What is GRC: governance, risk and compliance explained, with a maturity model

Answer first. GRC stands for governance, risk and compliance. OCEG, which coined the term, defines it as the integrated set of capabilities that let an organization reliably achieve its objectives, address uncertainty and act with integrity. It is a way of running the organization, not a department or a software category. This guide covers the terms, frameworks, roles and a maturity model.

What GRC means

GRC is an acronym for governance, risk and compliance. Some writers expand the R to risk management; the meaning is the same.

The term belongs to OCEG, a non-profit think tank for the people who govern, audit and manage performance, risk and compliance. OCEG says it created the acronym as early as 2002 and that its founder, Scott Mitchell, published the first peer-reviewed paper on GRC in 2007. Its definition has stayed stable since: GRC is the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity. OCEG calls that outcome Principled Performance, defined as "the ability to reliably achieve objectives, address uncertainty, and act with integrity".

Two features of the definition matter more than the words.

• It describes capabilities, not functions. The risk team, the compliance team and internal audit each hold part of the capability. So do the managers who own the risks and operate the controls, the board that sets appetite, and the systems that record what happened.
• It ties the three words to objectives. Governance sets direction, risk management deals with the uncertainty in reaching it, and compliance keeps the organization inside the rules on the way. Without an objective there is nothing to govern, no risk to assess and no reason to comply.

OCEG is also explicit about what integration does not mean: one GRC department in place of decentralised management, or one software system for everything. It means the capabilities share information and definitions and avoid doing the same work twice.

For the short version, read What is GRC? in the glossary. This guide goes underneath it.

Governance, risk and compliance, term by term

Each word has a working definition in a published standard. Using those definitions keeps a program's vocabulary the same as its auditors' and regulators'.

Governance. The IIA's Three Lines Model takes its definition from the Global Internal Audit Standards glossary: the combination of processes and structures the board puts in place to inform, direct, manage and monitor the organization's activities toward its objectives. The governing body is ultimately accountable for governance; it delegates resources and authority to management and relies on internal audit for independent assurance. In practice governance is the board's risk appetite, the committee structure, the policies the organization adopts and the reporting that shows whether objectives are being met.

Risk. ISO 31000:2018 defines risk as the effect of uncertainty on objectives, positive, negative or both (clause 3.1), and risk management as the coordinated activities an organization uses to direct and control itself with regard to risk (3.2). COSO's Internal Control — Integrated Framework (2013) uses a narrower definition for control purposes: the possibility that an event will occur and adversely affect the achievement of objectives. Both start from objectives, which is why risk cannot be managed apart from governance.

Compliance. ISO 37301:2021, the international standard for compliance management systems, says in its introduction that compliance is an ongoing process and the outcome of an organization meeting its obligations. It treats obligations broadly: laws and regulatory requirements, industry codes, organizational standards, and the standards of good governance, ethics and community expectations the organization has adopted. Compliance covers the organization's own policies as well as external law.

Internal control is the fourth term a program cannot do without. COSO defines it as a process, effected by the board, management and other personnel, designed to provide reasonable assurance about the achievement of objectives in operations, reporting and compliance. Controls are where the three words meet: a control exists because a risk threatens an objective or an obligation requires it, and evidence that it operated is what an auditor asks for. What are internal controls? gives the short definition.

Why the three are managed together

The case for treating governance, risk and compliance as one capability rests on three observations that all the frameworks in this guide make.

They share objects. One control can mitigate a risk in the register, satisfy an obligation in the compliance inventory, be tested by internal audit and be described in a policy. COSO's principle 12 makes the link explicit: control activities are deployed through policies that state what is expected and procedures that put them into action. When each function keeps its own copy of the control, the copies drift and evidence is collected several times.

They share owners. The IIA's model places responsibility for managing risk, ensuring compliance and operating controls with first line management, and gives second line functions such as risk and compliance a role of support and challenge. The same manager answers to all of them. A program that asks that manager the same question three ways loses the manager.

