Chapter 28 — Field practice

Chapter 28 — Field practice

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 Placement"]
  N2["28.2 Assessment support"]
  N3["28.3 Professional conduct"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 Placement"]
  N2["28.2 Assessment support"]
  N3["28.3 Professional conduct"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 Placement]
    |
    v
[28.2 Assessment support]
    |
    v
[28.3 Professional conduct]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) apply GRC skills in a supervised placement; (2) support an external assessment; (3) reflect on professional conduct.

28.1 Placement

Priya spends a term on placement with Riverton's operations team. She supports routine work: reviewing indicators, checking evidence freshness, chasing overdue actions and helping clinic managers with access reviews. She learns that much GRC work is steady follow-up rather than dramatic analysis, and that patience and good relationships with busy clinic staff matter as much as technical knowledge. Chasing overdue actions, for instance, depends on clinic managers trusting that she is helping rather than policing them. Those relationships later make it easier to raise uncomfortable findings.

28.2 Assessment support

Riverton's bank requests a PCI DSS self-assessment because of its card payments. With the hosted payment page and segmented terminals, Riverton's scope is small. Priya helps gather evidence: network diagrams, terminal inventories and confirmation from the payment provider of its compliance. She learns that the earlier architecture decisions made the assessment far easier, and that compliance work is shaped by design choices made long before assessment begins. Card data never touching Riverton's site removes most of the systems a larger assessment would otherwise examine.

28.3 Professional conduct

During the placement, a clinic manager asks Priya to mark an overdue access review as complete to avoid an escalation. She declines politely, explains that the record must reflect reality and offers to help complete the review that afternoon. They finish it together. She reflects that professional conduct means keeping records honest while helping people meet their obligations, and that refusing gently and offering help preserves the working relationship. Completing the review that afternoon meant the record could honestly show it done, only a little late.

Worked example

Priya supports routine GRC work, helps a small-scope PCI DSS self-assessment and declines to falsify a record while helping complete the review.

Synthetic case. The placement is synthetic; PCI DSS is real.

Errors and limits

Placements vary in quality. Pressure can be subtle.

Exercises

• EX082 — Routine work. What does much GRC work consist of? Rubric: 3 = steady follow-up;; 2 = follow-up;; 1 = analysis;; 0 = none.
• EX083 — Small scope reason. Why was Riverton's PCI DSS scope small? Rubric: 3 = hosted payment page and segmented terminals;; 2 = design;; 1 = vague;; 0 = none.
• EX084 — Integrity response. How did Priya respond to the request to mark a review complete? Rubric: 3 = declined and helped complete it;; 2 = honest help;; 1 = vague;; 0 = none.

Synthesis

Field practice shows that GRC work is steady, design-shaped and grounded in honest records.

Continue studying — chapter 28 of 30

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →