What GRC means, how to structure and run the programme, and which model fits a 25 to 250-person firm. Start here, then go deeper in Risk Management, Compliance and GRC Engineering.
Governance, risk and compliance kept in three spreadsheets give you three answers to the same question.
GRC is how a firm sets direction and accountability (governance), decides which threats it will carry (risk) and proves it meets its obligations (compliance). Run together, each feeds the others. Risk decides what the controls must do, compliance proves they do it, and governance makes someone accountable for both.
For a firm of 25 to 250 people, GRC rarely starts as a department. It starts with one person, a customer questionnaire and a certification deadline. The real question is how to build from there without ending up with three programmes.
Integration isn't a tool. It's one set of owners, one risk method and one evidence base.
This hub covers the programme as a whole. For depth, go to Risk Management, Compliance and GRC Engineering.
Every guide in this vault maps to a level. Start where you are.
What GRC is, who owns it, and how the three disciplines fit together.
Build the programme in your first 90 days, on a model and budget that fit your firm.
Measure maturity and run GRC as one integrated, improving system.
Leadership owns GRC. Someone still has to run it: in firms your size, usually a head of compliance, a security lead or an outsourced model.
Clear roles and responsibilities matter more than headcount. Every policy, risk and control needs a named owner in the team that does the work.
The board sets direction and risk appetite, and gets a regular, honest view of how the programme is doing.
Start with owners. Tools and frameworks come after.
Short answers to the questions we hear most from firms setting up their first GRC programme.
Governance, risk and compliance. Governance is how a firm sets direction and accountability. Risk management is how it decides which threats to treat and which to accept. Compliance is how it meets and proves its obligations. GRC treats the three as one programme.
If you hold customer contracts with security clauses, a certification or regulated customers, you already have GRC obligations. A programme is how you meet them deliberately rather than one questionnaire at a time.
Integrated risk management puts risk at the centre and links it to strategy and performance. GRC covers governance, risk and compliance together. For most firms your size, a well-run GRC programme covers most of what IRM offers: see GRC vs IRM.
A working foundation of named owners, a risk method, core policies and an obligations register can be in place in about 90 days. Maturity takes longer, and it comes from running the programme, not from documenting it.
It depends on your size, your budget and how specialist your obligations are. A common pattern is a part-time internal owner backed by outside expertise: compare the operating models.
Every guide in one place. Filter by level.
Work with a Trust Architect to design a GRC programme that fits a 25 to 250-person firm: scoped, owned and built to run all year rather than in a scramble before each audit.