Introduction

GRC is a term that is bandied about in the enterprise software market quite frequently, although in reality GRC is a term used to describe processes that every company has, even without knowing it. This article will present a comprehensive discussion of GRC including why there is a need for GRC.

What GRC Stands For

GRC stands for Governance, Risk Management, and Compliance; three interrelated but different concepts that organizations today are handling in tandem:

Governance

The processes, systems, and controls by which the organization is run and to whom responsibilities lie.

Risk Management

The process of recognizing, evaluating, and addressing risks that might arise in financial, operational, legal, cybersecurity, and reputational aspects.

Compliance

Ensuring that the organization is compliant with all relevant laws and regulations and its own internal policies.

Separately, each of them existed for a long time before “GRC” became a popular acronym. The combination of all three is an obvious conclusion that governance decisions impact risk exposures, which are, in turn, determined by compliance deficiencies, which, in their turn, are defined by governance policies.

Why GRC Became Its Own Discipline

With increasing regulations, there was a need for data protection laws, sectoral regulations, accounting standards, cyber security regulations, and so on; however, it turned out that separating governance, risk, and compliance activities resulted in an inefficient process because the same risk could be evaluated independently by three different departments utilizing different methodologies and different definitions of severity.

GRC allows having only one single perspective on risks and compliance status throughout the organization.

Who’s Responsible for GRC

Where there are fewer people in an organization, the GRC duties tend to be shared among a compliance officer, a risk manager, and heads of different departments. Where there are many people working in an organization, more so in regulated industries such as finance, health care, and insurance, GRC tends to be a separate function with its own leadership and team.

Another important entity in this process is the Board of Directors because the final responsibility of governance lies with the board members.

Common GRC Frameworks and Standards

It is extremely uncommon for organizations to develop GRC processes without starting with a framework. Frameworks used by organizations include the following:

• ISO 31000 – General framework for managing risks
• COSO – A framework for internal controls and enterprise risk management, especially popular in the US
• NIST frameworks – Used in the area of cybersecurity risk
• Industry specific framework – For example, HIPAA for the healthcare industry or SOX for public company financial reporting

The benefit of using an existing framework is that you get the process structure without having to create it all yourself, and it usually simplifies audits conducted outside your organization, since the assessor knows the framework well.

How Organizations Actually Run GRC Day to Day

The process flow for GRC is as follows:

1. Identifying Risks and Applicable Regulatory Requirements

Identification of risk and relevant regulation in the organization.

2. Assessing the Likelihood and Impact of Identified Risks

Evaluating the probability and consequence of identified risks.

3. Implementing Controls and Policies

Implementation of measures that would minimize identified risks.

4. Monitoring Controls and Compliance

Ensuring that control is effective and regulations are met.

5. Reporting to Leadership and Regulators

Providing the status to leaders, as well as to outside regulators when needed.

6. Auditing Periodically

Conducting audits regularly to ensure that everything works according to plan.

The process goes on continually rather than being a one-time exercise, because rules and risks change, and organization structure changes as well.

Why GRC Has Become More Complex Recently

There have been several factors in recent times that have added a lot to the workload of GRC practices in numerous organizations including the increase in data privacy laws like GDPR and CCPA or similar ones in other regions, increasing needs regarding cybersecurity in line with insurance and vendor contracts, and increasing customer and partner demands for assurance that a vendor can comply with compliance regulations (SOC 2 or ISO 27001) for making a deal happen.

GRC practice has therefore shifted from being just an internally-focused defensive exercise to one that has commercial consequences. Deals have been stalled or even killed when no such compliance certification was in existence.

Manual GRC vs. Software-Supported GRC

The smaller organization or the one with less regulatory compliance requirements will have GRC carried out using manual, spreadsheet-based, and document-sharing approaches. It may work on a smaller scale but will not work efficiently as regulations and controls increase; hence, many organizations choose to go with GRC software eventually.

Bottom Line

GRC is needed since governance, risk, and compliance are highly interrelated and cannot be managed in isolation without causing inefficiencies and gaps. Whether using spreadsheets or software, the process remains the same as identification of risks and requirements, control implementation, monitoring, and reporting to management and regulators.