---
title: "GRC roles and responsibilities: who owns what in a lean GRC team"
canonical: https://www.grcmana.io/vault/grc/grc-roles-and-responsibilities
published: 2025-05-08
updated: 2026-10-23
author: "Harry West"
framework: "GRC"
control: "Guide GRC roles and responsibilities"
journeyStage: fundamentals
---

# GRC roles and responsibilities: who owns what in a lean GRC team

## Key takeaways

GRC roles and responsibilities split into four kinds of work: running the programme, doing the risk and compliance work, owning controls in the business, and independent assurance. In a firm of 25 to 250 staff, three or four people hold these as hats. What matters is one named owner per activity and a checker who is independent of the doer.

- **ICT risk control function** — DORA Article 6(4) requires financial entities other than microenterprises to assign responsibility for managing and overseeing ICT risk to a control function with appropriate independence.
- **FCA compliance officer** — FCA SYSC 6.1.3R and 6.1.4R require an independent compliance function and compliance officer at management companies and electronic lending operators; common platform firms have parallel rules and others treat them as guidance.
- **DPO independence** — Under UK GDPR Article 38, a DPO reports to the highest management level, takes no instructions on their tasks and may hold other duties only without a conflict of interest.
- **Segregation of duties** — ISO 27001 Annex A 5.3 separates conflicting duties and areas of responsibility, so that no single person can raise, approve and execute a sensitive action alone.

The regulator's letter asks who owns ICT risk at your firm. The internal auditor wants to know who tests your controls. The honest answer to both is the same person, and that person also writes the policies, chases the evidence and drafts the board report.

This guide sets out GRC roles and responsibilities for a UK regulated firm of 25 to 250 staff. It is for the COO, CISO, compliance lead or new head of GRC who has to assign ownership after an audit finding, a DORA gap analysis or a regulator's question. You will get the core roles, how the team looks at three sizes, where rules fix ownership or independence, and a responsibility map you can copy.

## What are the core GRC roles and responsibilities?

A GRC team splits into four kinds of work: running the programme (a GRC lead), doing the risk and compliance work (analysts and a GRC engineer), owning controls (control owners), and independent assurance. In a small firm, three or four people wear these as hats. What matters is one named owner per responsibility and a checker independent of the doer.

Job titles vary. The work does not, so the table below describes each role by what it owns and, just as usefully, by what it does not.

| Role | What it owns | What it does not own |
| --- | --- | --- |
| GRC lead or head of GRC | The programme: its plan, the risk register's upkeep, the policy set, the reporting cycle and the escalations | The risks and controls themselves, which sit with the business |
| Risk and compliance analyst | Risk assessments, control mapping, regulatory change tracking, evidence requests and gap analysis | Decisions to accept risk or change how a control works |
| GRC engineer | Automated evidence collection, control monitoring and the data that feeds GRC reporting | Control design decisions and the sign-off that a control works |
| Compliance officer | The compliance function where a firm needs one: monitoring, advice and compliance reporting to management | Running the business activities it monitors |
| Control owner | Whether a control is designed and working, and fixing it when it is not | The day-to-day task, if someone else performs it |
| Control operator | Performing the control task on schedule and keeping its record | Judging whether the control is effective |
| Internal audit or independent assurance | Testing whether controls and the programme work, and reporting findings | Designing, operating or fixing what it tests |

Three neighbours sit outside the team but touch it every week. The CISO, or a vCISO bought in, owns security strategy and technical risk decisions. The GRC lead turns those decisions into controls and evidence.

The DPO, where you have one, advises on data protection. Under [UK GDPR](https://www.grcmana.io/vault/gdpr) Article 38 the DPO reports to the highest management level, takes no instructions on those tasks and can hold other duties only where they create no conflict of interest. In practice, that means the DPO should not also own the processing they monitor.

Legal interprets the obligations. The GRC team turns them into controls and keeps the map between the two current.

## What is the difference between a control owner, a control operator and a risk owner?

A risk owner decides how much of a risk the firm will carry and approves the treatment. A control owner answers for one control being designed well and working. A control operator performs the control's task. One person can hold two of these roles, but the person who runs a control should never be its only checker.

