Chapter 11 — Applied project

Chapter 11 — Applied project

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Project scope"]
  N2["11.2 Results"]
  N3["11.3 Handover"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Project scope"]
  N2["11.2 Results"]
  N3["11.3 Handover"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Project scope]
    |
    v
[11.2 Results]
    |
    v
[11.3 Handover]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) deliver an applied GRC improvement; (2) measure results against objectives; (3) document for handover.

11.1 Project scope

Daniel's applied project brings together his work: quantified risk reporting for the board, supplier tiering and appetite in exceedance terms. Over six months he rolls out tiering to all three hundred suppliers, introduces loss exceedance reporting for the top ten cyber scenarios and trains six estimators in calibration. Objectives include halving average review time, completing deep reviews for all high-tier suppliers and presenting scenarios in financial terms at every board meeting. Each objective is measurable, so the results section can report it as met, partly met or missed.

11.2 Results

After six months, average review time fell from about thirty-nine to twenty-four days, close to the objective. All forty-two high-tier suppliers have completed deep reviews, revealing three with significant exceptions now under remediation. The board receives quantified scenarios each quarter and has approved two treatments. Calibration tests show estimators' ranges capturing true answers more often after training. Daniel reports one objective, halving review time, as nearly but not fully met. The three suppliers with significant exceptions show that deep reviews found problems the old questionnaires had missed.

11.3 Handover

Daniel documents methods, tools, estimator guidance and the tiering rules, and trains a colleague to run the process. He records known limitations: estimates depend on a small group of experts, and loss data are sparse. He recommends collecting internal incident cost data to improve future estimates. He learns that applied projects create lasting value only when others can continue them, and that honest reporting of partly met objectives builds credibility. Recording the reliance on a small expert group warns his successor where the estimates are most fragile.

Worked example

Daniel rolls out tiering and quantified reporting, nearly halves review time, completes forty-two deep reviews and hands over with documented limits.

Synthetic case. Results are synthetic.

Errors and limits

Six months is short. Calibration gains can fade.

Exercises

• EX051 — Review time result. How did average review time change? Rubric: 3 = from about thirty-nine to twenty-four days;; 2 = nearly halved;; 1 = vague;; 0 = none.
• EX052 — High-tier reviews. How many high-tier suppliers completed deep reviews? Rubric: 3 = forty-two;; 2 = 42;; 1 = vague;; 0 = none.
• EX053 — Exceptions found. How many high-tier suppliers had significant exceptions? Rubric: 3 = three;; 2 = 3;; 1 = vague;; 0 = none.
• EX054 — Partly met. Which objective was only nearly met? Rubric: 3 = halving review time;; 2 = review time;; 1 = vague;; 0 = none.
• EX055 — Data recommendation. What data does Daniel recommend collecting? Rubric: 3 = internal incident cost data;; 2 = incident costs;; 1 = vague;; 0 = none.

Synthesis

Applied projects succeed when results are measured honestly and work is handed over.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →