Job role capstone: GRC analyst
You live a quarter as a GRC analyst: a risk register update, a policy review, an access review, a supplier assessment, audit evidence and a management report.
Level 401 · 12 lessons · 12 practice labs
Lessons
Start of the quarter
- The role and the quarter's plan
- Building the compliance calendar
- Quick task: the quarter's work plan
The work
- Updating the risk register
- The annual policy review
- Running the access review
- Assessing a new supplier
- Answering an external auditor's request
- Quick task: an issue and action log
Close
- The quarterly management report
- Lessons from the quarter and the next plan
- Capstone: the GRC analyst's quarter file
Practice labs
- Build the compliance calendar: Build a calendar across the quarter's weeks from twenty obligations and their frequencies.
- The quarter's work plan: Prepare a work plan that fits weekly capacity from the calendar, open findings and management priorities.
- Resolve clashing priorities: For an audit request, a policy review and a supplier assessment landing in one week, write the ordering decision and the stakeholder messages.
- Update the risk register: Update the scores and statuses in the risk register from the quarter's three incident summaries and two project notes.
- The annual policy review: Compare an access policy with last year's findings, a legal change and actual practice and write the proposed amendments.
- Close the gap between register and policy: Find five controls listed as treatment in the register with no counterpart in any policy and propose the document change.
- Prepare the access review list: Split a user export by manager to prepare the review lists for sign-off.
- Run the access review: Process manager responses and report access to remove, non-responders and the completion rate.
- Assess a new supplier: From an HR software provider's questionnaire, certificate and draft contract, write a risk summary and approval recommendation.
- Tidy the issue and action log: In a thirty-entry log, merge duplicates and complete missing owners and dates.
- Answer the external auditor's request: Compile the evidence for a ten-item request list and prepare the delivery pack with an index stating period and source.
- The quarterly management report: From risk, compliance, findings and supplier data, write a two-page report with status, trend and decisions requested.
About this course
You live a quarter as a GRC analyst: a risk register update, a policy review, an access review, a supplier assessment, audit evidence and a management report.
What you will learn
- Start of the quarter
- The work
- Close
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.