Governance, risk, and compliance
Governance, risk, and compliance tests how organizations set direction, measure risk, and prove control effectiveness. Expect questions on policy hierarchy, risk treatment, frameworks, audits, and continuity.
Core rules and concepts
- Policy states management intent; standards are mandatory requirements; procedures are step-by-step instructions; guidelines are recommended. A policy that no one enforces is not a control.
- Risk assessment estimates likelihood and impact, often with a risk register. Treatment options: avoid, mitigate, transfer, or accept. Acceptance belongs to an accountable owner, not the assessor.
- Controls can be preventive, detective, corrective, or compensating. Frameworks such as ISO/IEC 27001, NIST CSF, and SOC 2 provide structure; certification or attestation is not a guarantee of security.
- Third-party risk requires due diligence, contractual security terms, ongoing monitoring, and exit planning. Supply-chain risk includes software dependencies and service providers.
- Business continuity and disaster recovery depend on a business impact analysis. RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss.
Worked example
A payroll vendor suffers a breach. The organization reviews the contract for notification and audit rights, confirms which data was involved, and activates its own incident and privacy processes. It assesses whether payroll can continue, activates a manual payment fallback within the RTO, and records the risk decision. After recovery, it updates vendor monitoring and the exit plan.
Traps that cost marks
Do not confuse RTO with RPO. Do not treat compliance as proof of security. Do not let the risk assessor accept risk on the business owner's behalf. Do not call a procedure a policy.