Explain due care versus due diligence and give an example of each.

Senior governance roles live and die by this distinction because it maps directly to legal liability. Interviewers ask it to see whether you understand that knowing about a risk and acting on it are separate obligations.

Due diligence: knowing

Due diligence is the investigation, research, and ongoing oversight that builds understanding of an organization's risks and the controls available to address them. Running risk assessments, vetting a vendor's security posture before signing, monitoring the threat landscape, and reviewing audit findings are all due diligence. In short, due diligence is doing your homework to know what should be done.

Due care: doing

Due care is acting on that knowledge — implementing and maintaining the reasonable controls a prudent person would put in place. Deploying the patch you learned you needed, enforcing the policy you wrote, training staff, and keeping controls running over time are all due care. Due care is doing what should be done.

The prudent person rule

Both tie back to the prudent person rule: courts judge whether leadership acted as a reasonable, careful person would have under the same circumstances. An organization that performed diligence (it knew the risk) but skipped care (it never acted) is exposed to negligence claims. Demonstrable due care — documented, consistent, reasonable action — is a core defense against liability.

A clarifying example

A company runs an annual risk assessment and learns a critical server is unpatched: that is due diligence. Actually applying the patch and verifying it: that is due care. Knowing and not acting is the dangerous gap.

What interviewers look for

The clean "diligence = knowing, care = doing" split, the link to the prudent person rule, and awareness that due care is the legal shield against negligence.