They share a reader. The board receives reports on risk, compliance and assurance and has to reconcile them. COSO ERM asks for reporting on risk, culture and performance at multiple levels (principle 20); ISO 37301 requires compliance reporting (9.1.4) and management review (9.3); the Three Lines Model has internal audit report to the governing body. If the three reports use different taxonomies and data, directors cannot tell whether a red compliance finding and an amber risk are the same problem.

Why the three are managed together

	Managed separately	Managed as one capability
Records	A risk register, an obligations list, a control spreadsheet and an audit tracker, each with its own copy of the controls	One control record linked to the risks it treats, the obligations it satisfies, the tests run on it and the issues raised
Ownership	Each function assigns its own owners; the same manager appears three times	One owner per record, visible to every function
Testing and evidence	Each function requests evidence for its own purpose	Evidence collected once and reused for compliance testing, audit and risk assurance
Issues	Separate findings lists in audit, compliance and security	One issue record, one severity scale, one remediation workflow
Reporting	Three reports, three taxonomies, reconciled by hand	One data model feeding role-specific views of the same facts
Cost of change	A new regulation or reorganization is applied three times	Applied once to the shared records

The right-hand column is what the GRC Foundation library calls Connected GRC. Connected GRC Defined gives the definition and What Is a Connected GRC Program? the fifteen things such a program needs. This guide does not restate them.

The GRC frameworks that define the field

There is no single GRC standard. The field rests on six documents from four publishers, each covering part of the whole. A program that can trace its design to these six can answer any auditor, regulator or director who asks "on what basis?".

The GRC frameworks that define the field

Framework	Publisher and date	What it covers	Requirements or guidance	What it gives a GRC program
GRC Capability Model 3.5 (Red Book)	OCEG, 2023	The whole of GRC: capabilities to learn, align, perform and review	Guidance; free edition available	The definition of GRC and Principled Performance; a structure for the program as a whole
Internal Control — Integrated Framework	COSO, May 2013; superseded the 1992 framework on 15 December 2014	Internal control over operations, reporting and compliance objectives	Framework with 17 principles; the usual basis for SOX section 404 assessments	The definition of internal control, five components and the test of an effective control system
Enterprise Risk Management — Integrating with Strategy and Performance	COSO, June 2017	Risk in strategy setting and performance	Framework with 20 principles	Board oversight, risk appetite, severity assessment, portfolio view, reporting
ISO 31000:2018 Risk management — Guidelines	ISO, February 2018, second edition	Managing any risk in any organization	Guidelines; states it is not intended for certification	Principles, a framework and a process; definitions of risk and risk management
ISO 37301:2021 Compliance management systems — Requirements with guidance for use	ISO, April 2021, first edition; replaces ISO 19600:2014	A compliance management system	Requirements (the standard uses "shall"), so an organization can be audited against it	Compliance obligations, compliance risk assessment, a compliance function, raising concerns, investigations, indicators, reporting
The IIA's Three Lines Model	The Institute of Internal Auditors, July 2020 (updated September 2024)	Roles of the governing body, management and internal audit	Position paper with six principles	Who owns risk, who supports and challenges, who assures

Three have framework pages on this site: COSO Internal Control — Integrated Framework (2013), COSO Enterprise Risk Management Framework (2017) and ISO 31000:2018. The regulations and certification standards a program complies with, such as SOX, GDPR, ISO/IEC 27001 and SOC 2, are a separate list: they say what to comply with, the six above say how to organize the compliance.

OCEG's GRC Capability Model: learn, align, perform, review

OCEG's GRC Capability Model, the Red Book, is the only one of the six that describes GRC as a whole. Version 3.5 was released in 2023, OCEG's twentieth anniversary year, with a free edition on OCEG's site. OCEG says it was built with a panel of more than 300 experts and a study of more than 500 organizations. It organises capabilities into four components.

