Chapter 7 — Security governance, risk and compliance: organizational integration

Lesson map

Lesson 07 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Procurement integration"]
  N2["7.2 Lines of responsibility"]
  N3["7.3 Managing change"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Procurement integration"]
  N2["7.2 Lines of responsibility"]
  N3["7.3 Managing change"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]

[Learning outcomes]
    |
    v
[7.1 Procurement integration]
    |
    v
[7.2 Lines of responsibility]
    |
    v
[7.3 Managing change]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) integrate supplier tiering into procurement and risk; (2) align three lines of responsibility; (3) manage change across departments.

7.1 Procurement integration

Daniel works with procurement to embed tiering in the purchasing process. A short intake form now asks about data access, criticality and connectivity before any contract. The answers set the tier automatically, and high-tier suppliers cannot be approved without a completed security review. He learns that integration works when governance steps sit inside existing workflows, at the point where decisions are made, rather than in a separate process that staff must remember to start. Because the tier is set at intake, a high-tier supplier can no longer reach contract signature without the security review having started.

7.2 Lines of responsibility

Halbrook uses a model in which business units own and manage risk, a risk and compliance function oversees and challenges, and internal audit provides independent assurance. Daniel clarifies each line's role in supplier risk: procurement and business owners manage, his team sets methods and challenges, and internal audit tests the process annually. He learns that confusion between lines, such as the risk team performing reviews it should challenge, weakens assurance and blurs accountability. Before the change, his team had run some supplier reviews itself, which left no one independent to challenge them.

7.3 Managing change

Some business units resist tiering because high-tier reviews delay contracts. Daniel meets them, explains the reasons and offers early engagement so reviews start before contracts are urgent. He also publishes review times so units can plan. Resistance falls. He learns that change succeeds when people see the reasons, receive practical help and have their legitimate concerns, such as deadlines, addressed rather than dismissed as obstruction. Publishing the review times also gives his team a measure that business units can hold it to, which builds trust in the new process.

Worked example

Daniel embeds tiering in procurement, clarifies three lines of responsibility and reduces resistance through early engagement and published timings.

Synthetic case. Processes are synthetic.

Errors and limits

Intake forms can be gamed. Lines models vary across organisations.

Exercises

• EX031 — Intake gate. What prevents high-tier suppliers being approved without review?
  Show marking criteria

  Rubric: 3 = the procurement intake sets tier and blocks approval;; 2 = gate;; 1 = vague;; 0 = none.
• EX032 — First line. Who manages supplier risk in the first line?
  Show marking criteria

  Rubric: 3 = procurement and business owners;; 2 = owners;; 1 = audit;; 0 = none.
• EX033 — Line confusion. What weakens assurance between lines?
  Show marking criteria

  Rubric: 3 = the risk team performing reviews it should challenge;; 2 = confusion;; 1 = vague;; 0 = none.
• EX034 — Resistance cause. Why did some units resist tiering?
  Show marking criteria

  Rubric: 3 = high-tier reviews delayed contracts;; 2 = delay;; 1 = vague;; 0 = none.
• EX035 — Resistance fix. How was resistance reduced?
  Show marking criteria

  Rubric: 3 = early engagement and published review times;; 2 = engagement;; 1 = vague;; 0 = none.

Synthesis

Integration places governance steps inside workflows and respects clear lines of responsibility.

Continue studying — chapter 07 of 12

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →