Day 1: Establishing IT Governance, Alignment, and Decision Rights

IT Governance, Risk, and Compliance Principles

• Align governance structures with objectives
• Identify policies standards accountable owners
• Review risk before approving exceptions
• Use reporting for transparent oversight

IT GRC Strategic Alignment

• Clarify intended strategic outcomes
• Prioritize using transparent decision criteria
• Align priorities with responsible units
• Draft clear prioritized direction

IT GRC Decision Rights

• Identify owners for critical decisions
• Distinguish governance execution responsibilities
• Clarify handoffs across participating teams
• Prepare operating responsibility matrix

Day 2: Designing Policies, Risk Assessments, and Controls

IT GRC Policies and Standards

• Match governance structures to objectives
• Define policies standards accountable owners
• Assess risk before approving exceptions
• Apply reporting for transparent oversight

IT GRC Risk Assessment

• Identify risk events affecting objectives
• Estimate likelihood and business impact
• Document controls and residual exposure
• Prioritize risks needing additional treatment

IT GRC Control Design and Testing

• Link each control to risk
• Define control owner frequency evidence
• Test control works as designed
• Improve controls failing risk reduction

Day 3: Managing IT Compliance and Third-Party Assurance

IT GRC Compliance Management

• Link governance with organizational objectives
• Identify policies standards accountable owners
• Review risk before approving exceptions
• Use reporting for transparent oversight

IT GRC Third-Party Risk

• Identify third-party shared data access
• Review provider controls against safeguards
• Identify assurance evidence for reviews
• Track unresolved third-party risk actions

IT GRC Audit Evidence

• Define evidence proving control operation
• Arrange records for efficient review
• Map findings against requirements controls
• Monitor corrective actions through closure

Day 4: Governing Exceptions, Indicators, and Executive Oversight

IT GRC Risk Exceptions

• Align governance structures with objectives
• Define policies standards accountable owners
• Assess risk before approving exceptions
• Use reporting to strengthen oversight

IT GRC Risk and Performance Indicators

• Align risk metrics with decisions
• Verify indicator definitions source consistency
• Compare performance against relevant baseline
• Translate results into follow-up actions

IT GRC Executive Reporting

• Prepare concise governance decision information
• Highlight exposure requiring leadership attention
• Separate status reporting from decisions
• Produce decision-focused visual summary

Day 5: Building GRC Accountability and Maturity

IT GRC Culture and Accountability

• Define expected accountability behaviors
• Equip leaders to model accountability
• Build support for accountable behavior
• Measure accountability behavior through indicators

IT GRC Maturity Improvement

• Apply consistent maturity assessment criteria
• Validate ratings through evidence interviews
• Separate foundational gaps from enhancements
• Track maturity with periodic reassessment

IT GRC Implementation Roadmap

• Phase IT GRC implementation actions
• Assign implementation owners and deadlines
• Link implementation dependencies with decisions
• Define evidence confirming implementation stages

• Workplace cases combining principles of IT governance, risk, and compliance with competing priorities
• Applied tools used to structure decisions on control design and testing
• Peer critique of risk and performance indicators, with attention to implementation risk
• A final applied assignment delivering an IT GRC roadmap with controls owners and milestones