OCEG's GRC Capability Model: learn, align, perform, review

Component	What it covers, in OCEG's terms
Learn	The organization's context, culture and key stakeholders, so that objectives, strategy and actions are informed by them
Align	Strategy with objectives, and actions with strategy, through decision-making that addresses values, opportunities, threats and requirements
Perform	Actions that promote and reward desirable things, prevent and remediate undesirable things, and detect when something happens as soon as possible
Review	The design and operating effectiveness of the strategy and actions, and the continuing appropriateness of objectives

Two things distinguish it from the COSO and ISO documents. It covers opportunities and values alongside threats and requirements, so "perform" includes promoting desirable behavior, not only preventing undesirable behavior. And it is an integration layer: it does not replace ISO 31000 for risk or ISO 37301 for compliance, it describes how the capabilities those standards define fit together. Use the Red Book for the structure and vocabulary of the whole program; use the standards below to design the processes inside it.

COSO: internal control and enterprise risk management

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a joint initiative of five US accounting and audit bodies, including the IIA. It publishes two frameworks that COSO describes as complementary and overlapping; neither supersedes the other.

Internal Control — Integrated Framework (2013) defines internal control (above), sets three categories of objectives (operations, reporting and compliance) and five components: the control environment, starting with tone at the top and ethical values; risk assessment against established risk tolerances, including the potential for fraud; control activities, the actions established through policies and procedures, preventive or detective, manual or automated; information and communication; and monitoring activities, ongoing and separate evaluations of whether the components are present and functioning. Seventeen principles sit under the components. The test of effectiveness is that each component and principle is present and functioning and that the five operate together; a major deficiency in any of them means the organization cannot conclude its internal control is effective. The 2013 edition widened the reporting objective beyond external financial reporting to non-financial and internal reporting, which is why it applies to ESG and privacy reporting as much as to the financial statements. It remains the framework most public companies assess against for SOX section 404; SOX compliance covers that use.

Enterprise Risk Management — Integrating with Strategy and Performance (2017) has five components of its own (governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting) and twenty principles. The load-bearing ones for a GRC program are 1 (board risk oversight), 7 (defines risk appetite), 10 to 14 (identifies, assesses the severity of, prioritises and responds to risk, and develops a portfolio view) and 20 (reports on risk, culture and performance). The performance component is where the risk register lives; What is a risk register? defines it.

Together the two give a program its control vocabulary (component, principle, control activity, deficiency) and its risk vocabulary (appetite, severity, portfolio view). They do not define compliance as a discipline; for that, use ISO 37301.

ISO 31000 and ISO 37301: risk and compliance as management systems

The two ISO documents are different kinds of standard, and the difference matters when you decide what to be assessed against.

ISO 31000:2018 provides guidelines and states that it is not intended for certification. Its second edition, published in February 2018, is organized as principles, a framework and a process.

• Principles (clause 4). The purpose of risk management is the creation and protection of value. The Institute of Risk Management's practitioner guide summarises the eight principles: the framework and process are customized and proportionate; stakeholders are involved appropriately and in time; the approach is structured and comprehensive; risk management is integral to all organizational activities; it anticipates and responds to change; it considers the limits of available information; human and cultural factors influence every part of it; and it improves continually.
• Framework (clause 5). Leadership and commitment at the center, with integration, design, implementation, evaluation and improvement around it. This is where risk management joins governance: the framework is to be embedded in the organization's strategic and operational policies and practices.
• Process (clause 6). Scope, context and criteria; risk assessment (identification, analysis, evaluation); risk treatment; with communication and consultation, monitoring and review, and recording and reporting alongside.

ISO 37301:2021 specifies requirements. Its first edition was published in April 2021 by ISO/TC 309, the committee for governance of organizations, and it cancels and replaces ISO 19600:2014, which was guidance only. Because it uses "shall", a compliance management system can be audited against it. The clauses follow ISO's harmonized structure for management system standards.

ISO 31000 and ISO 37301: risk and compliance as management systems

Clause	Title	What a GRC program takes from it
4	Context of the organization	4.5 compliance obligations: identify and keep current the obligations that apply; 4.6 compliance risk assessment
5	Leadership	5.1.2 compliance culture; 5.1.3 compliance governance; 5.2 compliance policy; 5.3 roles, including 5.3.2 the compliance function
6	Planning	Actions to address risks and opportunities; compliance objectives; planning of changes
7	Support	Resources, competence (including the employment process and training), awareness, communication, documented information
8	Operation	8.2 establishing controls and procedures; 8.3 raising concerns; 8.4 investigation processes
9	Performance evaluation	9.1.3 indicators; 9.1.4 compliance reporting; 9.1.5 record-keeping; 9.2 internal audit; 9.3 management review
10	Improvement	10.1 continual improvement; 10.2 nonconformity and corrective action

The pairing is deliberate. ISO 37301 defines risk with the same words as ISO 31000 (3.7) and requires a compliance risk assessment, so a compliance management system built to it sits inside a risk framework built to ISO 31000. Keeping one risk taxonomy for both avoids a compliance risk register that cannot be reconciled with the enterprise one; How to build a common risk and control taxonomy covers the method.

Who does what: the IIA Three Lines Model

The frameworks above say what a GRC program must do. The IIA's Three Lines Model says who does it. Published in July 2020 as an update of the Three Lines of Defense model, it is a position paper of six principles that applies to all organizations. The What is three lines of defense? glossary entry covers the older model; the roles below follow the 2020 paper.

Who does what: the IIA Three Lines Model

Role	Who	What the model assigns to them
Governing body	Board, supervisory board, trustees	Accountable to stakeholders for oversight; delegates responsibility and resources to management; determines risk appetite and oversees risk management and controls; oversees compliance with legal, regulatory and ethical expectations; establishes an independent internal audit function
First line roles	Management delivering products and services, including support functions	Leads actions and resources to achieve objectives, including managing risk; maintains structures and processes for operations and risk, including controls; ensures compliance with legal, regulatory and ethical expectations; reports to the governing body on outcomes and risk
Second line roles	Risk, compliance, information security, sustainability, quality and similar functions	Provides complementary expertise, support, monitoring and challenge on managing risk; develops risk management practices, including controls, at process, system and entity level; reports on the adequacy and effectiveness of risk management
Third line roles	Internal audit function	Independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management, including controls; primary accountability to the governing body; independence from management
External assurance providers	External auditors, regulators, certification bodies	Additional assurance to meet legislative and regulatory expectations or requests from management and the governing body

Three points in the paper change how a program should be designed.

• The lines are roles, not departments. The paper's first footnote says the "lines" do not denote structural elements, that all roles operate concurrently, and that one team or individual may hold both first and second line roles. A GRC data model should record roles against records (this person owns this risk; this function tests this control), not against org-chart boxes.
• Second line roles are part of management. They provide support and challenge and are never fully independent from management, whatever the reporting line. The CRO and CCO may report directly to the governing body, and regulators may require it, but that does not make them assurance providers.
• Only the third line is independent. If the chief audit executive is asked to run compliance or ERM, the paper says internal audit is no longer independent of those activities and assurance on them must come from a qualified third party.

The practical output for a program is a RACI: for each record type, who is accountable, who supports, who assures. How to build a GRC RACI that actually works and Connected GRC roles and responsibilities take that further.

The GRC domains and the record each one manages

A program that began with financial controls now typically covers nine domains. Each has a primary record, an owning function and external drivers of its own, and each shares the control, issue and evidence records with the others.

