Governance Theatre vs Reality: Fixing the Operating Model Behind Control Failures

Foredragsholder

Ekaterina Zuckermann

Senior GRC & Security Governance Consultant | Operating models that survive audits and reality

Senior consultant in information security governance, risk management, and compliance (GRC), with close to 20 years’ experience supporting organizations in regulated environments. I focus on turning frameworks and regulatory expectations (including ISO/IEC 27001 and NIS2) into operating models that work in practice: clear decision rights, single-point accountability, audit-ready evidence flows, and pragmatic exception governance. My work typically sits at the intersection of security management, internal control, IT delivery, and crisis readiness, with an emphasis on reducing governance friction while improving assurance outcomes.

Om sesjonen

Many organizations have the frameworks: ISO/IEC 27001-aligned policies, risk registers, control descriptions, and audit routines. And still, daily delivery feels like pushing a fridge uphill. Evidence is duplicated across tools. Exceptions are handled in hallway conversations. IT teams quietly become default “control owners” without mandate. Audits trigger fire drills instead of assurance.

This session is an anonymized case story from a regulated, multi-site enterprise where change management worked, but everything around it (access governance, exception handling, evidence collection, readiness) created friction and risk. The core message is blunt: these failures are rarely caused by “missing controls.” They are caused by operating model design: unclear decision rights, split accountability between IT and GRC (Governance, Risk and Compliance), parallel tooling and documentation streams, and processes that look coherent on paper but collapse under delivery pressure.

I’ll map the symptom pattern to root causes, then show the minimum governance redesign that actually changed outcomes: decision-point RACI (Responsible/Accountable/Consulted/Informed), one intake and exception path, evidence designed as a byproduct of delivery, and reporting built for decisions rather than theatre. Attendees leave with a practical diagnostic and interventions they can apply without launching a two-year transformation program.

Samtidig i programmet

1. 09:00 The Invisible Privileged User: Attack Path Mapping Across Your Software Delivery Chain 1 · Frimurerlosjen, rom 1
2. 09:00 I Like Big Shares and I Cannot Lie 1 · Frimurerlosjen, rom 2
3. 09:00 Cryptography and export controls 10 · HeartBox ,Teatersalen
4. 09:00 Når OT møter Cloud-Native – muligheter og risikoer i skjæringspunktet 10 · HeartBox, Byscenen
5. 09:00 AI-agenter og personvern: Trenger jeg en DPIA? 11- Breiseth, Storlon
6. 09:00 How to prioritise within OT in light of a chaotic time 2 · Home hotel Hammer, moen nede
7. 09:00 Når fysisk sikkerhet blir Shadow IT – hvem eier egentlig kameraene, adgangskontrollen og IoT-enheten 2 · Home hotel Hammer, moen oppe
8. 09:00 Kartlegging av høyrisikoroller og menneskelige sårbarheter 3 · Hvelvet, Gullsalen
9. 09:00 Våre Sårbare Nettverk 4 · Kommunestyresalen, Lillehammer rådhus
10. 09:00 Deepfake Detection in the Real World 5 · Kulturhuset Banken, Expedisjon
11. 09:00 Offense is the best defense: The Evolution of Ukrainian Cyber Capabilities and Lessons for Europe 5 · Kulturhuset Banken, Festsalen
12. 09:00 Bli en del av Norges beredskap 5 · Kulturhuset Banken, Holbøsalen
13. 09:00 Design Intent vs Digital Residue: Inside a Forensic Research Pipeline 5 · Kulturhuset Banken, Kafeen
14. 09:00 Sikkerhetskultur: erfaringer fra en innenfra-og-ut-tilnærming! 6 · Lillehammer kino, sal 4
15. 09:00 When threats become multifaceted: How the police prioritize in a complex environment 9 · Victoria Scandic, sal 1+2
16. 09:00 Hvem eier krisen? – Når sikkerhetshendelsen treffer på tvers av 200 autonome team 9 · Victoria Scandic, sal 3
17. 09:15 Fra analyse til gjennomføring- effektiv fysisk sikring i politiet 2 · Home hotel Hammer, moen oppe