Governance, Risk and Compliance in Corporate Settings
This domain tests how agile delivery operates inside corporate governance, risk, and compliance without turning into waterfall. Expect stage gates, lightweight artefacts, risk-adjusted backlogs, ROAM, auditability, traceability, portfolio funding, and escalation.
Core rules
- Governance should provide transparency and decision rights, not predict every step. Fit cadence to risk: high-risk work needs more evidence, not more paperwork for its own sake.
- Use existing agile artefacts as evidence: product backlog, definition of done, test results, decision log, risk board, and release notes.
- Manage risk continuously: identify, assess, ROAM as Resolved, Owned, Accepted, or Mitigated, and place risk-reduction work in the backlog.
- Build compliance into the definition of done and acceptance criteria; automate evidence where possible.
- Escalate with options and impact, not just status. Governance bodies decide trade-offs; teams deliver.
Worked example
A regulated product must show segregation of duties and audit trails. The team proposes a full waterfall gate at the end. Reasoning: deferring compliance evidence creates late rework and audit risk. Better: add compliance acceptance criteria to the definition of done, automate audit logging, review evidence at each release gate, and keep a traceability matrix updated from the backlog. The gate remains, but evidence is produced continuously.
Traps
Treating governance as separate from delivery; deferring compliance to release; assuming agile means no documentation; using velocity to fund portfolios; ignoring enterprise risk; treating a gate as a status meeting rather than a decision point.