The GRC domains and the record each one manages

Domain	Primary record it manages	Shaped by	Typical second line owner	SmartSuite
Risk	Risk: statement, owner, inherent and residual rating, treatment, appetite comparison, linked controls and KRIs	ISO 31000:2018; COSO ERM 2017	Enterprise risk management	Enterprise Risk Management (ERM), RCSA
Compliance	Obligation: the requirement, its source, the controls that satisfy it, evidence and test results; plus the regulatory change that alters it	ISO 37301:2021; COSO Internal Control 2013; the applicable laws and standards	Compliance	Compliance Management suite, Compliance Assessments & Testing, Regulatory Change Management
Audit	Engagement and finding: scope, work performed, the deficiency, its rating, and the issue raised	The IIA's Three Lines Model and Global Internal Audit Standards	Internal audit (third line)	Internal Audit Management, Audit Management suite
Policy	Policy: version, owner, approver, review date, the controls it deploys, attestations	ISO 37301 clause 5.2; COSO Internal Control principle 12	Compliance or legal	Policy Management
Third-party	Vendor: tier, services, due diligence, contract, assessments, issues, offboarding	ISO 37301; sector rules such as DORA for financial entities	Third-party risk or procurement	Third-Party Risk, Third-Party Risk Management suite
Resilience	Important business service: impact tolerance, business impact analysis, dependencies, continuity plan, scenario tests, incidents	ISO 22301:2019; PRA, FCA and DORA rules for financial firms	Operational resilience or business continuity	Operational Resilience, Business Impact Analysis (BIA)
Cyber	Asset and threat: the system or data, its owner, threats and vulnerabilities, controls and their status	ISO/IEC 27001:2022; NIST CSF 2.0	Information security	Cyber Threat Management, Cyber & IT Risk suite
Privacy	Processing activity: personal data, purpose, lawful basis, DPIA, retention rule, privacy incidents	GDPR and national equivalents	Privacy or data protection office	Privacy Risk Management
ESG	Metric and disclosure: the data point, its source, the control over it, the disclosure it feeds	COSO Internal Control 2013 as applied to non-financial reporting; the applicable disclosure standard	Sustainability, finance or legal	ESG & Sustainability Management

Three records cut across all nine. Controls belong to no single domain; a control over user access serves cyber, privacy, SOX and the vendor program at once. Issues are the single queue of things to fix, whichever domain found them. Evidence is the proof a control operated, collected once and reused. The Connected GRC Operating Model describes the five foundational objects (risk, control, obligation, issue, evidence); The Connected GRC Data Model: Core Records lists the full set. AI governance is the tenth domain most programs are adding, with the AI use case as its record; AI Governance in Connected GRC covers it.

How a GRC program runs: the operating cycle

Read together, the frameworks describe one cycle. The table maps it to OCEG's components, names the role under the Three Lines Model, and cites the clause that requires each step.

How a GRC program runs: the operating cycle

Step	OCEG component	Who does it	Output record	Required by
1. Set objectives, context and appetite	Learn	Governing body and top management	Objectives; risk appetite statement; scope of the compliance management system	COSO ERM principles 1, 6 to 9; ISO 31000 clause 6.3; ISO 37301 clauses 4.1 to 4.4
2. Identify obligations and risks	Learn, Align	Second line with first line owners	Obligation inventory; risk register entries	ISO 37301 clauses 4.5 and 4.6; ISO 31000 clause 6.4.2; COSO ERM principle 10
3. Assess and prioritize	Align	First line scores; second line challenges	Rated risks; compliance risk assessment; priorities against appetite	ISO 31000 clauses 6.4.3 and 6.4.4; COSO ERM principles 11 and 12; COSO Internal Control principles 7 and 8
4. Design controls and write policies	Perform	First line designs; second line advises	Controls linked to risks and obligations; policies and procedures	COSO Internal Control principles 10 to 12; ISO 37301 clauses 5.2 and 8.2; ISO 31000 clause 6.5
5. Operate and collect evidence	Perform	First line	Evidence of control operation; attestations; indicators	ISO 37301 clauses 7.5 and 9.1; COSO Internal Control principle 13
6. Monitor, test and audit	Review	Second line tests; third line assures	Test results; monitoring reports; audit findings	COSO Internal Control principle 16; ISO 37301 clauses 9.1 and 9.2; Three Lines Model principles 3 and 4
7. Raise and fix issues	Perform, Review	First line remediates; second line validates; third line follows up	Issues with severity, owner, due date, corrective action and validation	ISO 37301 clauses 8.3, 8.4 and 10.2; COSO Internal Control principle 17
8. Report and revise	Review	CRO, CCO and CAE to the governing body	Board and committee reports; management review; changes to appetite, scope or controls	COSO ERM principles 15 to 17 and 20; ISO 37301 clause 9.3; ISO 31000 clauses 6.6 and 6.7

The cycle is continuous, not annual. COSO describes internal control as a dynamic and integrated process rather than a serial one, and the Three Lines Model says all roles operate concurrently. A monthly rhythm for steps 5 to 8, with steps 1 to 4 revisited on trigger (a new regulation, an acquisition, an incident) and at least annually, works for most programs; How to run a monthly Connected GRC review gives an agenda.

The GRC maturity model: five stages from spreadsheets to connected GRC

The standards describe what a capable program does, not the stages a program passes through on the way, and there is no published standard for GRC maturity. The five stages below are a working model built on the record types in this guide. Use it to place your program and decide what to change next, not as a score. The Connected GRC Maturity Model treats the same progression in more depth.

The GRC maturity model: five stages from spreadsheets to connected GRC

	Stage 1: Spreadsheets	Stage 2: Documented	Stage 3: Standardized	Stage 4: Integrated	Stage 5: Connected
Records	Risks, controls and obligations in spreadsheets, documents and email, one set per person	Each function keeps its own register; formats differ	A common taxonomy and one control library; each function still has its own tool	Shared records for controls, issues and evidence across risk, compliance and audit	One linked data model across all domains, including third-party, resilience, cyber, privacy and ESG; every record has an owner and relationships
Ownership	Held by the analyst who built the file	Named owners per register, not reconciled between registers	One owner per risk and per control, agreed across functions	Owners see everything linked to their records in one place	Roles recorded against records per the Three Lines Model; escalation routes defined
Controls and testing	Controls listed, rarely tested; results in email	Tested per function on separate calendars; the same control tested twice	Test once, comply many: one result mapped to every framework that needs it	Shared testing calendar across SOX, SOC 2, audit and compliance; evidence reused	Continuous control monitoring where data allows; manual testing kept for judgment controls
Issues	Tracked in the audit report or not at all	Separate lists per function with different severity scales	One severity scale; issues still routed by hand	One queue with remediation workflow and validation	Issues linked to the risk, control, vendor or service they affect; closure needs evidence of the fix
Reporting	Assembled by hand for each meeting; numbers disputed	Each function reports its own status; the board reconciles	Reports use the common taxonomy; still periodic	Dashboards by role from shared data; board sees risk, compliance and audit on one view	Decision-ready: exposure against appetite, obligations at risk, open issues by severity, resilience status, all from source records
What changes to move on	Move records into structured tables with owners and dates	Agree one taxonomy and one control library; retire duplicate registers	Link the records: control to risk, control to obligation, issue to control	Extend the model to the remaining domains; add continuous monitoring where feeds exist	Sustain: data quality reviews, role-based dashboards, annual re-baselining of appetite and obligations

Programs most often stall between stages 2 and 3, because agreeing one taxonomy means a function giving up its categories; the fix is a decision forum, not software, and How to build a Connected GRC operating committee describes it. The move from stage 3 to 4 changes the economics, because evidence is collected once from that point, and it is where a spreadsheet stops being viable, since the relationships between records are the point; From Spreadsheet GRC to Connected GRC is the migration playbook. For a self-assessment, use the GRC program health checklist.

GRC software: what it is and when you need it

GRC software is a category of application that holds the records in this guide and runs the workflows between them: risk registers and assessments, obligation and control libraries, policy lifecycles, testing and evidence collection, issue management, third-party assessments, and the dashboards that report on all of it. What is a GRC platform? defines the category. Three points keep the purchase in proportion.

• Software is not GRC. OCEG says integration does not require a single software system, and stages 1 to 3 above are mostly decisions about taxonomy, ownership and process. A tool bought at stage 1 stores the same disconnected records faster.
• The test is relationships. From stage 4 the value comes from one control being linked to several risks, obligations and tests, and an issue being linked to the thing it affects. Evaluate software on whether records relate to each other and whether business owners will use it, not on the module list. Modern GRC software: what it should do before you buy sets out the criteria.
• Consolidation is its own project. Stage 2 programs often own several point tools. Migrating one domain at a time works better than replacing everything at once; How to consolidate GRC tools without breaking the program covers the sequence.

