Chapter 26 — Security governance, risk and compliance: operational handoff

Lesson map

Lesson 26 published. Map, example, EX076.

flowchart TD
  N0["Learning outcomes"]
  N1["26.1 Runbooks"]
  N2["26.2 Readiness"]
  N3["26.3 Ownership"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX076"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["26.1 Runbooks"]
  N2["26.2 Readiness"]
  N3["26.3 Ownership"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX076"]

[Learning outcomes]
    |
    v
[26.1 Runbooks]
    |
    v
[26.2 Readiness]
    |
    v
[26.3 Ownership]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX076]

Learning outcomes

You will (1) hand over GRC processes to operations staff; (2) write runbooks; (3) confirm readiness before handoff.

26.1 Runbooks

Priya prepares runbooks for processes she helped build: the weekly roster reconciliation, monthly indicator review, evidence freshness check and quarterly access review. Each runbook lists the purpose, steps, tools, expected outputs, what to do when something fails and who to contact. She writes them for a person who has never done the task before. She learns that runbooks make processes independent of the people who designed them. The section on what to do when something fails matters most, since the coordinator will face it without Priya present.

26.2 Readiness

Before handoff, Priya watches the IT team's new coordinator perform each process using only the runbook. The coordinator completes three of four without help. For the indicator review, the coordinator is unsure what counts as an escalation, so Priya adds examples. She learns that readiness should be demonstrated, not assumed, and that the best test of documentation is someone else using it successfully. The added escalation examples close the only gap the coordinator found, so the runbooks are ready for handoff.

26.3 Ownership

Priya confirms that each process has an owner, a backup person and a place in the governance calendar. She agrees that she will be available for questions for one month, after which the coordinator is fully responsible. She learns that a clear end to support helps the new owner take responsibility, while a short support period reduces the risk of early mistakes going unnoticed. Naming a backup person for each process prevents the weekly reconciliation stopping when the coordinator is away.

Worked example

Priya writes four runbooks, tests readiness by observing the coordinator and confirms owners, backups and a one-month support period.

Synthetic case. The handoff is synthetic.

Errors and limits

Runbooks age. Backup people may lack practice.

Exercises

• EX076 — Runbook audience. Who should runbooks be written for?
  Show marking criteria

  Rubric: 3 = someone who has never done the task;; 2 = newcomer;; 1 = expert;; 0 = none.
• EX077 — Readiness gap. Which process needed more guidance?
  Show marking criteria

  Rubric: 3 = the indicator review escalation;; 2 = escalation;; 1 = vague;; 0 = none.
• EX078 — Support period. How long will Priya remain available after handoff?
  Show marking criteria

  Rubric: 3 = one month;; 2 = 1 month;; 1 = vague;; 0 = none.

Synthesis

Handoffs succeed when runbooks are tested by new owners and support has a clear end.

Continue studying — chapter 26 of 30

← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →