GRC Lecture: Governance, Risk and Compliance Frameworks

Governance establishes accountability, transparency, and alignment with organizational goals. It does so through a framework of policies, standards, defined roles (RACI), and procedures that guide consistent execution. Without governance, organizations experience confusion, lack direction, and encounter conflict.

Governance Hierarchy

Corporate governance evaluates, directs, and monitors the enterprise as a whole. IT governance is typically led by the CIO and focuses on aligning technology with business objectives. Information security governance is led by the CISO and concentrates on protecting all assets, with cyber security specifically safeguarding digital assets.

GRC Professional Roles

GRC analysts bridge operational efficiency, compliance, and risk by translating requirements into actionable controls. Risk analysts identify, analyze, and treat threats using likelihood‑impact metrics. Privacy and compliance specialists interpret regulations such as GDPR or DPDP for business units. IT auditors test controls and evaluate evidence, while vendor‑risk (TPRM) specialists assess third‑party risk before onboarding.

Regulatory vs. Business Requirements

Legal and regulatory requirements are non‑negotiable mandates. Stakeholder requirements reflect expectations from customers, partners, or investors. Business requirements capture internal goals and performance targets. Effective GRC aligns all three layers while respecting the hierarchy of obligations.

Three Lines of Defense

The first line—operational management and process owners—owns and manages risk directly. The second line—risk management, compliance, and privacy functions—provides oversight, guidance, and monitoring. The third line—internal audit—delivers independent assurance and reports directly to the board.

Frameworks and Standards

Frameworks such as COBIT, COSO, and NIST give high‑level guidance on how to approach governance, risk, and compliance. Standards like ISO 27001, PCI‑DSS, or SOC 2 define specific, mandatory requirements that organizations must implement to achieve certification. IT general controls (ITGCs) such as access management, change control, and backups form the technical foundation for financial reporting integrity under SOX.

Risk Fundamentals

A threat exploits a vulnerability, creating risk. Risk is quantified as Likelihood × Impact, where likelihood measures the probability of exploitation and impact measures the severity of consequences. Risk appetite, capacity, and tolerance set the boundaries for acceptable exposure. Treatment options include avoidance, mitigation, acceptance, and transfer. An incident is a confirmed event that has already occurred, distinct from the probabilistic nature of risk.

Policy & Governance Hierarchy

• Policy: Broad rules and management intent.
• Standard: Uniform requirements applied across the organization.
• Baseline: Minimum acceptable security configuration.
• Procedure: Step‑by‑step instructions for consistent execution.
• Guideline: Optional best‑practice recommendations.

GRC Implementation Lifecycle

1. Preparation – Create a Business Requirement Document and conduct stakeholder analysis.
2. Regulatory Mapping – Align legal obligations with business processes.
3. Gap Assessment – Use a scoping matrix to identify differences between current practices and required standards.
4. Control Design – Classify controls as preventive, detective, or corrective and map them to frameworks.
5. Continuous Monitoring – Track key performance indicators (KPIs) and key risk areas (KRAs) through Risk and Control Self‑Assessments (RCSA) and ongoing audits.

Audit & Awareness

The internal audit process follows four steps: planning (audit memo and risk assessment), fieldwork (interviews and document requests), test work (workpapers and evidence collection), and reporting (draft report, exit meeting, and action‑plan follow‑up). Training modifies skills, while awareness shapes behavior, both essential for a resilient GRC program.

Mechanisms and Explanations

• Governance Cycle (EDM) – Evaluate legal, regulatory, and market needs; Direct strategy and policy; Monitor performance and compliance.
• ITGC Integration with COSO – COSO provides the high‑level internal‑control framework; specific ITGCs satisfy COSO’s control‑activity requirements.
• Risk Statement Formula – “Due to [cause], there is a risk of [event] resulting in [impact].”
• Audit Process Steps – Planning, fieldwork, test work, and reporting create a structured path to independent assurance.