Governance, Compliance and Risk Management: Standards, Audits and Evidence
Governance, Compliance and Risk Management
This domain tests how the operation proves it is controlled: standards, audits, documentation, risk registers and change governance. The exam expects you to link a requirement to evidence, and to distinguish compliance with a standard from legal compliance.
Core rules and concepts
- Governance sets policy, objectives, roles and review. Relevant frameworks include ISO 9001 for quality, ISO/IEC 27001 for information security, ISO 45001 for occupational health and safety, ISO 14001 for environment, ISO 50001 for energy, EN 50600 and ANSI/TIA-942.
- Audits can be internal, external, certification or supplier. Findings need classification such as major, minor or observation, plus root cause, owner, due date and verification of closure.
- Document control covers approval, version, distribution, review date and retirement. Uncontrolled copies are a common nonconformity.
- A risk register records asset or process, threat, vulnerability, likelihood, impact, score, owner, treatment and residual score. Risk treatment options are avoid, reduce, transfer and accept.
- Change control, configuration management and compliance calendars provide evidence that obligations are tracked, not remembered.
Worked example
A risk is scored on a 5×5 matrix: likelihood 4, impact 5 = 20, which is high. The team installs leak detection and a second chiller sensor, reducing likelihood to 2; impact remains 5 because a leak would still damage equipment, giving residual 10, which is medium. The risk owner accepts the residual with a review date and a trigger for re-scoring if the chiller is replaced. Reasoning: controls do not automatically reduce impact; record inherent and residual scores separately and justify any acceptance.
Traps that cost marks
- Claiming ISO certification means legal compliance.
- Closing an audit finding without root-cause analysis or evidence.
- Keeping a risk register without owners, dates or residual scores.
- Using uncontrolled procedures in the data hall.
- Treating a supplier's certificate as proof of the supplier's day-to-day control.