GRC roles and responsibilities: who owns what in a lean GRC team

The regulator's letter asks who owns ICT risk at your firm. The internal auditor wants to know who tests your controls. The honest answer to both is the same person, and that person also writes the policies, chases the evidence and drafts the board report.

This guide sets out GRC roles and responsibilities for a UK regulated firm of 25 to 250 staff. It is for the COO, CISO, compliance lead or new head of GRC who has to assign ownership after an audit finding, a DORA gap analysis or a regulator's question. You will get the core roles, how the team looks at three sizes, where rules fix ownership or independence, and a responsibility map you can copy.

What are the core GRC roles and responsibilities?

A GRC team splits into four kinds of work: running the programme (a GRC lead), doing the risk and compliance work (analysts and a GRC engineer), owning controls (control owners), and independent assurance. In a small firm, three or four people wear these as hats. What matters is one named owner per responsibility and a checker independent of the doer.

Job titles vary. The work does not, so the table below describes each role by what it owns and, just as usefully, by what it does not.

Three neighbours sit outside the team but touch it every week. The CISO, or a vCISO bought in, owns security strategy and technical risk decisions. The GRC lead turns those decisions into controls and evidence.

The DPO, where you have one, advises on data protection. Under UK GDPR Article 38 the DPO reports to the highest management level, takes no instructions on those tasks and can hold other duties only where they create no conflict of interest. In practice, that means the DPO should not also own the processing they monitor.

Legal interprets the obligations. The GRC team turns them into controls and keeps the map between the two current.

What is the difference between a control owner, a control operator and a risk owner?

A risk owner decides how much of a risk the firm will carry and approves the treatment. A control owner answers for one control being designed well and working. A control operator performs the control's task. One person can hold two of these roles, but the person who runs a control should never be its only checker.

Take quarterly access reviews. The head of IT owns the risk of unauthorised access and accepts what remains after treatment. The engineering manager owns the access review control and answers to the auditor for it. A team lead runs the review each quarter and records the result.

The split matters most when something fails. If the review is skipped, the operator explains why, the control owner fixes the process, and the risk owner decides whether the exposure is still acceptable.

ISO 27001 Annex A 5.2 expects these duties defined, allocated to named people and communicated to them. Delegation is fine, but accountability stays with the person the duty was assigned to.

A control with no named owner is a hope, not a control.

Which GRC roles does a firm need at 25, 100 and 250 staff?

At about 25 staff, one senior person leads GRC as part of a wider role and buys in expertise and independent testing. At about 100, a dedicated GRC lead appears, often with an analyst. By about 250, the firm can usually run separate risk, compliance and assurance roles, and buys in only specialist work.

We recommend sizing the team by the work it must own, not by an enterprise role list. The table shows a typical shape at each size.

At the smallest size, the risk is not too few roles. It is one person holding all of them with nobody checking.

A vCISO is one route to a programme lead at that size. The choice is about time and competence, not job title.

As the firm grows, we recommend separating the checker first. ISO 27001 Clause 9.2 asks for impartial internal auditors, and SYSC 6.1.4R, where it applies, bars compliance staff from performing the activities they monitor. Both rules target the same conflict, so independent assurance should leave the doer's hands before anything else does.

Where do regulations fix GRC ownership or independence?

Several UK and EU rules fix who must own GRC work, or who must stay independent of it. DORA Article 6(4) assigns ICT risk to an independent control function. FCA SYSC 4.1.1R requires clear lines of responsibility. SYSC 6.1 sets the compliance function for some firms. ISO 27001 requires named roles and segregated duties.

Each rule applies to a different set of firms, so check which ones bind yours:

• DORA Article 6(4)****. Financial entities other than microenterprises must assign responsibility for managing and overseeing ICT risk to a control function with appropriate independence. DORA binds EU financial entities, so it reaches UK firms through EU-authorised group entities.
• FCA SYSC 4.1.1R****. A firm must have robust governance arrangements, including a clear organisational structure with well defined, transparent and consistent lines of responsibility. How the rule applies depends on your firm type, as set out in SYSC 1 Annex 1.
• FCA SYSC 6.1.3R and 6.1.4R. These require an independent compliance function and a compliance officer at management companies and operators of electronic lending systems. Common platform firms have parallel rules in SYSC 6.1.3-AR to 6.1.3-CR. Other firms take them as guidance and may find a separate compliance function appropriate.
• FCA SYSC 6.2.1R. Where appropriate and proportionate, common platform firms, management companies and operators of electronic lending systems need an internal audit function separate and independent from their other functions. Other firms take it as guidance.
• ISO 27001 Clause 5.3 and Annex A 5.2. Top management assigns and communicates security roles, including who keeps the ISMS conforming and who reports on its performance. See ISO 27001 Clause 5.3.
• ISO 27001 Annex A 5.3 and Clause 9.2. Conflicting duties are separated, and internal auditors are impartial about the areas they audit. See ISO 27001 Annex A 5.3 and ISO 27001 Clause 9.2.

The FCA's SYSC 6.1 does not make every firm appoint a compliance officer. Under SYSC 6.1.1R, it does expect every firm the chapter covers to have adequate policies and procedures for compliance, which is why the work needs an owner even where the formal function does not apply.

Board and committee accountability sits above all of this. This page stays with the team that does the work.

How do you map one owner to each GRC activity?

Map each recurring GRC activity to one accountable owner, the person or team who does the work, and an independent checker. Seven activities cover most programmes: the risk register, the policy set, control testing, evidence, supplier reviews, regulatory change and board reporting. One name per activity ends the "I thought you had it" gap.

Copy the map below and replace the roles with names. We recommend reviewing it whenever someone joins, moves or leaves.

This is a responsibility map, not a full RACI. It answers one question per activity: whose name goes on it.

The "Checked by" column is the easiest one to leave blank. Fill it first, because an activity checked by its own doer has no check at all.

What goes wrong with GRC ownership, and how do you fix it?

Three failure patterns are common in small GRC teams: control owners who don't know they own a control, owners who check their own work, and GRC run as one person's side job. Each looks fine on an org chart and fails in an audit interview. Each has a small, specific fix.

Owners who don't know they own a control. The register names someone who left, or someone who was never told. The fix is to write the allocation into the job description and tell the person directly. Then link the register to your joiner and leaver process so names change when people do.

The owner checking their own work. The control operator also signs off that the control works, so nothing independent ever looks. The fix is a named checker for every control test, from another function or from outside.

GRC as one person's side job. One person holds every role in the table, around a day job. The fix is not always a hire. It is protected time, a written mandate, and buying in the independent checks that the one person cannot give themselves.

A GRC team of one is a single point of failure with a job title.

Frequently asked questions