Take quarterly access reviews. The head of IT owns the risk of unauthorised access and accepts what remains after treatment. The engineering manager owns the access review control and answers to the auditor for it. A team lead runs the review each quarter and records the result.

The split matters most when something fails. If the review is skipped, the operator explains why, the control owner fixes the process, and the risk owner decides whether the exposure is still acceptable.

[ISO 27001 Annex A 5.2](https://www.grcmana.io/vault/iso-27001/annex-a-5-2-information-security-roles-and-responsibilities) expects these duties defined, allocated to named people and communicated to them. Delegation is fine, but accountability stays with the person the duty was assigned to.

A control with no named owner is a hope, not a control.

## Which GRC roles does a firm need at 25, 100 and 250 staff?

At about 25 staff, one senior person leads GRC as part of a wider role and buys in expertise and independent testing. At about 100, a dedicated GRC lead appears, often with an analyst. By about 250, the firm can usually run separate risk, compliance and assurance roles, and buys in only specialist work.

We recommend sizing the team by the work it must own, not by an enterprise role list. The table shows a typical shape at each size.

| Firm size | Who holds the GRC hats | What to buy in |
| --- | --- | --- |
| About 25 staff | The COO or CTO leads GRC part-time; department heads are control owners; the team operates its own controls | A vCISO or fractional GRC lead for the programme, and an external practitioner for independent testing |
| About 100 staff | A dedicated GRC lead, often with one risk and compliance analyst; control owners named in every function | Internal audit, specialist assessments, and engineering time to automate evidence |
| About 250 staff | A head of GRC with analysts, a GRC engineer and, where rules require it, a compliance officer; a separate assurance role | Specialist reviews, overflow during audits, and an external view on independence |

At the smallest size, the risk is not too few roles. It is one person holding all of them with nobody checking.

A vCISO is one route to a programme lead at that size. The choice is about time and competence, not job title.

As the firm grows, we recommend separating the checker first. ISO 27001 Clause 9.2 asks for impartial internal auditors, and SYSC 6.1.4R, where it applies, bars compliance staff from performing the activities they monitor. Both rules target the same conflict, so independent assurance should leave the doer's hands before anything else does.

## Where do regulations fix GRC ownership or independence?

Several UK and EU rules fix who must own GRC work, or who must stay independent of it. DORA Article 6(4) assigns ICT risk to an independent control function. FCA SYSC 4.1.1R requires clear lines of responsibility. SYSC 6.1 sets the compliance function for some firms. ISO 27001 requires named roles and segregated duties.

Each rule applies to a different set of firms, so check which ones bind yours:

- [**DORA Article 6(4)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj)\*\*\*\*.** Financial entities other than microenterprises must assign responsibility for managing and overseeing ICT risk to a control function with appropriate independence. DORA binds EU financial entities, so it reaches UK firms through EU-authorised group entities.
- [**FCA SYSC 4.1.1R](https://www.handbook.fca.org.uk/handbook/SYSC/4/1.html)\*\*\*\*.** A firm must have robust governance arrangements, including a clear organisational structure with well defined, transparent and consistent lines of responsibility. How the rule applies depends on your firm type, as set out in SYSC 1 Annex 1.
- **FCA SYSC 6.1.3R and 6.1.4R.** These require an independent compliance function and a compliance officer at management companies and operators of electronic lending systems. Common platform firms have parallel rules in SYSC 6.1.3-AR to 6.1.3-CR. Other firms take them as guidance and may find a separate compliance function appropriate.
- **FCA SYSC 6.2.1R.** Where appropriate and proportionate, common platform firms, management companies and operators of electronic lending systems need an internal audit function separate and independent from their other functions. Other firms take it as guidance.
- **ISO 27001 Clause 5.3 and Annex A 5.2.** Top management assigns and communicates security roles, including who keeps the ISMS conforming and who reports on its performance. See [ISO 27001 Clause 5.3](https://www.grcmana.io/vault/iso-27001/clause-5-3-organisational-roles-responsibilities-and-authorities).
- **ISO 27001 Annex A 5.3 and Clause 9.2.** Conflicting duties are separated, and internal auditors are impartial about the areas they audit. See [ISO 27001 Annex A 5.3](https://www.grcmana.io/vault/iso-27001/annex-a-5-3-segregation-of-duties) and [ISO 27001 Clause 9.2](https://www.grcmana.io/vault/iso-27001/clause-9-2-internal-audit).

