# GRC and vendor risk

**URL:** https://theauditrail.com/blog/grc/
**Published:** 2026-10-12
**Modified:** 2026-10-12
**Author:** The Audit Trail editorial desk

> How governance, risk and compliance programs run, and the software that runs them.

---

# GRC and vendor risk

How governance, risk and compliance programs run, and the software that runs them.

[GRC and vendor risk

In brief

-   OCEG defines GRC as an integrated set of capabilities for reliably achieving objectives.
-   OCEG says it coined the term in 2002, and its GRC Capability Model lists four components.

Platforms in this post

PlatformScore

![](https://theauditrail.com/logos/sprinto.png) Sprinto 84

![](/logos/vanta.png) Vanta 82

![](/logos/drata.png) Drata 76



](/blog/grc/what-is-grc/)

[

GRC and vendor risk

### What Is GRC? Governance, Risk and Compliance Explained

GRC means governance, risk and compliance. OCEG says it coined the term in 2002. Here is what each part covers, how the work is organized and what software does.

Oct 6, 2026 7 min read



](https://theauditrail.com/blog/grc/what-is-grc/)[GRC and vendor risk

In brief

-   Compliance automation runs evidence collection and control tests continuously.
-   It also automates policy, access reviews, training and vendor risk.

Platforms in this post

PlatformScore

![](https://theauditrail.com/logos/sprinto.png) Sprinto 84

![](/logos/vanta.png) Vanta 82

![](/logos/drata.png) Drata 76



](/blog/grc/compliance-automation/)

[

GRC and vendor risk

### What Compliance Automation Is and What It Automates

A definition of compliance automation and what it automates: evidence, monitoring, policy, access and vendor risk. Plus the parts that still need a person.

Oct 1, 2026 6 min read



](https://theauditrail.com/blog/grc/compliance-automation/)