Chapter 6 — Security governance, risk and compliance: operational workflow

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Findings workflow"]
  N2["6.2 Severity targets"]
  N3["6.3 Reporting"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Findings workflow"]
  N2["6.2 Severity targets"]
  N3["6.3 Reporting"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX026"]

[Learning outcomes]
    |
    v
[6.1 Findings workflow]
    |
    v
[6.2 Severity targets]
    |
    v
[6.3 Reporting]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes

You will (1) design a GRC workflow for findings; (2) set severity-based targets; (3) report progress to management.

6.1 Findings workflow

Lena designs a workflow for audit and review findings. Each finding is logged with a description, severity, owner, agreed action and target date. Owners update progress monthly. When an owner claims completion, Lena checks evidence before closing. Overdue findings escalate to the owner's executive. She learns that a clear workflow makes accountability visible and prevents findings from being forgotten after the audit report is filed. Checking evidence before closure prevents a finding being marked done when only a plan exists.

6.2 Severity targets

Lena proposes targets by severity: high findings closed within thirty days, medium within ninety and low within one hundred and eighty. She explains that targets must be realistic; a high finding needing a system replacement may need an agreed interim measure and a longer plan. She learns that target dates without realistic plans encourage false closure, while plans with interim measures keep risk managed while longer fixes proceed. A high finding needing a system replacement could, for example, be held within target by an interim restriction while the replacement is planned.

6.3 Reporting

Lena reports to the executive risk committee monthly: open findings by severity, overdue findings with owners and reasons, and findings closed with evidence. She leads with overdue high findings. The committee asks owners of overdue items to explain delays. She learns that reporting works when it is short, consistent and leads to action at the right level, rather than simply informing people that problems exist. Leading with overdue high findings means the committee's limited time goes to the items most likely to need executive help.

Worked example

Lena designs a findings workflow with evidence-based closure, severity targets and monthly committee reporting.

Synthetic case. The workflow is synthetic.

Errors and limits

Targets can drive false closure. Committees may not act.

Exercises

• EX026 — Closure check. What happens when an owner claims completion?
  Show marking criteria

  Rubric: 3 = Lena checks evidence before closing;; 2 = evidence;; 1 = vague;; 0 = none.
• EX027 — High target. What is the target for high findings?
  Show marking criteria

  Rubric: 3 = thirty days;; 2 = 30;; 1 = vague;; 0 = none.
• EX028 — Long fixes. How should a high finding needing a system replacement be handled?
  Show marking criteria

  Rubric: 3 = interim measure and longer agreed plan;; 2 = interim;; 1 = vague;; 0 = none.
• EX029 — Report lead. What does Lena's report lead with?
  Show marking criteria

  Rubric: 3 = overdue high findings;; 2 = overdue;; 1 = vague;; 0 = none.
• EX030 — Escalation path. Where do overdue findings escalate?
  Show marking criteria

  Rubric: 3 = the owner's executive;; 2 = executive;; 1 = vague;; 0 = none.

Synthesis

A findings workflow with realistic targets and action-focused reporting keeps remediation moving.

Continue studying — chapter 06 of 12

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →