What is GRC?
GRC brings together three management tasks of an organisation: governance, risk management and compliance. The integrated approach runs them on shared data instead of each discipline keeping its own lists of assets, risks and controls.
| Component | Core question | Responsibility (example) |
|---|---|---|
| Governance | Who decides what, under which rules, and who oversees it? | Management board, supervisory board |
| Risk | Which events threaten the objectives, and how are they managed? | Risk management, business units |
| Compliance | Which rules apply, and how is adherence evidenced? | Compliance function, legal department |
What is the difference between governance and compliance?
Governance sets how an organisation is directed and overseen: responsibilities, decision routes, reporting lines. Compliance checks whether the organisation follows the rules that apply to it, external or self-imposed. Governance sets the frame, and compliance measures behaviour against it.
An information security policy adopted by management is an act of governance; evidence that the policy is implemented belongs to compliance.
One control catalogue for several frameworks
The value of GRC shows as soon as several frameworks touch the same controls. Example: a company runs an ISMS under ISO/IEC 27001, a record of processing activities under the GDPR and security requirements from customer contracts. The same access control then appears in three lists, with three wordings, three states of evidence and three owners.
The GRC approach sorts this out in four steps:
- One inventory: assets, processes, systems and suppliers are recorded once.
- One control catalogue: each control exists once, with an owner and a review cycle.
- Many-to-many mapping: the same control meets requirements from ISO/IEC 27001, the GDPR and the customer contract.
- One body of evidence: a piece of evidence is produced once and serves every report.
Each additional framework then mainly needs mappings to existing controls, and new controls only for the gaps.
Who does what? The three lines model
The roles within GRC are described by the three lines model of the Institute of Internal Auditors (IIA).
The model distinguishes three roles:
- First line: management, which owns and manages risks and is responsible for processes and controls.
- Second line: roles that provide expertise, support, monitoring and challenge, such as risk management, compliance and information security.
- Third line: the internal audit function, which gives independent and objective assurance and reports to the board.
Where roles overlap, the model calls for clear accountability and safeguards against reviewing one's own work. Whoever operates a control therefore cannot judge its effectiveness independently.
GRC in German law: five points of reference
German company law, chiefly the Stock Corporation Act (AktG) and the Limited Liability Companies Act (GmbHG), does not use the term GRC, but it regulates its components:
| Provision | Who it applies to | What it requires |
|---|---|---|
| § 93(1) AktG, § 43(1) GmbHG | Management board of a stock corporation (AG), managing directors of a GmbH | The care of a diligent and conscientious manager, or of a prudent businessperson |
| § 1(1) StaRUG, the Corporate Stabilisation and Restructuring Act | Management of legal persons, including the GmbH | Continuously monitor developments that could threaten the company's survival, take countermeasures, report to the supervisory bodies without delay |
| § 91(2) AktG | Management board of every AG | Suitable measures, in particular a monitoring system, so that developments threatening the company's survival are detected early |
| § 91(3) AktG | Management board of a listed company | An appropriate and effective internal control system and risk management system |
| § 161 AktG | Management and supervisory boards of listed companies | An annual declaration on the recommendations of the German Corporate Governance Code, kept permanently on the company website |
For a GmbH, the need for GRC therefore follows from the duty of care and the crisis early-warning duty in § 1 StaRUG. Every AG is bound by § 91(2) AktG, and a listed AG also by § 91(3) AktG, which expressly requires an internal control system.
No GRC standard, but standards for each subsystem
GRC is a management approach, not a requirements standard. The subsystems have recognised reference frameworks of different types:
| Subsystem | Reference framework | Type of framework |
|---|---|---|
| Compliance management system | ISO 37301:2021 | Requirements standard with guidance |
| Compliance management system, audit | IDW PS 980 with seven basic elements | Auditing standard for German public auditors (Wirtschaftsprüfer) |
| Internal control system | COSO Internal Control, Integrated Framework (2013) with five components | Framework |
| Risk management | ISO 31000:2018 | Guidelines |
| Information security | ISO/IEC 27001 | Certifiable requirements standard |
The requirements for a compliance management system are explained in the entry on ISO 37301. Anyone building a new subsystem should decide early which objects the other subsystems will share: assets, owners, controls and evidence.
What must a GRC tool deliver?
A GRC tool has to handle many-to-many mapping in its data model. Four questions separate tools during selection:
- Mapping: can a control be mapped to several requirements without being copied?
- Evidence: is the evidence attached to the control or to the asset it applies to, rather than to a report?
- Own frameworks: can customer requirements be modelled as a framework of their own?
- Reports: is the report produced from the same data the business units maintain?
A simple selection test: maintain one access control once. Then check whether it appears with the same state of evidence in the reports for ISO/IEC 27001 and for a customer audit. Further selection criteria are in the guide to choosing ISMS software.
Governance, risk and compliance on the same asset
Rizzqo links the three GRC perspectives on the asset. Requirements from the held catalogues, such as ISO/IEC 27001, ISO/IEC 27002, DORA and the CRA, attach to the systems, services and suppliers they apply to. A requirement mapped to several frameworks is answered once and counts for each of them. Each requirement has a responsible owner, and finalised answers carry name and timestamp.
Rizzqo carries risk assessments on the same asset: a configurable matrix computes the risk in euros from likelihood in per cent and impact in euros. Measures run as tasks; their planned risk reduction is reserved and applied on completion. Rizzqo computes coverage per asset and framework from the finalised answers, and a daily snapshot records the trend.