Governance, risk, and compliance
Organizational concept
- 2 min read
- 2 chapters
Related on Lably
Through Governance and Artificial intelligence
History
Corporate financial scandals in the 1970s in the United States led to the creation of the organization, the Committee of Sponsoring Organizations of the Treadway Commission ("COSO"), by major US accounting associations; COSO issued reports calling for better controls over financial accounting, and standards to achieve those controls.
Call for more strict internal controls and financial reporting standards for companies was driven by high-profile corporate scandals in the 1990s in the UK, leading to the Turnbull Report in the UK, and similar scandals in the United States in the early 2000s, like the Enron scandal, which led to the passage of the Sarbanes–Oxley Act in the US. COSO updated their standards accordingly.
As companies began efforts to comply with these regulations, the interconnectedness of governance, risk management, and compliance became clear. This created a market for training and software to bring these function together; for example, in 2002, Symbiant, a UK software development company, created the first GRC software that let teams work together online, combining risk registers, evaluations and audit tracking all in one system. The term "Governance, risk, and compliance" or "GRC" was published by Scott Mitchell, founder of the Open Compliance and Ethics Group (OCEG), in an academic paper in 2007.
Sign in to keep reading
One more chapter is free with a Lably account.
Overview
Governance, risk, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with integrity. Corporate governance is the combination of processes established and executed by the directors (or the board of directors) that shape the organization's structure and assigns roles, enterprise risk management is predicting and managing risks that could hinder an organization from reliably achieving its objectives under uncertainty, and compliance refers to adhering with the mandated boundaries (laws and regulations) and voluntary boundaries (company's policies, procedures, etc.).
Governance, risk and compliance (GRC) is a discipline that aims to synchronize information and activity across governance, and compliance in order to operate more efficiently, enable effective information sharing, more effectively report activities and avoid wasteful overlaps. If not integrated and instead tackled in a traditional "silo" approach, most organizations must sustain unmanageable numbers of GRC-related requirements due to changes in technology, increasing data storage, market globalization and increased regulation.
Specific fields have developed GRC approaches; there is financial GRC (aka FinGRC), Legal GRC, and Operational GRC.
As companies have begun to adopt artificial intelligence to help run their businesses, the risks intrinsic to AI raise GRC challenges to the companies using AI products. As of 2025, some companies were beginning to adopt AI tools to help them manage GRC.