Domain 2 · Objective reference 2.1 · Chapter 6 of 19
Plan governance, risk and compliance work
About 5 minutes · ISC2 CC outline effective 1 September 2026
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Governance directs; risk prioritizes; compliance demonstrates.
Explore the anchors
Set direction and decision authority.
Concept matching activity
Match this task or description to its concept:
Evaluate uncertain consequences.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Understand the three connected functions
- Use tools to support decisions, not replace them
Understand the three connected functions
Governance establishes direction, accountability and oversight. Risk management evaluates uncertainty and responses in relation to objectives. Compliance evaluates applicable requirements and evidence of meeting them. They inform one another but are not interchangeable. A service can meet a checklist while retaining significant business risk, and a risk-based decision cannot simply waive a binding obligation.
Begin with a scope and inventory of services, information, relevant obligations and owners. Connect a requirement to a control, an operator, an evidence source and a review activity. A framework can organize the work, but the organization still needs decisions about applicability, resources and consequences.
Use tools to support decisions, not replace them
A GRC register or platform can track issues, controls, assessments and exceptions. Its value depends on accurate data, consistent definitions, access controls and accountable updates. Duplicated or stale records can make a sophisticated tool misleading. Link records where practical: one control may support several requirements, but each claim still needs appropriate scope and evidence.
For a new automated service, identify its business sponsor, intended purpose, data owner, supplier dependency and review route. A junior practitioner can maintain records, collect evidence and flag inconsistencies, while authorized owners make risk and legal decisions. Schedule reviews and define triggers for reassessment, such as an incident or a material supplier change.
Worked example
A firm tracks an access-control requirement, assigns the application owner, records review evidence and logs exceptions. The dashboard shows not just whether a policy exists, but whether the control operated for the relevant user population and period.
Check your understanding
Why is a completed compliance checklist not the same as a complete risk assessment?
Show explanation
A checklist evaluates its stated requirements and scope. It may omit emerging threats, dependencies, business consequences or failures outside that scope. Risk evaluation needs those circumstances as well.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.