Governance, Risk and Compliance (GRC)

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 62

Learners work out which questions must be answered before a technician switches on a new way of sharing records, and what a passed inspection does and does not show, before the three parts are named. Predictions then precede the three short questions, what happens without risk assessment, how to approach the supply-teacher proposal, who configures accounts, the sales team’s silo and an MOT for organisations; checks follow the account review, signed policies, a certificate and training figures. The habit to build: for any proposal, ask who decides, what matters most, what must be met and what evidence shows it works.

Objectives

• Describe governance, risk and compliance and the question each answers
• Explain how the three feed each other, through a worked example
• Separate oversight from operational work, and name typical roles
• Explain how silos let shared risks go unmanaged
• Explain why compliance is a baseline, not proof of security, and describe maturity

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the People, Processes and Technology lesson first.
• Write the three short questions on the board and leave them up for the whole lesson.
• The lesson takes about 62 minutes. To teach it in two parts, stop after “Departmental silos, communication and training”; the second part opens with “Compliance vs security”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe governance, risk and compliance and the question each answers
   • Explain how the three feed each other, through a worked example
   • Separate oversight from operational work, and name typical roles
   • Explain how silos let shared risks go unmanaged
   • Explain why compliance is a baseline, not proof of security, and describe maturity

   Purpose: Learners work out which questions must be answered before a technician switches on a new way of sharing records, and what a passed inspection does and does not show, before the three parts are named. Predictions then precede the three short questions, what happens without risk assessment, how to approach the supply-teacher proposal, who configures accounts, the sales team’s silo and an MOT for organisations; checks follow the account review, signed policies, a certificate and training figures. The habit to build: for any proposal, ask who decides, what matters most, what must be met and what evidence shows it works.

2. 1. Before it starts Think 5 min

   Purpose: Raise the decisions that come before technical work.

   Ask

   • Which other questions need answering?
   • Was the inspection wrong?

   Responses to expect

   • Legal questions come quickly; ownership needs a prompt.
   • On screen in turns: the opening question, its answer; then the question on a pass in March and a breach in June, and its answer.

   Discussion pause: List learners’ questions and sort them into three groups before revealing.

   In the lesson window

   • Think it through: A school’s IT technician could switch on a new way of sharing pupil records tomorrow. Before it is allowed, which other questions need answering, and by whom?
   • Think it through: A company passes an annual security inspection in March. In June it suffers a serious breach. Does that mean the inspection was wrong?

3. 2. Three connected responsibilities Explain 4 min

   Purpose: Name governance, risk and compliance and their short questions.

   Ask

   • Write one question for each part.

   Responses to expect

   • Most learners’ questions match the table closely.
   • On screen in turns: the opening; then the question on three short questions, and its answer; governance, risk and compliance, side by side; prompts, not hard boundaries.

   In the lesson window

   • Think it through: Governance, Risk and Compliance. Before reading the table, write one short question that each part might answer.

4. 3. Why they belong together Predict 11 min

   Purpose: Show how the parts feed each other, through the supply-teacher example.

   Ask

   • What goes wrong without risk assessment?
   • How would you approach the proposal?
   • What found the forgotten account?

   Responses to expect

   • Some credit the policy rather than the review.
   • Diagram: step through the four steps of the cycle; at the last, ask what governance does with what comes back.
   • On screen in turns: the opening question, its answer; then how the pillars feed each other, one step at a time; the diagram’s stages one at a time; a fictional school’s proposal; the question on following the proposal, and its answer; one proposal through the three questions, starting with governance; what matters most; what the school will do about it; what the school must meet; the evidence; the loop closing; the check question on who found the account, and its answer; what the example shows; where risk is taught next.

   Misconceptions to challenge

   • A learner may believe: “A signed policy means staff follow it.” Respond: Acknowledgement is not understanding or practice.

   In the lesson window

   • Think it through: Suppose an organisation has governance and compliance, but nobody assesses risk. What might go wrong?
   • Think it through: Before reading the example: if a school wanted supply teachers to see pupil records for the classes they cover, what would you want decided, assessed and checked before it starts?
   • Check your understanding: In the school example, what found the account that was still active three weeks after its teacher left?

5. 4. Accountability and organisational roles Predict 6 min

   Purpose: Separate oversight from operational work, and introduce typical roles.

   Ask

   • Must the head teacher configure accounts?

   Responses to expect

   • Learners tend to the extremes: does it all, or not her concern.
   • On screen in turns: the opening question, its answer; then oversight and operational implementation; roles and teams, with their contributions held back; what each contributes; not a universal organisation chart; who performs, who approves, where issues go.

