The GRC Learning Model

by Steve Schlarman – July 28, 2010

The older one gets, the more one forgets what one knows.

We have all seen the enlightened “master” in movies tell the young learner “Your cup must be emptied before it can be filled” or “Clear your mind and the truth will be revealed.” The premise that one must unlearn to learn is such a common theme in so many movies that it has become a cliché. But there is a truth in that to truly master something, you have to somehow transition that knowledge from an act of concentration to an act of just doing.

We recently held an internal training session for our managers to help facilitate some organizational transitions within our groups. Part of the session was a review of an adult learning model. The point of the model was to articulate the difference between how adults learn and how children learn. Adults generally learn differently than children and, as such, any effort to teach adults a new skill, implement a new organizational approach or introduce a major change needs to take this into consideration.

The model depicted four simple stages:

1. Unconsciously unskilled
2. Consciously unskilled
3. Consciously skilled
4. Unconsciously skilled

These stages are perfectly sensible—essentially outlining the path from “not knowing what you don’t know” to “doing what you do without thinking.” I had a colleague that used the folksy phrase “a pig looking at a watch” to describe the unconsciously unskilled. His point was that although the pig could see a watch, it didn’t know what it meant. Anyone watching Michael Jordan sink a fall-away jumper with a defender hanging all over him has seen the unconsciously skilled in action. What I find interesting is that the stages have two pieces—the technical elements of skilled vs. unskilled and the mental elements of the subconscious and conscious.  
 
Another component of the model focuses on how the transition between the stages is prompted. Moving from Stage 1 to Stage 2 involves an epiphany of sorts fueled by increasing awareness and relevant examples. Moving from Stage 2 to Stage 3 requires a shift in motivation and incentive. Finally, moving up to the “enlightened” Stage 4 demands repetition and practice, practice, practice. 

Now it doesn’t take much enlightenment to draw parallels to our world of governance, risk and compliance (GRC). If we apply this model to the objectives within our organization, we can see that GRC is not just the mechanics of audit, security and the controls in business processes but also the cultural and psychological growth of the organization. It seems to me that these stages outline the fundamental transition that all organizations are looking to achieve for GRC. If we want our organization to really implement governance, understand risk and manage compliance, then we need to help the organization “learn” the way adults do.

As GRC leaders in our organizations, we can take a step back and analyze just where our organization is in this continuum:

• Is the organization still in the “don’t know what we don’t know” stage?
• Has it reached the consciously unskilled stage where it really understands what skills it needs but lacks the motivation to progress?
• Does the organization need an epiphany or merely more time to practice?

Thinking in these terms brings to light some of the needs of the GRC efforts outside the mere technicalities of policy, controls and audit. True organizational change is the only thing that will push a GRC program toward enlightenment. This is where the cultural and psychological components of the program have to be pushed as hard as the mechanics. We all would like to see our organization begin to unconsciously incorporate well designed controls into business processes. The trick is to get the organization to move up this scale one step at a time.

Many times, risk and compliance professionals can get caught in the trap of teaching their organizations the way children need to be taught. Telling people over and over the “right way” to do things, making people learn by rote and other methods targeting a green-field mind do not work when you are trying to teach an organization of mature professionals. These simple tenets of adult learning, when applied to the grand scale of an organization, might help identify some of the reasons why GRC is not taking hold as well as one would hope in the organization. 

Take a moment to evaluate how the risk and compliance activities are being presented to the organization. You may find that while the skilled is winning over the unskilled, the long-term strategic win comes when the unconscious wins over the conscious. Think of the pride you would have if your organization would sink a game-winning shot over the outstretched hand of a defender in a pure, fluid motion of unconscious skill.

Published Jul 28 2010, 03:24 PM by Sarah Nord (Historical)

Comments

 

The GRC Learning Model | Forge network said:

Pingback from  The GRC Learning Model | Forge network

August 1, 2010 11:03 AM
 

Twitter Trackbacks for The GRC Learning Model [archer.com] on Topsy.com said:

Pingback from  Twitter Trackbacks for                 The GRC Learning Model         [archer.com]        on Topsy.com

July 28, 2010 4:35 PM

Leave a Comment

 

About Sarah Nord (Historical)

As Archer Marketing Communications Manager for RSA, The Security Division of EMC, Sarah Nord oversees the planning, development, delivery and analysis of strategic marketing programs. She also serves as senior writer and editor for RSA Archer marketing content, including web copy, press releases, data sheets, case studies and blog posts. Sarah holds a BA in Professional Writing and an MA in Writing from Missouri State University. She is also RSA Archer Certified.