Teaching · Pierre-Paul Ferland
AI can read the policy. Teach it what you notice.
A missing report, a green dashboard, six findings. The interesting part is how an experienced GRC practitioner decides what matters.
Try a case, then see how that reasoning becomes a reusable AI skill. Each takes about two minutes.
Pick a case ↓Invite me to speak →
The case files
Pick the problem you recognize.
Choose a next move, see its consequence, then teach the assistant what to notice when a new fact arrives. Wrong answers explain themselves. There is no score.
The missing report
A team wants an AI tool to summarize calls. They can test it with made-up calls today. Next month they want to use customer recordings. The vendor has no SOC 2 report.
1 / Choose the next move
What do you do first?
Something changed.
A customer contract forbids outside transcription unless the customer agrees. The pilot sponsor says the test went well.
2 / Teach the assistant
What should your AI assistant remember?
Try it at work: Ask for the data flow and the customer promise before the approval meeting.
The green check
The dashboard says backups are encrypted. Yesterday a product team moved them to a new location. Last month's evidence screenshot still shows green.
1 / Choose the next move
What do you check first?
Something changed.
The new location is encrypted, but backups now disappear after 14 days. Your policy says 30.
2 / Teach the assistant
What should your AI assistant remember?
Try it at work: Pick one control and name the system change that would make its evidence stale.
Six findings
Six teams missed an access review. Your AI assistant creates six separate medium risks. You notice they all use the same approval process.
1 / Choose the next move
What do you ask next?
Something changed.
Two teams review privileged admin access. The other four review low-impact internal tools.
2 / Teach the assistant
What should your AI assistant remember?
Try it at work: Take three repeat findings and ask whether they share a broken process.
The surprise connection
A finance team connected an AI note tool to company Drive. It never went through intake. The app appears in an OAuth grant log.
1 / Choose the next move
Where do you start?
Something changed.
The team says it only summarized public decks. The grant allows the app to read every file the user can access.
2 / Teach the assistant
What should your AI assistant remember?
Try it at work: Look at one OAuth grant before you send another discovery questionnaire.
The rubber stamp
A manager is asked to approve 300 user access entries by Friday. One group is called finance-admin. Nobody has explained what that group can actually do.
1 / Choose the next move
What would make the review honest?
Something changed.
One person still has admin access for emergency support, but has not used it in 18 months.
2 / Teach the assistant
What should your AI assistant remember?
Try it at work: Translate one opaque role name into the actions it permits.
The all-green deck
The board asks whether security risk improved. An AI assistant drafts 15 slides of green metrics. A critical vendor issue remains unresolved.
1 / Choose the next move
How do you open the conversation?
Something changed.
The board asks whether to fund better vendor monitoring or continue manual reviews.
2 / Teach the assistant
What should your AI assistant remember?
Try it at work: Replace one dashboard slide with the question leadership must answer.
All organizations and details in these cases are fictional. The useful part is the reasoning you can test against your own work.
How I teach
The expert is the starting point.
At Cégep, I use AI as a planning and building partner in identity and access management. Students learn to challenge its suggestions and understand the technical system well enough to catch an answer that sounds right but fails in practice.
In GRC, I had ChatGPT interview me about decisions I make: what signals I notice, what exceptions I allow, and what I know about the people involved. Those answers became reusable heuristics in a skill. I teach others to do the same with their expertise, connect those skills to changing signals from systems and APIs, and test them on past cases.
Models can interpret messy meaning that a fixed rule misses, but their answers vary. The expert sets the standard, corrects the failures, and keeps the relationships. That makes GRC more prepared for real conversations, and more likely to act before a problem becomes a quarterly surprise.
Take this to your own work
Interview yourself before you write a prompt.
Start with one decision you make often. Then teach the assistant the reasoning behind it.
Interview me about one GRC decision I make repeatedly. Ask one question at a time. Use a real past case to find the signals I noticed, the exceptions I allowed, the relationships that mattered, what changed my mind, and when I needed another person to decide. Draft a reusable skill that names its data sources, reasoning and limits. Test it on three past cases. Show me where it fails so I can teach it better.
Bring the cases into the room.
I can turn these decisions into a practical session for GRC or security teams, or speak about the bigger shift: GRC that understands technical systems and uses AI to make judgment more useful.
See speaking topics →Explore the working demos →