GRC Capability Model Details - Learn Component
This domain tests what the Learn component produces and how external and internal context feed GRC objectives, scope and strategy. Expect scenarios in which something changes in the environment and you must decide what should happen next.
Purpose
Learn is the "understand" phase: gather, validate and organize information about the external and internal environment, then use it to set GRC objectives, scope and strategy. It is continuous - context shifts between reporting cycles.
External environment
- Laws and regulations by jurisdiction, regulator guidance and enforcement trends.
- Voluntary standards and frameworks, contractual and customer requirements.
- Stakeholder expectations: investors, customers, employees, NGOs, media, communities.
- Market, technology, geopolitical, supply-chain and emerging-risk signals.
Outputs include an obligations/requirements register mapped to entities, processes and owners, plus a view of emerging risk and external change.
Internal environment
- Strategy, business model, objectives and how value is created.
- Structure, roles, processes, systems, data and third parties.
- Culture, conduct history, prior incidents, known issues.
- Existing controls and their performance, current risk profile, appetite and available resources.
Outputs include the risk universe or catalog, a capability baseline, common definitions and taxonomy.
What Learn feeds
Learn supplies what Align uses to set appetite, accountability and priorities, and what Perform uses to design controls. Every obligation identified here should trace forward to a control, an owner and a metric. A requirement with no downstream owner is a Learn failure that resurfaces later as an issue.
Worked example
A new data-protection regulation is enacted in a country where the company sells. Reasoning: confirm applicability and scope - which entities, products, data and jurisdictions; translate the legal text into discrete obligations; map each to processes and systems; compare against existing controls; record gaps with rated risk and owners; set a trigger to monitor regulator guidance and enforcement; only then does the work enter strategy, priorities and budget.
Traps
- Reading only the legal register and missing contracts, standards and ethical expectations.
- Treating Learn as a one-off project rather than a continuous scan.
- Not validating sources or rating significance, so everything becomes a priority.
- Failing to translate external requirements into internal objectives and plain language.
- Skipping the internal side and designing controls without knowing the culture, systems or existing coverage.