Governance, Risk and Compliance – An Integrated Process

Three-letter acronyms. Love them or hate them, we can appreciate that they are convenient shortcuts. Many of us remember when we took the time to speak the words rather than spend that time (and often more) trying to remember what the letters mean.  

And so, to GRC. Or, as some of us might prefer, Governance Risk and Compliance.  

Ahead of our upcoming Lunchtime Learning webinar on GRC (which Paul will be presenting, to give Gerry a break), we wanted to share some of our insights on the topic.  

The three elements of the collective ‘GRC’ are often considered separately and, indeed, are separate in terms of their management, the resource required by each element, and the internal and external factors that cause them to be separate. We deliberately use the word separate as distinct from siloed because Governance, Risk and Compliance are separate, but they work together. 

In every organisation, there must be elements of Governance – that competent resource that does what leadership does. There must be Compliance – the awareness of and the resource to meet the relevant and applicable legal and regulatory requirements. And then there is Risk – the awareness of and resource to manage the threats to the organisational objectives, but also to recognise the opportunities, all while keeping the organisation safe from itself. 

Good stuff happens and bad stuff happens. The ‘G’, the ‘R’, and the ‘C’ each have their own upsides and downsides and managing them successfully relies on understanding their interdependencies as well as their separateness. 

The leadership team has to understand the environment or context in which the organisation seeks to achieve its objectives. They scan the sector and business horizons, set the strategic direction, and resource the organisation to achieve its plans. They set objectives for each facet of the organisation and monitor the performance of each part.   

Some aspects are viewed positively: sales growth; factory output; cost-per-unit reduction; houses built; loan-to-asset ratio improved; profit growth; etc. In other words, the FUN stuff. Others are viewed less positively: no data breaches; no complaints; no regulatory fines; fewer incidents/near misses; no fatalities; no lost time; no accidents; etc. AKA, the BORING stuff. 

Governance is the effective leadership of the whole organisation to work in harmony to achieve the strategic objectives which includes all of the FUN stuff as well as all the BORING stuff. 

A well-governed organisation will achieve its strategic objectives through the effective management of any risks to that achievement – including any failure to comply, culminating in a ‘joined up’ outcome. Each part of the process works individually but is part of the overall process to ensure good governance.