Three disciplines, one purpose
Governance, Risk and Compliance (GRC) is the set of practices that lets an organisation make deliberate decisions about security and risk, prove it is doing what it says, and meet the obligations placed on it by law, contract and industry. The three words are related but distinct, and understanding the difference stops the function becoming a paperwork exercise.
The three parts
- Governance is how decisions are made and who is accountable. It covers the policies that state what the organisation requires, the roles that own those requirements, the committees or forums where risk is discussed, and the reporting that keeps leadership informed. Good governance means security decisions are made by the right people with the right information.
- Risk management is the process of identifying what could go wrong, estimating how likely and how damaging it would be, deciding what to do about it, and tracking whether those decisions worked. It turns an endless list of possible problems into a prioritised set of actions.
- Compliance is meeting external and internal requirements: laws and regulations, contractual commitments to customers, industry standards the organisation has adopted, and its own policies. Compliance provides evidence to outsiders that controls exist and operate.
How they fit together
Governance sets direction and accountability. Risk management decides where to spend effort. Compliance proves the effort happened. An organisation with compliance but no risk management does what auditors ask and nothing more. An organisation with risk management but no governance has good analysis nobody acts on. An organisation with governance but no compliance has policies it cannot prove it follows. The three reinforce each other.
Why it matters to operators
GRC is often seen as overhead. In practice it is what gets security budget approved, what wins enterprise customers who demand evidence, what keeps regulators satisfied, and what ensures the organisation fixes the right problems first. A small, well-run GRC function is one of the highest-leverage activities a security program can have.
Step by step: assessing where you stand
- List the policies that exist, when they were last reviewed and who owns each.
- Ask whether a risk register exists, how many risks it holds and when it was last updated.
- List the external obligations the organisation faces: regulations, customer contract clauses, standards it claims to follow.
- Identify where risk is discussed with leadership and how often.
- Note the gaps: missing policies, no register, unknown obligations, no forum.
Worked example
A growing software company has an information security policy written three years ago by a departed employee, no risk register, and three enterprise contracts that commit it to annual penetration tests and an incident notification window it has never measured. There is no regular forum where leadership hears about security risk. The assessment produces a clear starting list: refresh and assign the policy, start a register with ten risks, catalogue the contract obligations and schedule a quarterly risk review with the executive team.
Common mistakes
- Treating GRC as a compliance checklist rather than a decision-making system.
- Writing policies nobody is accountable for.
- Not knowing what has been promised to customers in contracts.
Action Step: Complete the five-step assessment for your organisation and write down the three biggest gaps.