Chapter 12 — Practice portfolio and final review
Lesson map
Lesson 12 published. Map, example, EX056.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Portfolio"]
N2["12.2 Final review"]
N3["12.3 Next steps"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX056"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Portfolio"]
N2["12.2 Final review"]
N3["12.3 Next steps"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX056"]
[Learning outcomes]
|
v
[12.1 Portfolio]
|
v
[12.2 Final review]
|
v
[12.3 Next steps]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX056]
Learning outcomes
You will (1) assemble a practice portfolio; (2) reflect on competence gained; (3) plan next steps in GRC practice.
12.1 Portfolio
Lena assembles her portfolio: the stakeholder map and purpose statement, the mobile app risk assessment, the self-assessment comparison, the findings workflow and ageing analysis, the sampled control test, the board report and the supplier report review. For each she writes a short note on what she did, what evidence supports it and what she learned. She removes any real member or staff data, keeping only synthetic or anonymised material. Each note links an artefact to the chapter in which it was produced, so assessors can trace her reasoning.
12.2 Final review
Mr. Reyes and a second assessor review the portfolio. They ask how she would handle a regulator questioning her sample size; she explains the tolerable rate and confidence and offers to extend the sample if needed. They ask what she found hardest; she says resisting pressure to soften reports while keeping good relationships. They judge her competent and note her strength in linking evidence to conclusions. The sample-size question shows why she recorded the tolerable rate and confidence when she ran the test in chapter 7.
12.3 Next steps
Lena plans her next steps: take on supplier risk ownership at Marston, deepen her knowledge of ISO/IEC 27001:2022 to support a possible certification and mentor a junior colleague in evidence handling. She commits to reviewing her methods yearly as standards and threats change. Mr. Reyes reminds her that GRC practice depends on judgement, honesty and steady follow-through as much as on frameworks. Taking on supplier risk ownership also closes the governance gap she identified in the peer credit union case.
Worked example
Lena assembles a seven-item portfolio, answers assessors on sampling and pressure and plans her next steps.
Synthetic case. The portfolio is synthetic; ISO/IEC 27001:2022 is real.
Errors and limits
Portfolios show selected work. Plans change with roles.
Exercises
- EX056 — Portfolio note. What note accompanies each portfolio item? Rubric: 3 = what she did, supporting evidence, what she learned;; 2 = note;; 1 = vague;; 0 = none.
- EX057 — Data in portfolio. What data did Lena remove from the portfolio? Rubric: 3 = real member or staff data;; 2 = real data;; 1 = vague;; 0 = none.
- EX058 — Sample challenge. How would Lena answer a regulator questioning her sample size? Rubric: 3 = explain tolerable rate and confidence, offer to extend;; 2 = explain;; 1 = vague;; 0 = none.
- EX059 — Hardest part. What did Lena find hardest? Rubric: 3 = resisting pressure to soften reports while keeping relationships;; 2 = pressure;; 1 = vague;; 0 = none.
- EX060 — Next role. Which ownership will Lena take on next? Rubric: 3 = supplier risk ownership;; 2 = supplier work in general, without risk ownership;; 1 = vague;; 0 = none.
Synthesis
A practice portfolio demonstrates competence and sets direction for continuing GRC practice.
Continue studying — chapter 12 of 12
← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →