What is Governance, Risk & Compliance (GRC)?

Governance, Risk, and Compliance (GRC) is an all-embracing and widely- recognized term covering an organization's policies, approach, functions, and activities spanning these three aspects of business.    Read More

Governance lays out the high-level management approach through which executives direct and control an organization. Governance defines the structure, policies, information management, controls, and objectives of the organization. Activities associated with governance ensure that all information vital to executive management is presented in a viable manner, and executive decisions, strategies, and directions flow effectively down the organization.

Risk. The term risk covers a wide range of uncertainties in areas of operational, financial, strategic and regulatory compliance activities. These uncertainties may include lack of information, understanding or knowledge of an event, its consequence or likelihood.

Aspects of risk include uncertainties in achieving objectives such as financial, health and safety and environmental goals, and can affect all levels of the organization including strategic planning, project management, products and processes.

Risk Management is defined as the coordinated activities necessary to direct and control an organization with regard to risk.

Compliance means conforming to necessary requirements and regulations. Internally, this relates to the actions necessary to first identify and then comply with applicable rules and standards such as internal strategies, policies, and procedures. Compliance also includes the ability to identify and meet the requirements of external regulations and laws, contractual obligations and regulatory bodies. On the organizational level, this is achieved through management processes which identify the applicable requirements (defined for example in laws, regulations, contracts, strategies and policies) These processes assess the state of compliance, the risks, and the potential costs of non-compliance against the projected expenses needed to obtain compliance, and thus determine priorities, funding required, and implementation of any corrective actions necessary.

Governance, Risk and Compliance (GRC) management is thus a closely related group of activities vital to the successful running of any business enterprise. Through correct integration of these functions, an organization can streamline its processes and avoid overlapping activities or gaps in GRC requirements and framework.

GRC encompasses and has come to supersede such terms as corporate governance, enterprise risk management (ERM), and operational risk management.