Governance, risk and compliance
GRCAlso called integrated risk management, enterprise GRC
Governance, risk and compliance (GRC) is the way a firm directs itself, manages its risks and meets its legal and regulatory duties as one joined-up system. Governance sets accountability and oversight. Risk management identifies and controls threats. Compliance checks that rules are followed. Regulators expect boards to see all three together.
How it works
At a bank or insurer, GRC links the board, senior managers and the three lines of defence. Policies set out who owns each risk. Controls are mapped to risks and to regulatory obligations. Testing results, incidents and audit findings flow into one record, so the board and regulators can see where the firm is exposed and who is accountable.
GRC matters because regulators judge firms on evidence, not intentions. UK listed companies must now declare whether their material controls work. US public companies certify internal control over financial reporting. Fragmented spreadsheets make that evidence hard to produce. Firms that keep risks, controls and obligations in one system answer supervisory requests faster and spot control gaps earlier.
The rules
Boards must monitor the risk management and internal control framework and declare in the annual report whether material controls were effective at the balance sheet date.
Premium and commercial companies listed in the UKManagement must assess and report annually on internal control over financial reporting, with auditor attestation for larger filers.
SEC-registered public companiesFirms must have clear organisational structures, independent risk management, compliance and internal audit functions, and a board that oversees them.
Credit institutions and investment firms under CRDSets 13 principles on board responsibilities, risk governance, the three lines of defence and the roles of the chief risk officer and compliance.
BanksCommon questions
What does GRC stand for?
GRC stands for governance, risk and compliance. It describes how a firm combines board oversight, risk management and regulatory compliance into one framework, so that risks, controls, policies and obligations are owned, tested and reported in a consistent way.
Is GRC a legal requirement?
No single law requires something called GRC. The elements are required separately. Banking rules require independent risk and compliance functions, listing rules require boards to oversee internal controls, and securities laws require reporting on financial controls. GRC is the practice of running these together.
How does GRC relate to the three lines of defence?
The three lines of defence assign roles within GRC. The business owns and manages risk. Risk and compliance functions set standards and challenge. Internal audit gives independent assurance to the board. A GRC framework records how each line performs its part.
What is a GRC platform?
A GRC platform is software that holds a firm's risk register, control library, policies, regulatory obligations, issues and audit findings in one place. It links them, so a failed control can be traced to the risk and rule it supports.
Our coverage
News and analysis on GRC and resilience from RegTech Post.
Read the coverage →RegTech PostThe Future of GRC Platforms: AI, Automation, and Risk PredictionRead the article →RegTech PostUnified Compliance: Breaking Down Silos in Risk and GovernanceRead the article →
