Chapter 42 — Security governance, risk and compliance: applied research
Lesson map
Lesson 42 published. Map, example, EX124.
flowchart TD
N0["Learning outcomes"]
N1["42.1 An applied question"]
N2["42.2 Method"]
N3["42.3 Critical reading"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX124"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["42.1 An applied question"]
N2["42.2 Method"]
N3["42.3 Critical reading"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX124"]
[Learning outcomes]
|
v
[42.1 An applied question]
|
v
[42.2 Method]
|
v
[42.3 Critical reading]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX124]
Learning outcomes
You will (1) frame an applied research question in GRC; (2) choose a method suited to an operating organisation; (3) review evidence critically.
42.1 An applied question
Nadia chooses an applied research question for her final year: does Ardwell's new practice of reporting expected loss ranges to the board change the decisions it makes compared with the old heat map? She narrows it to measurable terms: the number of risk treatment decisions per quarter, the time from proposal to decision and whether decisions follow the largest residual risks. She records that the study can describe changes but cannot fully separate the effect of reporting from other changes. The study's three measures are all countable from board minutes, which makes the comparison repeatable.
42.2 Method
She uses a before-and-after comparison of board minutes for four quarters before and four after the change, coding each decision with a codebook she pilots with a classmate. She also interviews two directors. Wohlin and colleagues (2012) describe threats to validity that she adapts: changes in board membership, a major incident that might prompt action and her own bias as someone who helped design the new pack. She records how each could affect results. Prof. Brenner adds that piloting the codebook with a classmate also reduces the risk that her own bias decides how decisions are coded.
42.3 Critical reading
Nadia reviews published evidence. Hubbard and Seiersen (2016) argue for quantitative methods, while Cox (2008) analyses weaknesses of risk matrices. Spears and Barki (2010) show that involving business users improves security risk management. She notes most sources are analytical or based on other settings, and few measure board decisions directly. Her study can add a small, honest piece of evidence from one cooperative, provided she reports its limits and avoids treating it as general proof. Her contribution is therefore described as local evidence from one organisation, not as a test of the published claims.
Worked example
Nadia frames a before-and-after study of board decisions, lists validity threats including her own bias and positions it against published evidence.
Synthetic case. The study is synthetic; cited works are real.
Errors and limits
Before-after designs confound timing. Minutes are incomplete records.
Exercises
- EX124 — Measured outcomes. Which outcomes does Nadia measure? Rubric: 3 = decisions per quarter, time to decision and alignment with largest risks;; 2 = three;; 1 = vague;; 0 = none.
- EX125 — Own bias. Why is Nadia's own role a validity threat? Rubric: 3 = she helped design the new pack;; 2 = bias;; 1 = vague;; 0 = none.
- EX126 — Evidence gap. What is missing from the published evidence? Rubric: 3 = direct measurement of board decisions;; 2 = gap;; 1 = vague;; 0 = none.
Synthesis
Applied GRC research needs measurable questions, explicit validity threats and modest claims.
Continue studying — chapter 42 of 50
← Chapter 41 (draft) · Course chapter index · Chapter 43 (draft) →