What is GRC (governance, risk, and compliance)?
GRC stands for governance, risk, and compliance: how an organization sets direction, manages uncertainty, and meets its obligations. Here's what each part means and how they fit together.
GRC stands for governance, risk, and compliance. Governance is how an organization sets direction and holds people accountable. Risk management is how it identifies, assesses, and treats uncertainty that could affect its goals. Compliance is how it meets the laws, regulations, standards, and contracts that apply to it. A GRC program connects all three, so decisions, risks, and obligations are managed with shared data.
The three parts
| Part | Question it answers | Typical activities |
|---|---|---|
| Governance | Who decides, and how do we know it's working? | Policies, roles, oversight, reporting to leadership and the board |
| Risk | What could go wrong, how likely is it, and how bad would it be? | Risk assessments, risk registers, treatment plans, key risk indicators |
| Compliance | Are we meeting our obligations, and can we prove it? | Framework assessments, control testing, evidence, audits |
Where the term comes from
The term GRC took hold in the early 2000s. After the accounting failures at Enron and WorldCom, the Sarbanes-Oxley Act of 2002 made executives personally accountable for internal controls over financial reporting, and companies found that their governance, risk, and compliance teams were answering the same questions with different data. The Open Compliance and Ethics Group (OCEG) formalized the idea: GRC is the set of capabilities that lets an organization reliably achieve its objectives, address uncertainty, and act with integrity.
Two decades later the scope is much wider. Most GRC programs now cover cybersecurity, privacy, third parties, and AI alongside financial controls, because that's where most new obligations come from.
Why connect them?
When the three run separately, the same control gets tested three times, one team's findings are invisible to the others, and leadership gets three different answers. A connected program lets one piece of evidence serve compliance and risk at once and gives leadership one view.
Take a quarterly access review. It satisfies a SOC 2 criterion, an ISO 27001 Annex A control, and the HIPAA Security Rule's access requirements. It's also evidence that a risk on your register (unauthorized access to customer data) is being controlled. In a connected program, the review is done once, filed once, and counted everywhere it applies. When it's late, the control status drops in every framework and the related risk rating goes up, without anyone updating three spreadsheets.
Frameworks GRC programs use
Most programs combine a few general frameworks with the specific regulations and standards that apply to their industry.
| Framework | What it covers | Who uses it |
|---|---|---|
| COSO Internal Control and COSO ERM | Internal control and enterprise risk management | Public companies, finance, internal audit |
| ISO 31000 | Principles and process for risk management | Any organization building a risk program |
| NIST CSF 2.0 | Cybersecurity outcomes across Govern, Identify, Protect, Detect, Respond, and Recover | Organizations of any size, often as the anchor for cyber |
| ISO/IEC 27001 | A certifiable information security management system | Companies that sell internationally or to enterprises |
| SOC 2 | An auditor's report on a service organization's controls | SaaS and service providers selling to businesses |
| Industry rules | HIPAA, PCI DSS, DORA, NYDFS 500, CMMC, and others | Organizations in those sectors |
Who does GRC?
Many organizations use the Institute of Internal Auditors' Three Lines Model to divide the work. The first line is the business and IT teams who own risks and run controls every day. The second line is risk management and compliance, who set the framework, advise, and check. The third line is internal audit, who give independent assurance to the board.
In practice, a CISO, chief risk officer, or chief compliance officer usually owns the program, a GRC team runs it, and control and risk owners across the company do much of the work. The board or its audit and risk committee oversees it.
What a GRC program does day to day
- ScopeList the laws, frameworks, and contracts that apply, and the systems, entities, and vendors they cover.
- Define controlsWrite the controls that meet those obligations, with an owner for each.
- AssessTest whether controls are designed well and working, through questionnaires, interviews, and automated checks.
- Collect evidenceKeep the records that prove each control works, dated and linked to the requirement.
- Track findings and risksTurn failures into findings, rate the risks they create, and assign fixes.
- ReportShow leadership and auditors where things stand, by framework, entity, and risk.
- RepeatRun the cycle on a schedule, and again whenever something important changes.
GRC maturity
| Level | What it looks like |
|---|---|
| Ad hoc | Work happens before audits, in spreadsheets and email. Results depend on who is doing it. |
| Defined | Policies, controls, and owners are written down. Assessments run on a calendar. |
| Managed | One system of record for controls, evidence, risks, and findings. Reports come from data. |
| Integrated | One control set serves several frameworks. Findings feed the risk register automatically. |
| Continuous | Technical controls are checked on a schedule, evidence ages visibly, and status reflects today. |
Signs your GRC program needs to change
- Every new framework starts a new project and a new spreadsheet.
- Audit prep takes weeks of screenshot collection.
- The risk register is updated once a quarter, from memory.
- Vendor questionnaires go out and nobody reads the answers closely.
- The board asks a simple question ("Are we exposed to this?") and it takes a week to answer.
- Two teams report different numbers for the same control.
What GRC software does
GRC platforms hold frameworks and controls, run assessments, collect evidence, track risks and findings, manage vendors, and report. Newer AI GRC platforms use AI agents to do much of that work, with people approving decisions.
When you compare tools, look at how they handle a second and third framework, how evidence stays current between audits, whether findings and risks share data, and how much setup your team has to do before the first assessment runs.
Getting started: the first 90 days
- Weeks 1 to 2List your obligations: the frameworks customers ask for, the regulations that apply, and the contracts with security terms.
- Weeks 3 to 4Inventory what you already have: policies, past audits, vendor lists, and any risk register, even an informal one.
- Weeks 5 to 8Pick an anchor framework, map your existing controls to it, and run a gap assessment.
- Weeks 9 to 12Assign owners to every gap, start a risk register from the findings, and set a reporting rhythm for leadership.
Metrics leaders ask for
- Share of controls passing, by framework.
- Number of open findings, by severity and age.
- Top risks against appetite, and how they moved since last quarter.
- Vendors by risk tier, and how many are overdue for review.
- Days to prepare for the next audit.
How TruOps approaches GRC
TruOps is an AI GRC platform. You upload what you already have, like policies, past assessments, SOC 2 reports, and vendor lists, and agents set up frameworks, controls, and assessments from them. Evidence from your documents and connected tools is mapped to every framework it satisfies, failed controls become findings with a recommended fix, and findings feed a live risk register. People approve every decision, and every AI answer cites its source.
What to look for
If governance, risk, and compliance are three teams using three tools, ask whether one shared set of evidence can serve all three while each team keeps working its own way.
Questions
What does GRC stand for?
Governance, risk, and compliance.
What is the difference between risk management and compliance?
Compliance asks whether you meet specific obligations. Risk management asks what could harm your goals and what to do about it. Compliance gaps are one source of risk.
Who owns GRC in an organization?
It varies. Often it's a CISO, chief risk officer, or chief compliance officer, with a GRC team running the program day to day.
What is IT GRC?
IT GRC is the part of a GRC program that covers technology: information security, privacy, IT controls, and technology vendors. For many companies today, IT GRC is most of the program.
What is the difference between GRC and ERM?
Enterprise risk management (ERM) covers all the risks to a business, including strategic, financial, and operational ones. GRC adds governance and compliance, and in many companies focuses on technology and regulatory risk. The two share a risk register and often a reporting line.
Is GRC the same as cybersecurity?
No. Cybersecurity teams protect systems and respond to threats. GRC sets the rules those teams work to, checks that controls are working, and reports the results. The two work closely, and many GRC teams sit under the CISO.
See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.