QULDEXResources · Glossary
What is GRC? Governance, risk and compliance explained
What does GRC mean?
Each of the three could be run on its own, and often is: a risk register in one place, compliance checklists in another, board reporting in a third. GRC is the decision to connect them.
The connection is practical. A risk leads to a control; the control meets a requirement; evidence shows it works; an audit confirms it; leadership sees the result.
What are the three parts of GRC?
Who decides, who is accountable, and how leadership oversees the rest.
Identifying what could affect objectives, and deciding how to treat it.
Meeting laws, regulations, standards and contracts, and being able to prove it.
How do the three parts connect?
One issue followed through governance, risk and compliance.
| Item | What it looks like |
|---|---|
| Risk | Customer data could be exposed through unused accounts |
| Control | Quarterly access review, owned by each system owner |
| Compliance | The control meets access requirements in ISO 27001 and SOC 2 |
| Governance | Results and overdue actions are reported to the risk committee each quarter |
This is an illustration written for this page, not a customer record.
Which standards cover each part?
| Part | Standard | What it provides |
|---|---|---|
| Governance | ISO 27001 clause 5 | Leadership, policy, and roles and responsibilities for the management system. |
| Risk | ISO 31000 | Principles and a process for identifying, analysing, evaluating and treating risk. |
| Compliance | ISO 37301 | Requirements for a compliance management system. |
| NIST CSF 2.0 | Govern function | Risk strategy, roles, policy and oversight for cybersecurity. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
Why do GRC programmes struggle?
Three separate lists
Risks, controls and requirements are kept in different tools with no links.
Instead: connect each control to its risk and its requirements.
Reporting by spreadsheet
Status is assembled by hand each month and is out of date on arrival.
Instead: report from the records themselves.
Compliance without risk
Controls are added to satisfy a checklist, not because of a risk.
Instead: start from the risks and the obligations together.
How does QULDEX handle this?
Readiness by framework and by audit, built from the controls, evidence and findings recorded in the platform.
GRC: common questions
What does GRC stand for?
Governance, risk and compliance.
What does a GRC team do?
It maintains the organisation's risks, controls and obligations, coordinates audits and assessments, tracks corrective actions, and reports the position to leadership.
What is GRC software?
Software that holds risks, controls, requirements, evidence, audits and actions in one system, so they can be linked and reported together.
Risks, controls and audits in one place
Controls, evidence, findings and corrective actions in one audit workspace.