Certified in Governance, Risk and Compliance (CGRC) — Lesson 3: Assessment Planning, Testing, Findings, Remediation, and Authorization

Learning Objectives

• Translate assessment scope, test procedures, and finding analysis into actions that can be implemented and verified.
• Compare viable approaches to remediation planning and record the trade-offs affecting authorization decision.
• Resolve the exception in which high-severity findings are accepted without business impact analysis, completion dates, or accountable owners without creating a new control gap.

Detailed Topics

• Evaluate assessment scope against policy, risk appetite, architecture constraints, and measurable acceptance criteria.
• Use test procedures to resolve a course-specific decision and record why rejected options were not selected.
• Inspect finding analysis for hidden assumptions, inherited responsibilities, and downstream operational effects.
• Translate remediation planning into a repeatable workflow that another practitioner can review and operate.
• Test authorization decision for normal behavior, boundary conditions, and an adverse scenario relevant to the lesson.

Instructor Demonstration

The instructor reviews the available facts, builds the required artifacts, and challenges the proposed solution. Particular attention is given to whether the system should be authorized, conditionally approved, or withheld from operation and the warning signs that appear when high-severity findings are accepted without business impact analysis, completion dates, or accountable owners.

Hands-On Exercise

Work through the scenario and prepare an independent assessment and summarize residual risk for executive approval. Your evidence package must include the assessment plan and authorization decision package.

1. Inventory the facts, assets, stakeholders, constraints, and evidence relevant to assessment scope.
2. Perform the core analysis for test procedures and finding analysis, recording assumptions and rejected options.
3. Introduce the adverse condition where high-severity findings are accepted without business impact analysis, completion dates, or accountable owners and revise the proposed response.
4. Complete the assessment plan and authorization decision package with ownership, acceptance criteria, residual concerns, and the next review date.

Scenario Analysis

• Identify which assumption has the greatest effect on whether the system should be authorized, conditionally approved, or withheld from operation.
• Compare two viable approaches involving remediation planning and explain their security and operational trade-offs.
• Specify the evidence required before the assessment plan and authorization decision package can be accepted.

Troubleshooting Guidance

Investigate the exception by comparing the documented design with observed behavior and retained evidence. Test one factor at a time, especially where high-severity findings are accepted without business impact analysis, completion dates, or accountable owners, and record why the corrective action addresses the root cause.

Validation Checklist

• The scope and ownership for assessment scope are explicit and agreed.
• The selected treatment for test procedures is supported by scenario evidence rather than assumption.
• The exception involving high-severity findings are accepted without business impact analysis, completion dates, or accountable owners was tested and its impact was recorded.
• The assessment plan and authorization decision package identifies acceptance criteria, residual risk, responsible owners, and follow-up actions.

Lesson Outcome

Learners can apply Assessment Planning, Testing, Findings, Remediation, and Authorization, explain whether the system should be authorized, conditionally approved, or withheld from operation, and support the conclusion with a reviewable assessment plan and authorization decision package.