Governance, Risk, and Compliance (GRC)

Governance, Risk and Compliance, or GRC for short, refers to a company’s coordinated strategy for managing the broad issues of corporate governance, enterprise risk management (ERM) and corporate compliance with regard to regulatory requirements.

Specifically, the three pillars of GRC are:

Governance – The effective, ethical management of a company by its executives and managerial levels.
Risk – The ability to effectively and cost-efficiently mitigate risks that can hinder an organization’s operations or ability to remain competitive in its market.
Compliance – A company’s conformance with regulatory requirements for business operations, data retention and other business practices

Defining Governance, Risk and Compliance

While many experts and GRC vendors disagree on a standard definition for Governance, Risk and Compliance, the Open Compliance and Ethics Group (OCEG) has published one of the most comprehensive GRC definitions. In its GRC Capability Model, Red Book, 2.0, the OCEG defines GRC as a “system of people, processes, and technology that enables an organization to:

Understand and prioritize stakeholder expectations.
Set business objectives that are congruent with values and risks.
Achieve objectives while optimizing risk profile and protecting value.
Operate within legal, contractual, internal, social, and ethical boundaries.
Provide relevant, reliable, and timely information to appropriate stakeholders.
Enable the measurement of the performance and effectiveness of the system.”

GRC Solutions and Services

GRC business policies, software solutions and services enable companies to implement, manage monitor and measure the effectiveness of their Governance, Risk and Compliance strategies. GRC strategies rely on clearly defined, objective measurables for providing companies with insight into the overall effectiveness in each area of governance, risk and compliance.

Because GRC strategies span the entire organization, these tools and policies require management and coordination across numerous departments in an enterprise, including IT, management, security, compliance and auditing.