Present a GRC portfolio project without overstating experience

An educational GRC project should show how you think and document work. It should also say plainly that the organization, records or findings are fictional. A reader should never have to discover halfway through an interview that the “client engagement” was a practice exercise.

You can make a modest project worth discussing without inventing scale. One coherent case with a well-supported decision is more informative than a folder full of disconnected templates.

Start with a bounded question

Consider this original project brief: a fictional company is assessing a document-processing supplier before allowing customer data into a pilot. The evidence package includes a policy, an account export and an incomplete review worksheet. Your task is to decide what the records support and prepare a targeted follow-up request.

The question is narrow enough to finish. You are not certifying the supplier, conducting a complete security audit or claiming that an access review resolves every privacy and security consideration.

Give the file a readable structure

Use a small set of artifacts that connect to each other:

1. README: the question, fictional context, scope, assumptions and instructions for reading the file.
2. Evidence register: IDs, source type, date, scope and limitations for each supplied record.
3. Analysis worksheet: the claim being evaluated, supporting evidence and unresolved questions.
4. Follow-up request: the specific records needed and why they would change the analysis.
5. Decision memo: what is supported now, what remains uncertain and who should decide next.

Give every artifact a purpose. A risk matrix is not automatically useful simply because it looks like something a professional might use. If your ratings have no defined criteria or relationship to the scenario, they create false precision.

Make uncertainty visible

In the example, a spreadsheet lists 18 accounts. You do not know whether it includes service accounts or whether the export covers the complete service. Record those questions explicitly. Avoid silently treating the supplied list as a complete population just so you can finish a neat-looking assessment.

Your memo could say: “The supplied worksheet records review decisions for 18 listed accounts. The package does not establish population completeness, and two account decisions remain unresolved. I would request the source-query scope and the disposition of those items before supporting a customer-data approval decision.”

That is an original fictional response, not a formal assurance opinion. A real engagement would use its approved methodology, criteria, access permissions and review process.

Show a revision after new evidence

Add a second round of facts. Suppose the vendor provides a reconciled export and tickets resolving the two questions. Update the evidence register and explain which earlier limitations are now addressed. Do not erase the original version; show the change.

You may still have unanswered questions outside this access-review scope. A good revision explains what changed and what did not. It does not jump from “two gaps resolved” to “the vendor is safe.”

Describe the project in an interview

Begin with the label: “This is a fictional project I built to practice evidence review.” Explain the decision, the documents and one point where you changed your reasoning. Then discuss what would be different in a real environment: access to source systems, an agreed population, approved procedures and review by the responsible team.

Keep project material separate from employment history. Do not publish copied employer reports, customer information or proprietary questionnaires without authorization. Your own fictional case can demonstrate care without exposing someone else's records.

Try the free evidence desk for a bounded example you can work through before designing a larger portfolio.

A relevant next step

The Risk & Evidence Portfolio Kit develops a connected fictional file with blank and completed companions. Its actual preview is available before purchase.

Define the contribution before building

Use the free portfolio brief builder to choose GRC, IT audit or third-party risk, define one fictional decision and write an honest description of your planned work. Download the brief as a specification; it is not a completed project or evidence of professional experience.