The related terms buyers meet are integrated risk management (IRM) and enterprise risk management (ERM). GRC vs IRM vs ERM explains the differences, and Connected GRC vs Integrated Risk Management explains why this site uses Connected GRC for stage 5.

Common mistakes

Treating GRC as the compliance team's job. Under the Three Lines Model, first line management owns risk, controls and compliance with legal and ethical expectations; risk and compliance functions support and challenge. A program in which the second line fills in the registers for the business has inverted the model and will not survive an auditor's question about who owns the control.

Two risk taxonomies, one for ERM and one for compliance. ISO 37301 defines risk with the same words as ISO 31000. If the compliance risk assessment uses different categories and scales from the enterprise register, the two cannot be aggregated and the board sees two unreconciled pictures.

Confusing internal control with compliance. COSO's objective categories are operations, reporting and compliance. A control library scoped only to regulatory obligations misses the controls that protect the objectives the business cares about most.

Letting internal audit run the program. The Three Lines Model is explicit that if the chief audit executive takes decision-making responsibility for compliance or ERM, internal audit is no longer independent of those activities. Audit can advise on the design; it should not own it.

Measuring activity instead of exposure. Counts of controls tested and policies attested say nothing about whether the organization is inside its risk appetite or meeting its obligations. How to separate GRC activity metrics from risk intelligence draws the line.

Justifying the program only as defense. The IIA's sixth principle is that all roles together create and protect value. A program sold only as protection gets funded only after a loss. Tie it to the objectives it protects and the decisions it improves.

How SmartSuite does this

SmartSuite's GRC & Resilience solutions hold the nine domains in this guide as one set of related records on a single work management platform rather than as separate modules. Each suite maps to a domain in the table above: Enterprise Risk Management, Compliance Management, Audit Management, Third-Party Risk Management, Operational Resilience & Business Continuity, Cyber & IT Risk, Privacy Management, ESG Management, SOX Management and AI Governance.

The Compliance Management suite is the entry point for the compliance capability ISO 37301 describes. It centralises obligations, policies, control libraries, testing and evidence in one workspace, links each obligation to the controls that satisfy it and to the assessments and remediation that follow, and maps controls once for reuse across frameworks. The suite page describes a staged rollout that starts with Policy Management, Compliance Assessments & Testing or Regulatory Change Management and extends to the full obligation-to-evidence workflow, with dashboards of compliance posture, overdue controls, risk coverage and framework readiness.

Because the records are related, the operating cycle runs without re-keying: a risk in Enterprise Risk Management (ERM) links to the controls that treat it; a test result counts for every framework mapped in Control Framework & Regulatory Libraries; a finding from Internal Audit Management opens an issue in Issues Management against the same control. That is the stage 4 to stage 5 move in the maturity table. The SmartSuite GRC+R Architecture explains why a relational work platform is the basis for it, and How to evaluate SmartSuite GRC against legacy GRC platforms gives a buyer's checklist.

Frequently asked questions

What does GRC stand for?

GRC stands for governance, risk and compliance; some writers expand the R to risk management. OCEG, the non-profit that created the acronym as early as 2002, defines GRC as the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity. The outcome it describes is what OCEG calls Principled Performance.

What is the difference between GRC and ERM?

Enterprise risk management is one capability inside GRC: identifying, assessing, responding to and reporting on risk to strategy and objectives, as COSO's 2017 framework and ISO 31000:2018 describe. GRC adds governance (direction, appetite, oversight) and compliance (meeting obligations, as ISO 37301:2021 defines it), plus the controls, issues and evidence the three share. ERM can exist without GRC; the reverse is not true.

Which GRC framework should we adopt?

Use them together rather than choosing one. OCEG's GRC Capability Model gives the overall structure; COSO's Internal Control — Integrated Framework (2013) gives the control model auditors recognize; COSO ERM 2017 and ISO 31000:2018 give the risk model; ISO 37301:2021 gives auditable requirements for compliance; the IIA's Three Lines Model assigns the roles. Only ISO 37301 is written as requirements.

