What GRC means
GRC stands for governance, risk and compliance. It is the practice of running those three functions as one coordinated system instead of three separate departments with separate spreadsheets.
OCEG, the nonprofit that popularized the term, defines GRC as “the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity.” OCEG calls that outcome “Principled Performance.”
- Governance sets direction: objectives, policies, roles, oversight and accountability.
- Risk management identifies what could stop the organization from reaching those objectives and decides what to do about it.
- Compliance makes sure the organization meets its legal, regulatory, contractual and internal obligations, and can prove it.
The word that matters is “integrated.” A risk register that never informs policy, or a compliance program that never feeds risk assessments, is not GRC. It is three silos with a shared acronym.
Why GRC is getting more attention in 2026
Several regulatory developments explain why boards and regulators now expect integrated, evidence-based programs:
| Driver | What it asks for |
|---|---|
| SEC cybersecurity rules (adopted July 26, 2023) | Annual disclosure of processes for assessing and managing material cyber risk, board oversight and management’s role (Regulation S-K Item 106); material incidents on Form 8-K within four business days of a materiality determination |
| DOJ Evaluation of Corporate Compliance Programs (updated September 23, 2024) | Risk assessments that cover AI and new technologies; compliance access to company data; timely review of vendors |
| NIST Cybersecurity Framework 2.0 (February 26, 2024) | A new Govern function, with emphasis on governance and supply chains |
| Interagency third-party guidance (June 6, 2023) | Life-cycle risk management of third-party relationships at US banks |
| EU DORA (applies from January 17, 2025) | ICT risk management and ICT third-party oversight for EU financial entities |
| AI rules (EU AI Act, state laws, NIST AI RMF) | Inventories, risk assessments and human oversight for AI systems |
The common thread is evidence. Each framework asks not only whether a control exists, but how the organization knows it works.
The frameworks behind GRC
GRC is not one standard. Programs usually combine several:
| Area | Common frameworks |
|---|---|
| Enterprise risk | COSO ERM (Integrating with Strategy and Performance, 2017); ISO 31000:2018 |
| Cybersecurity | NIST CSF 2.0; ISO/IEC 27001; SOC 2 |
| Third-party risk | US interagency guidance (banking); DORA (EU finance) |
| AI | NIST AI RMF 1.0; ISO/IEC 42001:2023; EU AI Act |
| Compliance programs | DOJ Evaluation of Corporate Compliance Programs; OFAC Framework for Compliance Commitments |
| Sector rules | For example 21 CFR Part 11 and GMP in life sciences, HIPAA in healthcare, GLBA in finance |
A common approach is to map controls once to many frameworks, so one piece of evidence (for example an access review) supports several obligations.
How a GRC program works
- Set governance. Define objectives, risk appetite, policy ownership and reporting lines to the board.
- Build an obligations inventory. List the laws, regulations, standards and contracts that apply.
- Map controls to obligations. One control can satisfy several requirements.
- Assess risk. Identify, score and prioritize risks, including third-party and AI risks.
- Collect evidence. Policies, procedures, records, test results, certificates, vendor reports.
- Test and monitor. Check that controls operate, ideally continuously where data allows.
- Manage issues. Track findings, remediation and exceptions to closure.
- Report. Give management and the board an accurate view of risk and compliance status.
Steps 5 to 7 are where most effort goes, and where programs most often fall short.
Common weaknesses
- Silos. Risk, compliance, security and audit maintain separate registers that disagree.
- Paper controls. Policies exist, but no evidence shows they operate.
- Stale evidence. Certificates, SOC reports and policies past their review dates.
- Third parties outside the program. Vendors handle critical data or processes with little oversight.
- AI outside the program. New AI tools adopted without inventory or risk assessment. Verizon’s 2026 DBIR reports that employee use of unapproved AI tools rose from 15% to 45% in a single year.
- Reporting without substance. Dashboards show green while underlying evidence is missing.
GRC program checklist
- Governance roles, risk appetite and board reporting defined
- Obligations inventory maintained and owned
- Controls mapped to obligations and frameworks
- Risk assessment covers enterprise, cyber, third-party and AI risk
- Evidence collected, dated and linked to controls
- Controls tested on a defined schedule
- Issues tracked to closure with evidence
- Third parties and AI systems inventoried and assessed
- Reporting traceable back to evidence
Check compliance evidence with AskDona
GRC programs run on documents: policies, procedures, control evidence, audit reports, vendor attestations. AskDona reads that evidence against the requirements you set, flags gaps such as missing evidence, expired documents or statements that conflict across files, and links every finding to the exact page it came from. Run a sample compliance evidence review on one control area. AskDona shows the evidence; your compliance team decides.
FAQ
What does GRC stand for? Governance, risk and compliance: the coordinated management of an organization’s direction, its risks and its obligations.
What is a GRC framework? A structure for running GRC, usually combining an enterprise risk framework such as COSO ERM or ISO 31000 with domain frameworks such as NIST CSF 2.0 or ISO/IEC 27001.
Who owns GRC? Usually shared: the board oversees, management owns risks and controls, risk and compliance functions set standards and monitor, and internal audit gives independent assurance.
Is GRC only for large companies? No. Smaller organizations face the same obligations and benefit from a single inventory of obligations, controls and evidence.
How does AI affect GRC? AI adds new risks to manage (inventory, bias, accuracy, oversight) and new tools for managing them, such as automated evidence review.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| OCEG, What is GRC | Nonprofit standards body | GRC and Principled Performance definitions |
| SEC press release 2023-139 | US regulator | Cybersecurity disclosure rules |
| Gibson Dunn, DOJ updates ECCP (Sept 2024) | Law firm client alert | DOJ compliance program expectations |
| NIST, CSF 2.0 release (Feb 2024) | US standards agency | CSF 2.0 Govern function |
| Federal Reserve, interagency third-party guidance (June 6, 2023) | US regulator | Third-party guidance |
| EIOPA, DORA | EU supervisory authority | DORA application date |
| Verizon, 2026 DBIR release (May 19, 2026) | Industry report | Shadow AI statistic |
| ISO 31000 | International standard | Risk management standard |
| ISO/IEC 42001 | International standard | AI management system |
| NIST AI RMF | US standards agency | AI risk framework |