Free preview lesson · Governance, Risk & Compliance Foundations · Module 1: GRC foundations
What governance, risk and compliance mean
Governance, risk and compliance are often lumped together, but each answers a different question. Separating them makes security programmes easier to run.
Governance
Governance sets direction: who makes security decisions, what policies exist, how much risk the organisation is willing to accept and how leaders are kept informed.
Risk management
Risk management identifies what could go wrong, how likely it is and how much it would hurt, then decides whether to reduce, transfer, avoid or accept each risk. It turns vague worry into prioritised action.
Compliance
Compliance shows that the organisation meets external obligations — laws, contracts and standards — and its own policies. It relies on evidence: records that controls exist and are working.
Common pitfall
Treating compliance as the goal. Passing an audit does not mean risks are well managed; it means specific requirements were evidenced at a point in time.
Action step
For your organisation or a familiar one, name one example each of a governance decision, a managed risk and a compliance obligation.
This is one lesson from Governance, Risk & Compliance Foundations.
Educational content only. No income, revenue or earnings results are promised or implied. No certification, licence or professional credential is awarded.