Governance, risk & compliance (GRC)
Joining up governance, risk management and compliance with business continuity and operational resilience.
One clear view of how the organisation is run, what could go wrong and what it must do.
Many organisations manage governance, risk, compliance, audit, security and continuity in separate teams, with separate registers and reports. ADVOX helps you bring them together, so responsibilities are clear, controls are shared, evidence is reusable and leaders see one picture.
New to the subject? Start with What is Governance, Risk & Compliance (GRC)?.
GRC consulting services.
GRC framework and operating model
Define roles, committees, the three lines model, reporting lines and how governance, risk, compliance and continuity fit together.
Policies and procedures
Review and write policies, standards and procedures, with clear owners and review cycles. See BCMS Policies, Procedures & Processes.
Risk management and appetite
Risk methodology, registers, appetite statements, key risk indicators and links to ERM consulting.
Regulatory and standards mapping
Map obligations, such as ISO standards, SAMA, NCEMA 7000, DORA or UK rules, to controls, and remove duplicated effort.
Third-party and concentration risk
Supplier assessment, tiering, exit planning and monitoring. See concentration risk and supply chain risk.
Controls, assurance and audit readiness
Control libraries, testing plans, evidence collection and preparation for internal, external and regulatory audit.
Continuity and resilience in GRC
Link the business impact analysis, continuity plans, exercises and incident management into the same registers and reports.
Reporting and dashboards
Board and committee reporting, metrics and tools to show risk, compliance and resilience status. See BCMS software and automation.
Common reference points.
| Standard or framework | What it covers | Typical use |
|---|---|---|
| ISO 31000 | Risk management principles, framework and process. | Basis for a risk management approach. |
| ISO 37000 | Guidance on the governance of organisations. | Board and governance design. |
| ISO 37301 | Compliance management systems. | Managing legal and other obligations. |
| ISO 37001 | Anti-bribery management systems. | Integrity and anti-corruption controls. |
| ISO/IEC 27001 and 27002 | Information security management and controls. | Cyber and data security governance. |
| ISO 22301 and ISO 22313 | Business continuity management systems and guidance. | Continuity governance and certification. See ISO 22301. |
| ISO 22316 | Organisational resilience principles. | Embedding resilience in governance. |
| ISO 22320 | Emergency management and incident response guidance. | Incident and crisis governance. |
| ISO 45001 | Occupational health and safety management. | Safety governance. See Emergency Planning. |
| ISO 38500 | Governance of IT. | Board oversight of technology. |
| COSO ERM and Internal Control | Enterprise risk management and internal control frameworks. | Finance, audit and control environments. |
| COBIT | Governance and management of enterprise IT. | IT governance and control objectives. |
| NIST Cybersecurity Framework and NIST risk guidance | Cyber risk governance and risk management. | Cyber risk and control mapping. |
| BCI Good Practice Guidelines | Good practice across six Professional Practices. | Continuity programme design. See GPG. |
Standards are updated from time to time. Check the current edition and your certification body’s requirements.
Examples relevant to our clients.
| Region or sector | Examples | What they relate to |
|---|---|---|
| Saudi Arabia | SAMA Business Continuity Management Framework and cyber security framework; national data protection law. | Financial sector continuity, cyber and data governance. |
| United Arab Emirates | NCEMA 7000 (national business continuity standard); central bank and free zone requirements; federal data protection law. | Continuity, sector rules and data protection. |
| Other GCC states | Central bank and sector regulator requirements on outsourcing, operational resilience and cyber risk. | Financial and critical sectors. |
| European Union | DORA (digital operational resilience for financial entities); NIS2 (network and information security); GDPR. | ICT risk, third parties, cyber and data protection. |
| United Kingdom | Operational resilience rules from the PRA and FCA; UK Corporate Governance Code; UK GDPR; Civil Contingencies Act for responders. | Important business services, impact tolerances and board accountability. |
| International banking | Basel Committee principles for operational resilience and sound management of operational risk. | Bank resilience and risk governance. |
| United States | Sarbanes-Oxley (internal control over financial reporting); sector rules such as HIPAA; SEC cyber disclosure rules. | Financial reporting, health data and cyber disclosure. |
This is a general summary and not legal advice. Check the current requirements that apply to you with your regulator or legal adviser.
Why GRC matters.
2001 to 2002, Enron and WorldCom
Accounting and governance failures led to the US Sarbanes-Oxley Act, strengthening internal control and board accountability.
2007 to 2009, global financial crisis
Weak risk governance contributed to reforms on capital, liquidity and risk oversight.
2018 onwards, GDPR
Large fines for data protection failures made privacy compliance a board-level issue.
2021 to 2025, operational resilience rules
UK, EU and international regulators asked firms to identify important services, set impact tolerances and manage third-party risk.
July 2024, CrowdStrike outage
A supplier’s faulty update disrupted many sectors, bringing supplier governance and concentration risk to board agendas.
Regional resilience
Gulf regulators and national standards increasingly require tested continuity and clear governance. See our 2026 GCC Incident Log.
Examples are drawn from public reports and simplified.
A practical approach.
Assess
Review governance, risk, compliance, audit, security and continuity arrangements, and find overlaps and gaps.
Design
Agree the operating model, taxonomy, risk appetite, control set and reporting.
Build
Create the policies, registers, control library, roles and templates, and configure tools if needed.
Embed
Train owners and committees, and set review cycles and metrics.
Assure
Test controls and exercises, prepare for audits and regulators, and report to leadership.
Improve
Use incidents, audits and changes in rules to refine the system.
GRC consulting questions.
Do we need a GRC tool?
How does GRC connect to ISO 22301?
Which regulations apply to us?
Can you provide training?
Talk to ADVOX about governance, risk and compliance.
We aim to reply to your enquiry within 2 hours during working hours.