk and compliance: implementation II
Lesson map
Lesson 31 published. Map, example, EX091.
flowchart TD
N0["Learning outcomes"]
N1["31.1 Rolling out the tooling"]
N2["31.2 Routine integration"]
N3["31.3 Exceptions"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX091"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["31.1 Rolling out the tooling"]
N2["31.2 Routine integration"]
N3["31.3 Exceptions"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX091"]
[Learning outcomes]
|
v
[31.1 Rolling out the tooling]
|
v
[31.2 Routine integration]
|
v
[31.3 Exceptions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX091]
Learning outcomes
You will (1) roll out a GRC capability across the organisation; (2) integrate controls into routine work; (3) manage exceptions formally.
31.1 Rolling out the tooling
With the broker running, Ardwell rolls out its ticketing-based GRC tooling. Each control becomes a recurring task assigned to its owner, with the control description, test steps and an evidence field. Nadia helps migrate eighty controls from spreadsheets, checking each for an owner and a frequency. Twelve controls have no clear owner, and three describe practices that no longer exist. Migration thus becomes a cleanup exercise, removing obsolete controls and assigning owners before the first cycle begins. Removing the three obsolete controls also means the first cycle does not produce misleading passes for practices no longer performed.
31.2 Routine integration
Controls work best when they fit existing routines. Nadia links the quarterly access review to the human resources reporting cycle, so reviewers receive current role lists. She schedules patch evidence collection to follow the monthly maintenance window. Owners receive reminders a week before tasks are due, and overdue tasks escalate to managers after five days. She learns that integration into routine work reduces the effort of compliance and makes evidence a by-product of operations rather than a separate burden. Linking evidence collection to the maintenance window means patch evidence is fresh when it is gathered.
31.3 Exceptions
Some controls cannot be applied everywhere. An old substation device cannot support current authentication. Nadia helps design an exception process: the owner requests an exception, states the risk and compensating controls, a manager approves it for a limited time and the exception appears in the risk register. Exceptions expire and must be renewed with fresh reasoning. She learns that unmanaged exceptions become hidden permanent gaps, while managed ones keep risk visible and decisions accountable. The old substation device, for instance, can stay in service under supervised access while its exception and expiry date remain visible.
Worked example
Nadia migrates eighty controls, finds twelve unowned and three obsolete, integrates tasks into routines and designs time-limited exceptions.
Synthetic case. Control counts and processes are synthetic.
Errors and limits
Reminders cause fatigue. Exceptions are often renewed by habit.
Exercises
- EX091 — Migration findings. What did the migration reveal? Rubric: 3 = twelve controls without owners and three obsolete;; 2 = cleanup;; 1 = vague;; 0 = none.
- EX092 — Escalation rule. When do overdue tasks escalate to managers? Rubric: 3 = after five days;; 2 = five days;; 1 = vague;; 0 = none.
- EX093 — Exception expiry. Why must exceptions expire? Rubric: 3 = to force fresh reasoning and keep risk visible;; 2 = renewal;; 1 = vague;; 0 = none.
Synthesis
Rollout succeeds when controls fit routines and exceptions remain visible and time-limited.
Continue studying — chapter 31 of 50
← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →