What Is GRC? Governance, Risk and Compliance Explained

GRC stands for governance, risk and compliance. OCEG, the nonprofit that says it coined the term in 2002, defines GRC as “the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty, and act with integrity.” In plain words, GRC is how a company decides what it wants, works out what could stop it and shows that it follows the rules that apply.

ISACA’s glossary calls GRC “a business term used to group the three closely related disciplines responsible for operations and the protection of assets.” NIST’s glossary lists GRC as an abbreviation used across its publications. Software built for this work is called GRC software.

Where the term comes from

OCEG says it used the acronym as early as 2002, and says its founder, Scott Mitchell, published the first peer-reviewed academic paper on GRC in 2007. OCEG describes its GRC Capability Model, now at version 3.5, as an open-source standard that joins governance, strategy, risk, audit, compliance, ethics, culture and IT into one approach. It suggests using the model alongside narrower frameworks from ISO, COSO, ISACA, the IIA and NIST.

What each letter covers

Governance is who sets the objectives and who answers for them. OCEG says GRC “includes work done by departments in governance, strategy, risk, compliance, security, audit, finance, legal, IT, and HR,” and also work by operators in lines of business, the executive suite and the board itself. The IIA released its Three Lines Model in 2020 and describes the roles of management, the governing body and internal audit.

Risk is the uncertainty between a company and its objectives. Gartner defines GRC tools as tools “designed to support a holistic enterprise risk management (ERM) process, encompassing risk identification, assessment, mitigation, monitoring and reporting.” A risk register is the usual working record, with an owner and a treatment plan for each risk.

Compliance is meeting the rules that apply, whether a law, a contract or a published standard. For a technology company those rules often arrive as frameworks such as SOC 2 and ISO 27001, and each framework brings its own controls, evidence and audit.

OCEG lists what follows when these functions run apart: high costs, lack of visibility into risks, inability to address third-party risks, difficulty measuring risk-adjusted performance and too many negative surprises.

Why companies run GRC

OCEG names several drivers: stakeholders who demand high performance along with transparency, regulations that keep changing, the growth of third-party relationships and costs of addressing risks and requirements that are hard to control. OCEG says organizations that integrate GRC processes and technology across all or many silos have reduced costs, reduced duplication of activities and greater ability to gather information quickly and to repeat processes consistently.

GRC, compliance management and compliance automation

The terms nest. GRC is the widest. ISACA’s glossary uses it to group three disciplines, and Gartner defines GRC tools around an enterprise risk management process.

Compliance management software is the next layer in. It organizes the risk register, policies, auditor access and task owners around one or more named frameworks.

Compliance automation sits inside that layer. It is the set of integrations and automated tests that collect evidence on a schedule. NIST defines continuous monitoring as “Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.”

Integrated risk management, or IRM, is the label ServiceNow uses for its product. ServiceNow describes IRM as “an approach to risk management that connects IT, cyber, compliance, and operational risk across the enterprise, replacing silos with unified visibility.” IRM and GRC name overlapping products, so a buyer should read the module list rather than the label.

The four components of a GRC program

OCEG’s GRC Capability Model, also known as the Red Book, describes the work in four components.

Learn means understanding the company’s context, culture and key stakeholders, which informs the objectives. Align ties strategy to those objectives and actions to the strategy, so that decisions weigh values, opportunities, threats and requirements.

Perform is where the controls live: actions that promote desirable things, prevent and remediate undesirable things, and detect events as soon as possible. Review checks the design and the operating effectiveness of the strategy and the actions, and asks whether the objectives still make sense.

OCEG says integrating GRC does not mean creating a mega-department, and does not call for using only one GRC software system to manage everything.

GRC software

GRC software typically holds a risk register, a policy library with approvals and employee acceptance, vendor risk reviews, audit management, issue tracking and reporting across frameworks.

The GRC software ranking scores seven platforms out of 100:

• Sprinto, 84
• Vanta, 82
• Drata, 76
• Secureframe, 75
• Scrut, 72
• OneTrust, 64
• Thoropass, 52

Sprinto, Vanta, Scrut and OneTrust are scored 5 of 5 on vendor risk.

Other vendors sell GRC platforms that this site does not score. ServiceNow, Archer, Optro (formerly AuditBoard), MetricStream, LogicGate and Hyperproof each describe their own scope. ServiceNow, for example, says its IRM product connects risk and compliance across IT, cyber and business operations.

Vendor risk inside a GRC program

OCEG names the inability to address third-party risks as one of the costs of running these functions in silos. Software vendors package the answer in different ways. OneTrust sells Third-Party Risk Management as a separate package and scores 5 of 5 on vendor risk. Vanta sells Third Party Risk Management standalone or as an add-on. Secureframe keeps advanced third-party risk on its Complete plan, and Scrut says it includes vendor risk with AI-written questionnaires and AI scoring of vendor responses.

The frameworks a GRC program maps to

A GRC program rarely follows one rulebook. Most programs map their controls to several frameworks at once, so that one piece of evidence counts more than once.

SOC 2 is an AICPA audit report on a service organization’s security, availability, processing integrity, confidentiality and privacy controls, and only a licensed CPA firm can perform it. ISO 27001 specifies an information security management system and offers certification through accredited bodies.

HIPAA is a US federal law that requires safeguards for electronic protected health information. PCI DSS applies to organizations that store, process or transmit cardholder data. CMMC sets cybersecurity requirements for defense contractors.

The rubric that scores the platforms gives framework coverage 15 points out of 100, and customisation, which covers building a framework the vendor did not ship, 10 points. A buyer with a regional rulebook or a customer-specific control set should check those two scores first.

What to check in a GRC platform

A module list tells more than a product label. Four questions separate the platforms quickly. Does the risk register assign an owner and record a treatment plan for each risk? Do policy approvals run in ordered steps with more than one approver? Does vendor risk cover discovery, assessment and ongoing review? Can the team add a framework, control or test the vendor did not ship?

Drata, for example, describes policy approval workflows with multiple approvers and ordered steps, and Sprinto scores 5 of 5 on customisation.

What GRC software costs

Six of the seven scored platforms list starting prices on AWS Marketplace (pricing study). On vendor websites, only Secureframe prints a dollar figure: Fundamentals starts at $7,500 a year.

The audit carries its own fee. A-LIGN, a licensed audit firm, puts a SOC 2 audit at $20,000 to $150,000 or more, and Thoropass is the one scored platform that delivers the audit itself through its own CPA practice.