Integrating people, process and technology in GRC
The closing idea of the series, and the one that determines whether everything before it works. Controls fail at the seams — where a tool hands off to a process, or a process depends on a person understanding something nobody told them.
What this session covers
- Technology scales a process that already works. It does not create one, and it will faithfully scale a broken process too.
- Process is what makes outcomes repeatable when the person who usually does it is on holiday.
- People are where judgement lives, which is exactly the part that cannot be automated.
- Most GRC programmes over-invest in tooling and under-invest in the process design that would make the tooling useful.
A practical test: for any control you rely on, ask what happens if the person who normally runs it leaves tomorrow. If the answer is that it quietly stops, the control is a person, not a process.
This is also the lens that makes a GRC function credible to the rest of the business. Security that ignores how work actually gets done produces controls people route around, and controls people route around are worse than no controls at all, because they create false assurance.
Go further with mentorship
This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation.