Training on Governance, Risk & Compliance (GRC) Masterclass

Module 1: Foundations of GRC

• Core principles of governance, risk, and compliance

• The role of GRC in organizational strategy

• Key frameworks: COSO, ISO 31000, OCEG

• Case study: Enron Corporate governance failures and lessons learned

Module 2: Corporate Governance & Board Responsibilities

• Roles of board of directors, audit committee, and executive management

• Ethical culture, code of conduct, and tone from the top

• Stakeholder theory vs. shareholder primacy

• Case study: Wells Fargo fake accounts scandal Board oversight failure

Module 3: Enterprise Risk Management (ERM)

• Risk identification, assessment, and mitigation strategies

• Risk appetite, tolerance, and capacity

• Heat maps, risk registers, and bow-tie analysis

• Case study: Barings Bank Operational risk and lack of segregation of duties

Module 4: Compliance Program Design & Management

• Elements of an effective compliance program (USSC guidelines)

• Regulatory mapping, horizon scanning, and obligations management

• Policies, procedures, and training

• Case study: Siemens bribery scandal Compliance breakdown and remediation

Module 5: Internal Controls & Testing

• COSO internal control framework (5 components)

• Preventive, detective, and corrective controls

• Control testing: Design effectiveness vs. operating effectiveness

• Case study: Toshiba accounting scandal Control override and management pressure

Module 6: IT GRC & Cybersecurity Risk

• IT governance frameworks: COBIT, NIST CSF, ISO 27001

• Cybersecurity risk assessments and threat landscapes

• Data privacy: GDPR, CCPA, and cross-border transfers

• Case study: Equifax data breach IT control failures and patch management

Module 7: Third-Party Risk Management (TPRM)

• Vendor onboarding, due diligence, and tiering

• Contractual risk allocation (indemnification, audit rights)

• Continuous monitoring and offboarding

• Case study: Target data breach HVAC vendor access leading to compromise

Module 8: Whistleblowing, Incident Management & Investigations

• Whistleblower protection laws (Dodd-Frank, EU Whistleblowing Directive)

• Incident response plans: Detect, respond, recover

• Root cause analysis and corrective action plans (CAPs)

• Case study: Theranos Whistleblower role and internal investigation failures

Module 9: GRC Metrics, Reporting & Assurance

• Key Risk Indicators (KRIs) vs. Key Performance Indicators (KPIs)

• Board-level GRC dashboards and heat maps

• The Three Lines of Defense model (internal audit's role)

• Case study: 2008 Financial Crisis Risk reporting failures at Lehman Brothers

Module 10: GRC Maturity, Culture & Continuous Improvement

• GRC maturity models (Ad-hoc → Optimized)

• Building a speak-up culture and psychological safety

• Integrating GRC with strategy and ESG (environmental, social, governance)

• Case study: BP Deepwater Horizon Safety culture, governance, and risk communication failures