Who owns GRC in an organization?

Under the IIA's Three Lines Model, the governing body is accountable for oversight, first line management owns the risks, controls and compliance in its own operations, second line functions such as risk and compliance provide expertise, monitoring and challenge, and internal audit provides independent assurance. No single function owns GRC; the chief risk officer or chief compliance officer usually coordinates the program on management's behalf.

How do we know which maturity stage we are at?

Look at the records, not the tools. If risks, controls and obligations live in spreadsheets, you are at stage 1 or 2. If the functions share a taxonomy and one control library, stage 3. If one control test serves several frameworks and issues sit in one queue, stage 4. If every domain sits in one linked data model with decision-ready reporting, stage 5.

Sources

1. OCEG, What is GRC (Governance, Risk, and Compliance)? Definition of GRC and Principled Performance; origin of the term (2002, 2007); the four components of the GRC Capability Model; integration does not require one department or one software system. https://www.oceg.org/ideas/what-is-grc/ and https://www.oceg.org/about/what-is-grc/
2. OCEG, GRC Capability Model 3.5 (OCEG Red Book), free edition, and The GRC Capability Model 3.5: A Comprehensive Guide (release in OCEG's twentieth anniversary year, 2023; more than 300 experts; more than 500 organizations). https://www.oceg.org/grc-capability-model-red-book/ and https://www.oceg.org/grccapabilitymodel35/
3. COSO, Internal Control — Integrated Framework: Executive Summary, May 2013. Definition of internal control; objectives; five components; seventeen principles; effective internal control; relationship to the ERM framework. Framework page with the 15 December 2014 supersession date: https://www.coso.org/guidance-on-ic. Executive summary PDF (archived copy): https://www.como.gov/archive/2021/12/COSO-2013.pdf. SmartSuite framework page: https://www.smartsuite.com/frameworks/coso-internal-control-integrated-framework-2013-icfr
4. COSO, Enterprise Risk Management — Integrating with Strategy and Performance: Executive Summary, June 2017. Five components and twenty principles. https://www.coso.org/guidance-erm (PDF: https://www.coso.org/_files/ugd/3059fc_61ea5985b03c4293960642fdce408eaa.pdf). SmartSuite framework page: https://www.smartsuite.com/frameworks/coso-enterprise-risk-management-framework-2017
5. ISO 31000:2018, Risk management — Guidelines, second edition, February 2018. Definitions 3.1 and 3.2; not intended for certification; clauses 4 to 6. Catalog: https://www.iso.org/standard/65694.html. Preview: https://cdn.standards.iteh.ai/samples/65694/7ced163880234659809e5202d306b3a4/ISO-31000-2018.pdf. SmartSuite framework page: https://www.smartsuite.com/frameworks/iso-31000-risk-management-guidelines-2018
6. Institute of Risk Management, Standard Deviations: A Risk Practitioner's Guide to ISO 31000:2018. The eight principles, framework components and process steps. https://www.theirm.org/media/6884/irm-report-iso-31000-2018-v2.pdf
7. ISO 37301:2021, Compliance management systems — Requirements with guidance for use, first edition, April 2021, ISO/TC 309. Foreword (replaces ISO 19600:2014); introduction; scope; definitions 3.7, 3.18 and 3.21; clauses 4 to 10. Catalog: https://www.iso.org/standard/75080.html. Preview: https://cdn.standards.iteh.ai/samples/75080/98db41625e0445a193a12f005dd5f30b/ISO-37301-2021.pdf
8. The Institute of Internal Auditors, The IIA's Three Lines Model: An Update of the Three Lines of Defense, July 2020, updated September 2024. Six principles; key roles; relationships; applying the model. https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf. Announcement: https://www.theiia.org/en/content/communications/2020/july/20-july-2020-iia-issues-important-update-to-three-lines-model/

Related: GRC Foundation · What is GRC? · What is a GRC platform? · What is compliance management? · What is governance?