The GRC Triptych: how the three connect¶
What you'll be able to do in this chapter
- Connect governance, risk and compliance into one reinforcing loop.
- Explain the role each plays in relation to the others.
- Distinguish the conceptual order (taught in Module 1) from the operational order (used in Modules 3–4) and say why they differ.
- Trace a single Scaldimet decision through all three lenses.
Three definitions, one job¶
You now have four clean concepts: cybersecurity (what we protect), governance (who decides and answers), risk (what could go wrong, weighed), and compliance (what we must do, provably). Defined separately, they can feel like three different departments that happen to share a corridor.
They are not. They are one system with three jobs, and the point of this Lesson is to make you see the loop they form (because a CISO who treats governance, risk and compliance as separate workstreams can create disconnected activities and decisions). A CISO who runs them as one loop produces a programme. By the end of this Lesson you will trace a single Scaldimet decision all the way round that loop.
How the three fit together¶
Strip each to its role in relation to the other two:
- Governance sets the frame. It decides the objectives, grants the authority, names the owners, and: crucially (sets the risk appetite). Governance does not, by itself, tell you what to do; it tells you what you are trying to achieve and how much risk you will tolerate getting there.
- Compliance lays the floor. Given the frame, compliance brings in the obligations (laws, standards, contracts) that define a sound baseline. A good baseline efficiently covers most of the ordinary, sector-wide risk, because that is precisely what standards and laws are: distilled, widely-agreed good practice.
- Risk handles what's left. No baseline anticipates your particular dangers. Risk analysis takes the things the floor doesn't cover (Scaldimet's flat French network, its unmonitored contractor, its ageing OT) and decides what to do about each, measured against the appetite governance set.
And then the loop closes: the results of risk analysis and compliance status flow back up to governance as oversight (reports, decisions, revised appetite) which adjusts the frame, and round it goes again.
The triptych as a sentence
Governance decides what matters and how much risk is acceptable; compliance establishes the baseline that covers the ordinary; risk addresses the specific dangers the baseline misses (and all three report back to governance, which adjusts and re-directs). Direction → baseline → bespoke treatment → oversight → direction. One loop.
Each depends on the others. Compliance without governance is a baseline nobody owns or oversees. Risk without governance has no appetite to measure against, so it never knows when to stop. Governance without compliance and risk provides direction without the controls and analysis needed to support it. The three are only useful as a set; that is why the field bundles them into one word.
The two orderings, and why they differ¶
Here is the deliberate design choice this course makes, and the reason Module 1 has been building to this moment.
There are two different valid orders for governance, risk and compliance, and they serve different purposes. Confusing them is common; understanding why both exist is a mark of someone who really gets GRC.
The conceptual order: Governance → Risk → Compliance. This is the order of understanding and dependency, and it is the order Module 1 itself uses (governance in 1.2, risk in 1.3, compliance in 1.4). Why this order to learn? Because risk is the intellectual core of the whole field (you cannot really understand why a given compliance baseline exists, or why governance sets an appetite, without first understanding risk). Compliance is, in a sense, "pre-packaged risk treatment": a standard is a list of controls that experts decided address common risks. To grasp compliance deeply, you must already grasp risk. So for learning, risk comes before compliance.
The operational order: Governance → Compliance → Risk. This is the order of doing, and it is the order the rest of the course executes (Module 2 governance, then Module 3 compliance, then Module 4 risk). Why flip it to act? Because when you are actually building a programme, it is far more efficient to put the well-understood baseline in place first, then spend your scarce analytical effort on what the baseline doesn't cover. Adopting ISO 27001 and the NIS2 measures handles the bulk of Scaldimet's ordinary exposure in one structured move. Then you do bespoke risk analysis on the remainder (the French OT, the contractor, the flat network) rather than laboriously re-deriving, from first principles, controls that a standard would have handed you anyway. Starting from a baseline (sometimes called working from a socle, a foundation) is simply less wasteful than starting from a blank page.
| Conceptual order (to learn) | Operational order (to do) | |
|---|---|---|
| Sequence | Governance → Risk → Compliance | Governance → Compliance → Risk |
| Logic | You must understand risk to understand why compliance exists | Put the baseline in place first, then analyse what it misses |
| Where in this course | Module 1 (Concepts) | Modules 2 → 3 → 4 |
Technical explainer (read & discuss, don't build): 'baseline-first' vs 'risk-first'
In practice you will meet two schools.
Risk-first (pure): assess all your risks from scratch, then design controls to treat them. Thorough, but slow and expensive, and it re-invents work that standards already did.
Baseline-first (compliance-led): adopt a recognised baseline (a standard / regulatory set), which covers common risks by default, then run risk analysis only on the gaps and the organisation-specific exposures. Faster, and it stands on collective experience.
Most mature programmes (and this course) use baseline-first for execution, while still teaching risk as the underlying concept. The two are not in conflict: the baseline is risk treatment, just done in advance by the wider community. Module 4 opens precisely where the baseline stops, framed as "what the baseline does not cover".
So the conditions are now visible to you as a learner: Module 1 taught risk as a concept early (so the baseline makes sense); Module 3 will teach every control alongside the risk it mitigates (so compliance never becomes mindless box-ticking); and Module 4 will open by asking what the baseline leaves uncovered (so risk analysis targets the gaps, not the whole). That is the triptych, turned into a teaching plan.
Application: one decision, three lenses¶
Take a single, concrete Scaldimet decision and walk it round the loop. The decision:
"Should Scaldimet connect Site Beta's ageing French production systems to the central network at the Belgian headquarters, so the two sites can share data more easily?"
Work through each lens before reading the debrief.
- Governance asks: Whose decision is this, and does it fit our objectives and risk appetite? Who would own the resulting risk?
- Compliance asks: What do our obligations say? Does NIS2, or ISO 27001, or the OEM contract require (or forbid) anything about network separation and the protection of OT?
- Risk asks: If we connect them, what could go wrong, how likely, how bad (and is that residual risk within appetite)?
Debrief. Through the governance lens, this is not an IT convenience decision: it materially changes the company's risk exposure, so it belongs to a senior owner against a stated appetite, not to whoever happens to be configuring the network. Through the compliance lens, both NIS2's risk-management expectations and ISO 27001's controls point firmly towards separating IT and OT, not merging them (the baseline already has an opinion here, and it is the opposite of "connect them for convenience"). Through the risk lens, connecting a modern network to Beta's flat, unsupported, weakly-managed OT would let a compromise at either site reach the other (high likelihood given Beta's state, severe impact given the production and contract consequences); almost certainly outside any sane appetite.
Notice what just happened: the three lenses agreed, and each added something the others didn't. Compliance gave you a fast, defensible answer from the baseline. Risk explained why that answer is right for Scaldimet specifically and quantified the stakes. Governance located who must own the decision and tied it to appetite. Run only one lens and you get a thinner answer; run the loop and you get a decision you can defend to the board, the auditor, and the customer alike. That is the triptych working.
Key takeaway
Governance, risk and compliance are one loop, not three departments: governance sets the frame and appetite, compliance lays the baseline that covers ordinary risk, risk handles what the baseline misses, and everything reports back to governance. There are two valid orderings: the conceptual order (Governance → Risk → Compliance) for learning, because you must understand risk to understand why compliance exists; and the operational order (Governance → Compliance → Risk) for doing, because it is more efficient to lay the baseline first and then analyse the gaps. This course teaches in the first order and executes in the second (on purpose).