Chapter 24 — Applied research methods | Technologist Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 24 — Applied research methods

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Question"]
  N2["24.2 Method"]
  N3["24.3 Findings"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Question"]
  N2["24.2 Method"]
  N3["24.3 Findings"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Question]
    |
    v
[24.2 Method]
    |
    v
[24.3 Findings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) design a small applied study in GRC; (2) choose suitable data and methods; (3) report findings with limits.

24.1 Question

Priya designs a small study: does sending clinic managers pre-filled access review lists with role descriptions reduce the time they spend on reviews? She defines time spent as minutes reported in a short log, and quality as the number of inappropriate rights found by a second check. She learns that applied questions should be narrow, measurable and useful to the organisation, rather than broad questions that cannot be answered in a semester. Measuring quality by a second check guards against lists that save time by hiding inappropriate rights.

24.2 Method

Seven clinics receive the new lists and seven continue with the old lists for one quarter, with clinics allocated by drawing names. Priya records time and quality for each. She notes threats: managers know they are being studied, clinics differ in size and one quarter may be unusual. She learns that random allocation helps comparability but cannot remove all differences when groups are small. Drawing names avoids, for example, the larger clinics all ending up with the new lists. She records each threat in her report so readers can weigh the result themselves.

24.3 Findings

Managers with new lists report a median of forty minutes compared with ninety for the old lists. The second check finds similar numbers of inappropriate rights in both groups. Priya reports that the new lists saved time without reducing quality in this small study, while stating the limits. She learns that honest reporting of a small study can still support a practical decision, provided its uncertainty is clear. Forty against ninety minutes is a large difference, but seven clinics per group is too few to rule out chance entirely.

Worked example

Priya randomly allocates fourteen clinics, finds median review time of forty versus ninety minutes with similar quality and reports limits.

Synthetic case. The study is synthetic.

Errors and limits

Self-reported time. Seven clinics per group.

Exercises

EX070 — Quality measure. How is review quality measured? Rubric: 3 = inappropriate rights found by a second check;; 2 = second check;; 1 = vague;; 0 = none.
EX071 — Allocation. How were clinics allocated? Rubric: 3 = by drawing names;; 2 = random;; 1 = vague;; 0 = none.
EX072 — Time result. What median times did the groups report? Rubric: 3 = forty versus ninety minutes;; 2 = 40 vs 90;; 1 = vague;; 0 = none.

Synthesis

Small, well-designed applied studies support decisions when their limits are stated.

Continue studying — chapter 24 of 30

← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →