Governance, Risk & Compliance learning path | 3by3Grid
Ensuring organisational integrity through strong governance, risk management, and compliance practices. Covers internal controls, regulatory standards, ethics, audit readiness, data privacy, business continuity, and accountability frameworks.
Concepts
- Business Continuity Planning: Prepare for the Unexpected Business continuity planning helps organisations identify their most critical operations, prepare for disruptions they cannot fully predict, and reduce the cost and confusion when unexpected events t…
- Business Impact Analysis: Identify Critical Functions and Acceptable Downtime Business impact analysis helps organisations identify which functions are truly critical to operations, establish defensible recovery timeframes, and allocate continuity resources before disruption s…
- COBIT: Turn IT Governance Into Business Value COBIT helps organizations bring structure, accountability, and clarity to IT decisions so technology investments support business priorities, manage risk, and deliver measurable value.
- Crisis Communication Planning: How to Lead With Clarity Under Pressure Crisis Communication Planning helps managers communicate clearly, consistently, and credibly during high-pressure situations, reducing confusion, protecting trust, and enabling faster, more aligned r…
- Crisis Management Framework: Steps for Real-Time Leadership A crisis management framework gives leaders a structured approach to real-time decision-making, team coordination, and stakeholder communication when a major incident demands an immediate, organised…
- Decision Log: Track Key Choices and the Reasoning Behind Them A decision log helps managers and teams create a transparent, traceable record of what was decided, who decided it, and why, reducing rework, resolving disputes, and supporting accountability in comp…
- Disaster Recovery Planning (IT): Reduce Downtime, Protect Data Disaster Recovery Planning gives managers a structured way to restore critical IT systems and data after an outage or attack, limiting downtime, data loss, and the operational and reputational damage…
- Incident Response Planning: Prepare Leaders to Act When Things Go Wrong Incident Response Planning helps managers respond quickly and coherently to disruptive events by defining clear actions, roles, and decision paths before a crisis hits.
- ISO 27001 Framework: Build Governance-Ready Security ISO 27001 gives managers a structured way to build, govern, and prove the credibility of their team's information security practices, turning ad hoc protection into an auditable, defensible system.
- Risk Appetite Statement: The Boundary Behind Every Risk Call A risk appetite statement gives managers and project sponsors a shared, pre-agreed boundary for how much risk is acceptable, so that scoring and escalation decisions stop depending on whoever happens…
- Risk Register: How to Identify, Track, and Reduce Risks A structured risk register helps teams anticipate threats before they disrupt delivery, then assign clear ownership and actions to protect projects and operations.
- Supplier Relationship Management: Build Partnerships That Unlock Commercial Value Supplier Relationship Management gives organisations a structured way to move beyond transactional purchasing and build supplier partnerships that reduce risk, improve quality, and unlock commercial…
- Vendor Risk Management: Assess and Mitigate Supplier Risk Vendor risk management gives managers a structured way to evaluate external providers before dependency on them becomes a liability that threatens continuity, data security, or cost control.
Courses
- Build a Risk Register Before the Auditors Ask for One A department that's never formally tracked its risks usually finds out the hard way, through an audit finding rather than a near-miss it caught in time. This course walks a manager through running a…
- Get Ahead of a Cybersecurity Compliance Audit Before a Client Demands It Managers who inherit an ISO 27001 mandate rarely start with a security team already in place. This course sequences the actual governance work: applying COBIT's structure to figure out who owns what,…
- Lead an Incident in the First Hour of a Crisis A vendor data breach lands on your desk at 4:15pm on a Friday, and no one on your team has ever run this before. This course works through the real mechanics of leading through a live incident: setti…
Simulations
- Handle A Vendor Breach During Audit Week A manager mid-audit for ISO 27001 certification learns a critical subprocessor has been breached, with the auditor's supplier review starting in 24 hours and two enterprise renewals hanging on certif…
- The Ransomware Note That Beat the Notification Clock Three production servers go dark at 6am with a ransomware note attached, and the regulator's 72-hour breach notification clock is already running. This ransomware incident response simulation puts yo…
- The Risk You Logged and Then Watched Happen A board wants to know why an accepted risk was allowed to happen. This simulation puts you in the room 48 hours after a supplier failure you saw coming eight months ago, and asks you to defend a gove…