Bridge the gap between knowing GRC and doing GRC. Clear explanations, practical guides and resources to help you take the next step.
A practical approach to learning GRC.
Download a free Excel-based ERM Toolkit designed to support risk assessments, documentation, and monitoring. Suitable for beginners and experienced practitioners looking to develop practical risk management skills or strengthen their existing processes.
View toolkitExplore the resource overview and companion guidance.
Get clear on the ideas behind the task. Start with the why, then build from there.
See the inputs, decisions and steps involved in getting the work done.
Connect the dots with fictional examples of what a deliverable can look like.
Use a resource as a starting point, with its assumptions and limitations in view.
A practical, Excel-based toolkit for managing third-party risks throughout the supplier lifecycle. Classify suppliers, conduct due diligence, assess security controls, evaluate risks, manage findings and remediation, monitor suppliers, and document risk decisions. Includes a worked example and a step-by-step Practitioner Handbook.
Learn how to prepare a professional third-party risk assessment report, summarise supplier due diligence findings, evaluate residual risk, document evidence gaps and present clear recommendations to business owners and management. Includes a completed example report and practical exercise.
Learn how to manage supplier offboarding, develop exit plans, coordinate secure data return and deletion, revoke third-party access and assess concentration and fourth-party dependencies. Includes a practical supplier migration exercise.
Learn how to monitor supplier risks throughout the relationship, establish review schedules and KRIs, respond to third-party security incidents, reassess exposure and track remediation. Includes a practical supplier monitoring and incident management exercise.
Learn how GRC analysts identify and review cybersecurity requirements in supplier contracts, including access controls, incident notification, audit rights, data protection, subcontractors, service resilience and exit arrangements. Includes practical clause examples and a contract review exercise.
Learn how to turn supplier security findings into residual risk assessments, select appropriate treatment actions, manage risk acceptance and prepare evidence-based recommendations. Includes a worked supplier approval case and practical risk decision exercise.
GRC work involves judgement, context and people. This workshop makes the fundamentals easier to understand, with clear guidance and examples you can learn from.
About the workshop