   Misconceptions to challenge

   • A learner may believe: “Security is the IT team’s job.” Respond: Leaders set direction, owners accept risks and every department matters.

   Discussion pause: The contributions column is held back: ask what each role or team adds before revealing it.

   In the lesson window

   • Think it through: A head teacher is responsible for the school’s pupil records. Must she configure the accounts herself?

6. 5. Departmental silos, communication and training Predict 9 min

   Purpose: Explain silos and work through the document-storage proposal.

   Ask

   • What has gone wrong between sales and IT?
   • What does a signed policy show?

   Responses to expect

   • The shared, unmanaged risk is the key idea.
   • On screen in turns: the opening question, its answer; then silos and shared risk; proposing external document storage, starting with the need; assessing risk before use; checking requirements; recording a decision with conditions; communicating and implementing; checking actual use; the check question on a signed policy, and its answer; from a meeting to what staff do; accountability for communicating policy.

   If the explanation does not land: Draw two boxes for the teams and a document outside both: whose is it?

   In the lesson window

   • Think it through: The sales team starts sharing documents through a new online service because it is easier. IT assumes everything is still in the approved system. Each team is doing its own job well. What has gone wrong?
   • Check your understanding: In step 5, staff have all signed to say they have read the new policy. What does that show?

7. 6. Compliance vs security Predict 7 min

   Purpose: Separate compliance from security effectiveness with the MOT and coat comparisons.

   Ask

   • What does the Cyber Essentials case show?
   • Why can one checklist not fit every organisation?

   Responses to expect

   • “Compliant means secure” is common.
   • On screen in turns: the opening; then a Cyber Essentials pass and undetected malware; the check question on a pass, then malware, and its answer; the MOT comparison; the coat-and-rain comparison; the question on one fixed checklist, and its answer; where the comparisons stop.

   Misconceptions to challenge

   • A learner may believe: “Compliant means secure.” Respond: Compliance is a baseline within a scope and a moment.

   To go further

   • What would you ask an assessor before relying on their report?

   In the lesson window

   • Check your understanding: A firm passes Cyber Essentials, yet malicious software is found on one laptop a week later. What does that show?
   • Think it through: An MOT uses one fixed checklist for every car. Why can a security assessment not work quite the same way?

8. 7. Security maturity Predict 7 min

   Purpose: Describe the maturity stages and place the school example on them.

   Ask

   • Where does the school start?
   • Is a training percentage evidence of maturity?

   Responses to expect

   • Learners often equate more documents with maturity.
   • Diagram: reveal the stages one at a time; ask where the school’s supply-teacher process sits before the stages are named for it.
   • On screen in turns: the opening; then five stages of maturity, one at a time; the diagram’s stages one at a time; the four-word version; the question on placing the school, and its answer; the school’s process through the stages; training figures are not maturity; the check question on a training percentage, and its answer; improvement is not more documents; hear from all three pillars.

   In the lesson window

   • Think it through: Using the five stages, where would you put a school that decides each supply teacher’s access as it arises, with nothing written down?
   • Check your understanding: Ninety-eight per cent of staff have completed a training course. Is that evidence of a mature process?

9. 8. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The survey tool tests the three questions; the CISO tests ownership; the wrong recipient tests process failure.
   • On screen in turns: the opening; then the question on a survey tool, and its answer; the question on a CISO accepting every risk, and its answer; the question on a wrong recipient, and its answer.

   In the lesson window

   • Apply it: A department wants to start using a new online survey tool for parents next week, and only IT has approved it. What is missing?
   • Apply it: A CISO says they will personally accept every risk in the organisation. What is the problem?
   • Apply it: An employee shares a file with the wrong external person. Nobody had shown staff how the sharing settings work. What should the review look at?

10. 9. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The compliance question links to the MOT discussion.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. Revision takeaway Consolidate 4 min

    Purpose: Consolidate the four questions, the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the four questions to ask together.

    Responses to expect

    • Who owns the decision, what risk, which obligations, what evidence.
    • On screen in turns: the opening; then what to remember; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Decide, prioritise, meet obligations.
    • Each feeds the next, and results return.
    • Oversight checks; others do the work.
    • Silos hide shared risks.
    • Compliance is a baseline; evidence of practice shows maturity.

Consolidation

• Decide, prioritise, meet obligations.
• Each feeds the next, and results return.
• Oversight checks; others do the work.
• Silos hide shared risks.
• Compliance is a baseline; evidence of practice shows maturity.