Chapter 3 — Authorized practice and evidence handling

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Authority"]
  N2["3.2 Evidence handling"]
  N3["3.3 Conflicts"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Authority"]
  N2["3.2 Evidence handling"]
  N3["3.3 Conflicts"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Authority]
    |
    v
[3.2 Evidence handling]
    |
    v
[3.3 Conflicts]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) work within authority and confidentiality limits; (2) handle evidence securely; (3) avoid conflicts in assurance work.

3.1 Authority

In her new role, Lena can request evidence from any department, but she cannot change systems or approve exceptions herself. She learns to confirm her authority before acting, especially when asked to look at member data. Marston's internal policy allows GRC staff to access member data only when needed for a specific review, with approval and logging. She learns that respecting these limits protects members and keeps her work defensible. When a review needs member data, she now files the approval reference with her evidence so the access can be justified afterwards.

3.2 Evidence handling

Lena collects evidence such as access review sign-offs, system reports and test results. She stores it in a restricted folder, names files consistently with date and source, and records where each item came from. She removes member details that are not needed. She learns that evidence must be complete enough to support conclusions, protected from alteration and handled according to its sensitivity, especially when it contains personal or financial information. For an access review sign-off, she records the system it came from and the date it was exported, so another reviewer could obtain the same file.

3.3 Conflicts

Lena previously wrote Marston's data protection procedures. Now she is asked to assess whether they work. Mr. Reyes points out the conflict: she may be inclined to see her own work favourably. She discloses the conflict and asks a colleague to review that area. She learns that in assurance work, independence matters, and that disclosing and managing conflicts is better than pretending they do not exist. The colleague's review of the data protection procedures is then reported under the colleague's name, not Lena's.

Worked example

Lena confirms her authority before accessing data, handles evidence securely and discloses a conflict in assessing her own procedures.

Synthetic case. Policies and roles are synthetic.

Errors and limits

Independence is relative in small teams. Evidence handling takes time.

Exercises

• EX011 — Lena's limits. What can Lena not do in her role?
  Show marking criteria

  Rubric: 3 = change systems or approve exceptions;; 2 = limits;; 1 = vague;; 0 = none.
• EX012 — Member data access. When may GRC staff access member data?
  Show marking criteria

  Rubric: 3 = only when needed for a specific review, with approval and logging;; 2 = need;; 1 = always;; 0 = none.
• EX013 — Evidence protection. What protections apply to evidence?
  Show marking criteria

  Rubric: 3 = restricted folder, consistent names, source records, minimised data;; 2 = protection;; 1 = vague;; 0 = none.
• EX014 — Conflict found. What conflict did Lena have?
  Show marking criteria

  Rubric: 3 = assessing procedures she wrote;; 2 = self-review;; 1 = vague;; 0 = none.
• EX015 — Conflict response. How did Lena manage the conflict?
  Show marking criteria

  Rubric: 3 = disclosed it and asked a colleague to review;; 2 = disclose;; 1 = ignore;; 0 = none.

Synthesis

Authorised, secure and independent practice makes GRC evidence trustworthy.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →