Day 1: Mapping the Oversight Landscape and Roles

Sources of Oversight and Assurance

• Identify governance, risk, compliance, audit roles
• Distinguish continuous monitoring from independent assurance
• Locate repeated low-value testing
• Map current control and assurance functions

Coordinating Assurance Across Three Lines

• Confirm management accountability for risks/controls
• Define support challenge and monitoring responsibilities
• Prevent internal audit designing management controls
• Resolve common role-overlap cases

Decision and Escalation Paths Across Functions

• Define who decides and who challenges
• Standardize escalation rules for material issues
• Avoid multiple committees owning same matter
• Design one coordinated escalation route

Day 2: Common GRC Taxonomy and Data

Objectives and Risk Taxonomy

• Connect risks with objectives and owners
• Standardize similar labels across separate registers
• Preserve specialist detail where genuinely necessary
• Clean conflicting entries across risk records

Shared Control Library

• Link controls across relevant risks/obligations
• Identify principal control over repeated descriptions
• Define operating evidence and control ownership
• Build a small reusable control library

Data Quality and Trusted Sources

• Define authoritative source per data element
• Set update approval and versioning rules
• Identify inconsistent assessments across functions
• Build a GRC data dictionary

Day 3: Coordinated Planning and Assurance Mapping

Risk, Monitoring, and Audit Planning

• Align work cycles without common plans
• Use findings across functions collaboratively
• Identify themes requiring coordinated intervention
• Build an integrated oversight calendar

Developing Assurance Mapping

• Define assurance coverage for risks/controls
• Distinguish three lines of assurance
• Locate areas without sufficient independent review
• Prepare assurance map for risk portfolio

Reliance on Other Work

• Evaluate methodology, competence, objectivity before reliance
• Determine reperformance depth needed for confidence
• Document reliance boundaries within audit planning
• Analyze shared evidence between two functions

Day 4: Integrated Reporting and Committee Information

Unified Report Design

• Present objective, exposure, control, issue together
• Prevent conflicting risk ratings across reports
• Show assurance coverage gaps and duplication
• Rebuild committee page from separate reports

Control and Assurance Indicators

• Measure appetite breaches and control effectiveness
• Track compliance issues and audit actions
• Use closure-time and recurring-cause indicators
• Design a balanced GRC dashboard

Supporting Committee Decisions

• Separate information from decision-required matters
• Define action owners and remediation deadlines
• Handle professional disagreement across control functions
• Simulate a multi-source committee briefing

Day 5: GRC Operating Model Design

Selecting the Right Level of Integration

• Define integrated data versus independent elements
• Balance efficiency with objectivity requirements
• Assess technology implications for workflow
• Set design principles for target model

Processes, Roles, and Technology

• Define assessment, testing, reporting cycles
• Allocate data ownership and approval authority
• Specify vendor-neutral platform requirements
• Build an end-to-end operating flow

Transformation Roadmap Laboratory

• Diagnose current gaps against target design
• Prioritize data governance and reporting initiatives
• Define measurable phased gains
• Present transformation roadmap to executive panel

• Role maps applying the Three Lines Model to organizational reality
• Exercises harmonizing risk control and obligation taxonomies
• Assurance mapping identifying gaps and duplicated coverage
• A GRC operating-model and committee-reporting design laboratory