Governance, Risk, and Compliance
Governance sets direction and control
Governance is the system by which services are directed and controlled: setting direction, defining roles and accountability, and ensuring value and risk are balanced. Distinguish governance (direction, oversight, accountability) from management (day-to-day planning and execution). A frequent trap is treating governance as a committee that approves tickets - governance sets policy and accountability, management runs the operation.
Risk: identify, assess, treat
Risk is the effect of uncertainty on objectives. Understand the standard treatment options: avoid, reduce/mitigate, transfer, accept. Know the difference between risk (uncertain future effect) and issue (a problem already occurring). Residual risk is what remains after treatment; risk appetite is how much the organization is willing to accept.
Compliance and control
Compliance means meeting obligations - legal, regulatory, contractual, and internal policy. Controls are the safeguards that make compliance demonstrable: segregation of duties, access control, audit trails, change approval. Understand that audit provides independent assurance and should not be conflated with management review.
Traps to watch
- Confusing risk acceptance (a conscious, authorized decision) with ignoring risk.
- Assuming transfer (e.g., insurance or a supplier contract) eliminates risk - accountability usually remains.
- Treating compliance as a one-time certification rather than ongoing evidence.
Worked example
A team wants to skip change approval to hit a deadline. The correct reasoning: this is a risk decision, not a scheduling one. Options are reduce (add a targeted review), transfer (contractual assurance), or accept (documented, authorized by the accountable owner). Simply proceeding is acceptance without authority - a governance failure.