Chapter 43 — Industry or public-service practice
Lesson map
Lesson 43 published. Map, example, EX127.
flowchart TD
N0["Learning outcomes"]
N1["43.1 Placement"]
N2["43.2 Audit and regulator"]
N3["43.3 Reflection"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX127"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["43.1 Placement"]
N2["43.2 Audit and regulator"]
N3["43.3 Reflection"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX127"]
[Learning outcomes]
|
v
[43.1 Placement]
|
v
[43.2 Audit and regulator]
|
v
[43.3 Reflection]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX127]
Learning outcomes
You will (1) work within a real governance function; (2) observe audits and regulator interactions; (3) reflect on practice versus theory.
43.1 Placement
Nadia spends a semester on placement in Ardwell's governance team. She supports preparation for the cooperative's first certification audit against ISO/IEC 27001:2022, helping owners assemble evidence and checking the statement of applicability against actual practice. She finds that some controls work well but are poorly documented, while others are documented well but rarely performed. She learns that audits test the link between documents and practice, and that the link is often weaker than managers think. The controls performed but undocumented, for example, need only writing up, while those documented but not performed need real work.
43.2 Audit and regulator
She observes the stage one audit, in which the certification body reviews documentation and readiness. Auditors ask how risk acceptance decisions are made and who approves them. Ardwell's answer is clear because of the earlier work on decision records. Later, she sits in on a meeting with the energy regulator about incident reporting expectations. She notes how regulators focus on outcomes such as restoration times and communication, while certification focuses on management system processes. The decision records from chapter 18 thus pay off directly when auditors ask who approves risk acceptance.
43.3 Reflection
Nadia writes a reflection comparing practice with her coursework. Theory presented controls as neatly designed and tested; practice involved negotiation, competing deadlines and incomplete data. Yet the theory helped: data models, testable requirements and sampling gave her tools to bring order to messy situations. She also learns the value of relationships, since owners cooperated more readily once they understood the reasons behind requests. Prof. Brenner notes that reflective practice turns experience into transferable knowledge. Owners asked to supply evidence for the audit, for instance, responded faster once she explained which requirement each item supported.
Worked example
Nadia supports certification readiness, observes stage one audit and regulator meetings and reflects on theory versus practice.
Synthetic case. The placement, audit and meetings are synthetic; ISO/IEC 27001:2022 is real.
Errors and limits
One placement is one context. Observations can be selective.
Exercises
- EX127 — Document gap. What gap did Nadia find between documents and practice? Rubric: 3 = some controls work but are undocumented, others documented but rarely done;; 2 = mismatch;; 1 = vague;; 0 = none.
- EX128 — Stage one focus. What did auditors ask about in stage one? Rubric: 3 = how risk acceptance decisions are made and approved;; 2 = acceptance;; 1 = vague;; 0 = none.
- EX129 — Regulator focus. How did the regulator's focus differ from certification? Rubric: 3 = outcomes like restoration and communication versus processes;; 2 = outcomes;; 1 = vague;; 0 = none.
Synthesis
Placement shows how theory helps bring order to messy practice and how relationships enable governance.
Continue studying — chapter 43 of 50
← Chapter 42 (draft) · Course chapter index · Chapter 44 (draft) →