Governance, Risk, and Compliance
This domain tests whether you can keep delivery within agreed authority, risk appetite and legal obligations, and whether you understand where assurance comes from.
Governance essentials
- Terms of reference define purpose, membership, quorum, decision rights and escalation routes.
- Delegated authority states who may approve what value or risk; decisions outside it escalate.
- Risk appetite vs tolerance - appetite is willingness to accept risk; tolerance is the measurable limit.
- Three lines model - management owns risk, independent functions provide oversight, internal audit gives assurance.
- Controls are preventive or detective; each needs an owner and evidence.
- Compliance obligations include data protection, records retention, procurement rules and sector regulation.
Worked example
A project risk score reaches 16 on a 5×5 matrix; the agreed tolerance is 12. Reasoning: the risk owner updates the register, documents current controls, and escalates to the steering group with options: accept with mitigation, transfer, reduce or stop. Acceptance must be recorded by someone with authority above the tolerance. Informing the project board is not escalation if that board lacks the authority to accept the risk.
Traps
- Treating governance as meeting attendance rather than decisions.
- Confusing risk owner, accountable for the risk, with action owner, who delivers mitigation.
- Assuming compliance is a one-off sign-off.
- Risk registers with no review dates.
- "Accepted" risk with no named acceptor or rationale.
- Assurance treated as the same thing as management reporting.