Knowledge Governance, Risk, and Compliance
This section covers Knowledge Governance, Risk, and Compliance. The exam tests ownership, policy, access control, privacy, retention, intellectual property, and knowledge-loss risk. Policy must be operable: templates, review cadences, and exception handling make it real.
Core rules
- Governance defines decision rights: who approves taxonomy changes, owns content, grants access, and retires knowledge. A RACI or similar matrix makes this explicit.
- Classify knowledge by sensitivity and apply least privilege and need-to-know. Access control must survive role changes, departures, and external collaboration.
- Privacy and records obligations apply to knowledge repositories. Personal data needs lawful basis, minimization, retention limits, and deletion capability.
- IP rules cover third-party content, licensed material, and employee know-how. Sharing across boundaries can create contractual or confidentiality risk.
- Knowledge risk includes loss of experts, undocumented decisions, shadow collaboration, and unmanaged obsolete content.
Worked example
A team wants to publish sensitive incident lessons across the company. The reasoning should not choose all-or-nothing. Classify the record, redact personal and customer data, restrict the detailed version to authorized roles, publish a sanitized pattern, set a retention period, and review access quarterly.
Traps
Do not reduce governance to IT security. Do not over-restrict so that knowledge becomes unusable. Do not leave content without an owner. Do not ignore third-party IP or shadow tools.