What is governance, risk & compliance (GRC)?
Directing the organisation, managing uncertainty and meeting obligations, in one joined-up approach.
Three disciplines, one aim: reliable, accountable performance.
Governance, risk and compliance (GRC) is a way of bringing together how an organisation is directed and held to account (governance), how it identifies and manages uncertainty (risk), and how it meets laws, regulations, standards and its own policies (compliance). Treating them together reduces duplication and gaps, and gives leaders a clearer view.
GRC underpins enterprise risk management, business continuity and operational resilience.
Governance, risk and compliance.
Governance
The structures, roles, policies and decision rights that direct the organisation: board and committees, strategy, delegated authority, ethics, performance and accountability.
Risk
Identifying, assessing, treating and monitoring threats and opportunities, including strategic, operational, financial, cyber, third-party and continuity risks.
Compliance
Meeting legal, regulatory, contractual and internal requirements, and being able to show evidence through monitoring, audit and reporting.
Assurance
Independent checks, such as internal audit and testing, that controls and processes work as intended.
GRC fundamentals.
Why join them up.
Governance sets direction
The board sets strategy, risk appetite and expectations, and assigns responsibility.
Risk management informs decisions
Risks are identified and measured against appetite, and treatments are chosen and funded.
Compliance sets the boundaries
Laws, regulations, standards and contracts define what must be done and shown.
Controls and policies connect them
Policies, procedures and controls turn decisions into daily practice.
Monitoring and reporting close the loop
Metrics, audits and incident reviews show whether objectives and obligations are being met.
Continuous improvement
Findings feed back into strategy, risk assessments and controls.
Common reference points.
ISO 31000
International guidance on risk management principles, framework and process.
COSO
Frameworks for enterprise risk management and internal control, widely used in finance and audit.
ISO 37000 and corporate governance codes
Guidance and national codes on how boards govern, such as the UK Corporate Governance Code.
ISO 37301
Requirements for compliance management systems.
ISO/IEC 27001
Information security management, often central to cyber and data compliance.
ISO 22301
Business continuity management system requirements. See ISO 22301.
COBIT
A framework for governance and management of enterprise IT.
Sector and regional rules
For example SAMA and central bank rules in Saudi Arabia, NCEMA 7000 in the UAE, DORA in the EU, and operational resilience rules in the UK.
What good GRC delivers.
Better decisions
Leaders see risk, performance and compliance in one place.
Less duplication
One set of controls, tests and evidence for several requirements.
Fewer surprises
Risks and breaches are found earlier, and responses are agreed in advance.
Regulator and customer confidence
Clear accountability and evidence of control.
Lower cost
Joined-up audits, reporting and tools.
Stronger resilience
Continuity, cyber, third-party and operational risks are managed with the same view.
Accountability
Named owners for risks, controls and obligations.
Culture
Ethical behaviour and speaking up are supported.
Practical steps and tools.
Clarify roles
Many organisations use the three lines model: management owns risk and controls, risk and compliance functions oversee, and internal audit gives independent assurance.
Keep a single register
Link risks, controls, policies, obligations and incidents, so one change updates all views.
Set appetite and metrics
Agree how much risk is acceptable and track key risk and key control indicators.
Use GRC software where it helps
Tools can hold registers, workflows, evidence and dashboards, but they do not replace clear ownership.
Include continuity and third parties
Link business impact analysis, continuity plans, supplier risk and incident management into the same system.
Test and report
Run control tests and exercises, and report findings to senior management and the board.
When governance, risk and compliance fail.
2001 to 2002, Enron and WorldCom
Accounting and governance failures led to the US Sarbanes-Oxley Act of 2002, which strengthened internal control and board accountability for listed companies.
2007 to 2009, global financial crisis
Weak risk oversight and excessive risk-taking in banks led to major reform, including stronger capital, liquidity and risk governance rules.
Data protection fines
Laws such as the EU GDPR allow large fines for serious data protection breaches, and drive investment in compliance and governance.
Operational resilience rules
Regulators in the UK, EU and elsewhere now require firms to identify important services and show they can stay within impact tolerances. See What is Operational Resilience?.
Third-party and concentration risk
Outages at large providers, such as the 2024 CrowdStrike incident, have led boards to look harder at supplier governance. See What is Concentration Risk?.
GCC
Regulators and standards in the Gulf, including SAMA in Saudi Arabia and NCEMA 7000 in the UAE, set expectations for governance of continuity and risk.
Examples are drawn from public reports and simplified. Check the original sources for details.
GRC questions.
Is GRC the same as risk management?
How does GRC relate to business continuity?
Do small organisations need GRC?
Do we need GRC software?
Can ADVOX help?
Talk to ADVOX about governance, risk and resilience.
We aim to reply to your enquiry within 2 hours during working hours.
Related reading: What is Enterprise Risk Management (ERM)? | What is Operational Risk? | What is Concentration Risk?