GRC Reference Architecture

Governance, Risk, and Compliance (GRC) is presented as an integrated set of capabilities for reliably achieving organizational objectives when delivering IT services. Governance sets objectives, policies, decision rules, and measurable controls, while management plans, builds, runs, and monitors execution within that direction. The report argues that digitalization and cloud services make IT governance inseparable from corporate governance, because service delivery is increasingly outside direct organizational control and must be governed through objectives, oversight, and performance monitoring.

GRC’s primary purpose is to ensure IT-related business risks are managed and legal, regulatory, and contractual obligations are met in a cost-effective, non-duplicative way. A shared vocabulary is essential because “risk” is used inconsistently; here, risk is defined as the effect of uncertainty on objectives, and risk management aims to reduce likelihood and/or impact. The report introduces a hazard-focused risk model in which threats exploit vulnerabilities and overcome controls to create business impact on assets; controls can be preventative, detective, restorative, or assurance-based (notably for outsourcing and cloud).

GRC is framed as a continuous cycle: requirements review (laws/regulations, business impact analysis, contracts), policy and control definition (align overlaps, resolve conflicts, remove redundancies), review of effectiveness (using automated data, manual attestations, and audits plus threat landscape context), definition of improvement projects (selected via portfolio management using financial and strategic dimensions, including RSI), and crisis/incident management (planned and tested, with clear triage and escalation between emergency and board-level crisis response). Effective GRC requires board sponsorship, a steering committee spanning stakeholders, centralized risk registration, tool-supported reporting from a single data source, and board reporting that emphasizes risk posture and maturity against targets rather than technical detail.

• GRC is defined as an integrated collection of capabilities enabling an organization to achieve objectives, address uncertainty, and act with integrity.
• Governance sets objectives and rules while management executes processes aligned with that direction.
• ISO 31000 defines risk as the effect of uncertainty on objectives.
• ISO Guide 73:2009 identifies hazard risk, control risk, and opportunity risk as three types of risk.
• The ISACA Risk IT framework identifies strategic, environmental, market, credit, operational, and compliance risk categories.
• The Basel Accords categorize financial risk into market, liquidity, credit, and operational risk, placing IT risk under operational risk in that model.
• A risk register is intended to include identifiers, descriptions, owners, stakeholders, assets at risk, inherent/residual probability and impact, and treatment details.
• Control status inputs are grouped into automated sources, manual sources, and audits.
• Control effectiveness review cadence is described as ranging from weekly to quarterly, depending on need and best practices.
• Crisis team training exercises are recommended at least annually.

• “GRC is the integrated set of capabilities that ensure the reliable execution of organizational goals.”
• “Governance sets the objectives and rules while management executes the processes.”
• “The word risk is in common use and means different things to different people.”
• “The worst possible approach is to set up independent groups to manage and report on each regulatory area.”
• “Organizations are strongly advised to adopt a standard GRC framework.”
• “The objective of risk management is to reduce the impact and / or the likelihood of a risk.”
• “Ideally, there should be one risk register for the whole organization.”
• “The controls that are chosen should be relevant, effective, measurable and proportional.”
• “The GRC organization is not responsible for implementation, rather it is responsible for setting controls, monitoring effectiveness and specifying changes that are required.”
• “Reporting to the organizational board should be based on risk strategy objectives rather than technical controls.”