What Is GRC (Governance, Risk, and Compliance)?

GRC (Governance, Risk, and Compliance) & OCEG (Open Compliance and Ethics Group): A Deep Dive

GRC, as an acronym, denotes governance, risk, and compliance — but the full story of GRC is so much more than those three words.

The acronym GRC was created by OCEG (originally called the "Open Compliance and Ethics Group") as a shorthand reference to the critical capabilities that must work together to achieve Principled Performance — the capabilities that integrate the governance, management, and assurance of performance, risk, and compliance activities.

This includes work done by departments in governance, strategy, risk, compliance, security, audit, finance, legal, IT, and HR. But it also includes operators in lines of business, the executive suite, and the board itself.

While the acronym was used by OCEG as early as 2002, the first peer-reviewed academic paper on the topic was published in 2007 by OCEG founder Scott Mitchell in the International Journal of Disclosure and Governance.

This groundbreaking paper influenced the related software and services industry and began open-source GRC standards.

Can GRC (Governance, Risk, and Compliance) be Done Wrong?

Short answer, yes.

The long answer is that yes when businesses are operating under disjointed and disconnected circumstances, GRC activities can cause a number of problems.

To address these drivers, organizations develop departments and programs such as:

• Performance management
• Risk management
• Compliance
• Corporate social responsibility
• Etc.

Unfortunately, these departments and programs are often siloed, ineffective, and yield troubling drawbacks:

• High costs
• Lack of visibility into risks
• Inability to address third-party risks
• Difficulty measuring risk-adjusted performance
• Too many negative surprises

When these activities are siloed, it is highly likely that counter-productive objectives are established, sub-optimal strategies are selected, and performance isn't optimized.

What Does GRC (Governance, Risk, and Compliance) Look Like When Done Right?

Integrating GRC capabilities does not mean creating a mega-department of GRC and doing away with decentralized management. Nor does it call for using only one GRC software system to manage everything.

Rather, it is about establishing an approach that ensures the right people get the right information at the right times; that the right objectives are established; and that the right actions and controls are put in place to address uncertainty and act with integrity.

When GRC is done right, the benefits accrue. Organizations that integrate GRC processes and technology across all or many silos have:

• Reduced costs
• Reduced duplication of activities
• Reduced impact on operations
• Achieved greater information quality
• Achieved greater ability to gather information quickly and efficiently
• Achieved greater ability to repeat processes in a consistent manner

The GRC Capability Model describes "GRC Done Right" in 4 high-level components and several detailed elements:

1. LEARN about the organization's context, culture, and key stakeholders to inform objectives, strategy, and actions.
2. ALIGN strategy with objectives, and actions with strategy, using effective decision-making that addresses values, opportunities, threats, and requirements.
3. PERFORM actions that promote and reward desirable things, prevent and remediate undesirable things, and detect when something happens as soon as possible.
4. REVIEW the design and operating effectiveness of the strategy and actions, as well as the ongoing appropriateness of objectives to improve the organization.

How Can I Kickstart my Education in GRC (Governance, Risk, and Compliance)?

With the help of a panel of 100+ experts, OCEG studied 250+ organizations to document best practices in the GRC Capability Model (commonly called the OCEG Red Book). Download the newest version of our Red Book (The GRC Capability Model 3.5), and sign up for an All Access Pass to get exclusive access to training materials, as well as your first GRC Professional (GRCP) Certification.

With a GRCP Certification, you can:

• Unified vocabulary across disciplines
• Defined common components and elements
• Defined common information requirements
• Standardized practices for things like policies and training
• Identified communication for everyone involved, including strategic decision-makers