The [FCA's SYSC 6.1](https://www.handbook.fca.org.uk/handbook/SYSC/6/1.html) does not make every firm appoint a compliance officer. Under SYSC 6.1.1R, it does expect every firm the chapter covers to have adequate policies and procedures for compliance, which is why the work needs an owner even where the formal function does not apply.

Board and committee accountability sits above all of this. This page stays with the team that does the work.

## How do you map one owner to each GRC activity?

Map each recurring GRC activity to one accountable owner, the person or team who does the work, and an independent checker. Seven activities cover most programmes: the risk register, the policy set, control testing, evidence, supplier reviews, regulatory change and board reporting. One name per activity ends the "I thought you had it" gap.

Copy the map below and replace the roles with names. We recommend reviewing it whenever someone joins, moves or leaves.

| Activity | Accountable owner | Does the work | Checked by |
| --- | --- | --- | --- |
| Risk register | GRC lead | Risk owners update their risks; the analyst runs the review cycle | Internal audit or an external reviewer |
| Policy set | GRC lead | Policy authors in each function draft and refresh | Management, at approval |
| Control testing | GRC lead | Analyst or GRC engineer tests; never the control's operator | Internal audit |
| Evidence collection | Control owners | Control operators, with automated collection where possible | Analyst, at sampling |
| Supplier reviews | The supplier's business owner | Analyst runs the assessment | GRC lead |
| Regulatory change | Compliance officer, or the GRC lead where there is none | Analyst tracks and maps changes; legal interprets | Management |
| Board reporting | GRC lead | Analyst compiles the metrics | The board or its committee, on receipt |

This is a responsibility map, not a full RACI. It answers one question per activity: whose name goes on it.

The "Checked by" column is the easiest one to leave blank. Fill it first, because an activity checked by its own doer has no check at all.

## What goes wrong with GRC ownership, and how do you fix it?

Three failure patterns are common in small GRC teams: control owners who don't know they own a control, owners who check their own work, and GRC run as one person's side job. Each looks fine on an org chart and fails in an audit interview. Each has a small, specific fix.

**Owners who don't know they own a control.** The register names someone who left, or someone who was never told. The fix is to write the allocation into the job description and tell the person directly. Then link the register to your joiner and leaver process so names change when people do.

**The owner checking their own work.** The control operator also signs off that the control works, so nothing independent ever looks. The fix is a named checker for every control test, from another function or from outside.

**GRC as one person's side job.** One person holds every role in the table, around a day job. The fix is not always a hire. It is protected time, a written mandate, and buying in the independent checks that the one person cannot give themselves.

A GRC team of one is a single point of failure with a job title.

## Frequently asked questions

### What does a GRC team do?

A GRC team runs the programme that keeps a firm within its risk appetite and its obligations. The [UK Cyber Security Council](https://www.ukcybersecuritycouncil.org.uk/specialisms/cyber-security-governance-and-risk-management) describes the related specialism as monitoring compliance with agreed cyber security policies and assessing and managing the relevant risks. In practice that means registers, policies, testing, evidence and reporting.

### What are the responsibilities of a GRC analyst?

A GRC analyst does the programme's groundwork: risk assessments, control mapping, regulatory change tracking and audit evidence. The analyst prepares decisions; risk owners and management make them. Until a firm hires one, this work falls to the GRC lead, which is why an analyst is usually the first role added alongside a dedicated lead.

### What is a GRC engineer?

A GRC engineer builds the automation behind the programme: pulling evidence from systems, monitoring controls continuously and feeding the data into reporting. The role sits between security engineering and compliance. We recommend a firm of about 100 staff starts with engineering time from another team before it hires one.

### Who should own GRC in a small firm?

A senior leader with authority across every function should own it, usually the COO or CTO in a firm of 25 to 50 staff. Authority matters more than GRC expertise, because control owners sit in every team and the owner must be able to make them act. Ownership means accountability for the programme, not doing every task; the expertise can be bought in.