GRC stands for Governance, Risk and Compliance. It describes an integrated approach to running an organisation responsibly: making sure decisions are made and overseen properly (governance), that the things which could go wrong are understood and controlled (risk), and that legal and regulatory obligations are met (compliance).
The term was coined in the early 2000s after a wave of corporate failures - Enron, WorldCom, Parmalat - exposed the cost of treating these three disciplines as separate workstreams that never spoke to each other. The insight behind GRC is simple: governance, risk and compliance are different lenses on the same underlying question - "is this organisation behaving responsibly, and can we prove it?"
Industry note: the analyst Michael Rasmussen (GRC 20/20 Research) is widely credited with formalising the modern GRC discipline and is often referred to - not least by himself - as the "father" or "godfather" of GRC. His OCEG GRC Capability Model work in the mid-2000s did a lot to turn what was a vague management buzzword into a defined operating model.
The Three Disciplines
Governance is how decisions get made and overseen. It covers the structure of the board, the committees that report to it, the delegated authorities given to executives, the policies that set out how the organisation operates, and the reporting that flows back upward. Good governance answers the question "who decides what, on whose authority, and how do we know it is happening?"
Risk management is how the organisation identifies, assesses, treats and monitors the things that could prevent it achieving its objectives. This is the risk register, the risk and control assessments, the appetite statements, the heat maps that go to the Risk Committee. For a deeper look at the risk discipline, see our guide to building an Enterprise Risk Management (ERM) framework.
Compliance is how the organisation makes sure it meets external rules - regulations, laws, contractual obligations, codes of practice - and internal rules (its own policies). Compliance work tracks obligations, maps them to controls, evidences that the controls operate, and reports breaches.
The reason these three disciplines are bundled together is that they share most of the same source data - the same risks, the same controls, the same evidence, the same owners. When governance, risk and compliance are run as separate functions on separate systems, the same person ends up answering the same question three times for three different audiences. GRC, done well, asks the question once and routes the answer to all three.
What GRC Looks Like in Practice
In a typical mid-market regulated firm, a working GRC framework usually contains:
- A risk register - the canonical list of risks, their owners, their gross/net scores, the controls that mitigate them, and the actions in flight to address them. See our guide to what a risk register actually is.
- A control library - the catalogue of controls in place, who owns each one, how often it is tested, and whether it is operating as designed.
- Risk and Control Self-Assessments (RCSA) - the periodic exercise where the first line confirms which risks they face and how well the relevant controls are working. See what an RCSA actually is and why most programmes fail.
- A policy framework - the policies and procedures that govern day-to-day decisions, with version control, approvals, and attestations.
- A compliance obligations register - the list of regulations and standards the organisation is subject to, mapped to the controls that satisfy them.
- A reporting layer - the board pack, the committee papers, the regulatory returns. See what board-level risk reporting actually requires.
- A clear governance model - usually based on the Three Lines of Defence, which separates ownership (first line), oversight (second line) and assurance (third line).
Who Actually Does What: Roles Across the Three Lines
The textbook describes the three lines as neat, separate boxes. The reality in a mid-market firm looks more like a slightly chaotic relay race - and that's fine, as long as everyone knows when they are holding the baton. Here is where the work usually sits in practice, and where it should sit when the model is healthy.
First Line
Operational ownership
Heads of operations, IT, finance, customer service and sales operations - the people running the business day to day.
Responsible for identifying the risks in their domain, operating the controls that mitigate them, evidencing that those controls work, and owning remediation when issues arise. The first line owns the risk - not the risk team.
Second Line
Oversight and challenge
Risk and compliance functions, often supported by a CISO or Head of Operational Resilience. Typically a small team in a mid-market firm.
Responsible for setting the methodology, maintaining policy and the assessment calendar, training the first line, and providing constructive challenge. The second line is not there to perform the first line's work; it is there to ensure that work is performed to the required standard.
Third Line
Independent assurance
Internal audit, frequently co-sourced or outsourced in mid-market firms. Reports to the Audit Committee, not to executive management.
Responsible for forming an independent opinion on whether the framework operates effectively - whether the risks reported to the board are the risks that genuinely exist, and whether the controls relied upon are operating as designed.
The most common failure mode is that the second line gradually absorbs the first line's responsibilities. The risk team chases owners for updates, completes RCSA scoring on their behalf, drafts remediation plans, and then authors the board paper that reports on all of it. By the time the third line audits the framework, it is effectively auditing the second line's view of work the second line has performed itself - which is not what the model is designed to provide.
The healthier position is unambiguous: the first line owns the risk. If a risk owner cannot articulate their top three risks in a brief conversation, the risk is not genuinely owned - it sits in a register maintained by someone else. The second line's role is to make that level of ownership possible, not to substitute for it.
When the Head of Risk is the only person who can speak to the score of every risk on the register, the model has inverted. The second line has become the source of truth rather than the source of challenge. The framework holds together until a regulator or a serious incident asks who decided a given residual risk was acceptable - at which point the answer points back to the risk team, who do not own the underlying activity.
When Does Any of This Start to Matter?
For a 20-person startup, the three lines sit on three sides of the same standing desk. That is fine. GRC as a formal discipline only starts to earn its keep when the gaps between the lines become real - and there are usually four moments when that happens fast:
- Headcount crosses ~100. The CEO no longer personally knows what every team is doing. Risks start happening that nobody at the top sees coming, because the line of sight has broken. This is the moment a real risk register stops being optional.
- A regulator walks in. FCA authorisation, CQC inspection, OfS condition of registration, ICO audit, ISO 27001 certification, SOC 2 Type II, customer security questionnaire from a Tier-1 bank - whichever flavour shows up first. The day someone external asks "show us how this is governed" is the day informal stops working.
- Something goes wrong - and there is no audit trail. A breach, an outage, a complaint, a missed deadline. Senior leadership asks who knew, when, and what was done about it. If the honest answer involves trawling Slack DMs and an email folder labelled "follow up", you have outgrown the informal model.
- Money is on the table. A funding round, an exit conversation, a major contract, an insurance renewal. Investors, acquirers, prime customers and underwriters all ask the same set of GRC questions - and they all read the answer as a proxy for how seriously the leadership team takes its own business.
If two or more of those have happened to you in the last twelve months, you are not "thinking about" GRC anymore - you already have one. The only question is whether it is documented, defensible and operating, or whether it is a series of confident answers held together by the personal credibility of two or three people who are one resignation away from a problem.
The Honest Bit: GRC Is Not Glamorous, But It Is Asymmetric
Nobody gets promoted for the breach that did not happen. Nobody throws a launch party for a clean audit opinion. GRC is the corporate equivalent of fixing the roof in summer - hard to celebrate, expensive to ignore.
But the payoff is asymmetric. A good GRC framework saves you from the kind of single bad day that resets a five-year strategy. It is the cheapest insurance against the most expensive failure mode in regulated business: the one where the board genuinely did not know, the regulator decides that is itself the failure, and the front page writes itself. Run properly, GRC is not the cost of doing business - it is the thing that lets the business compound without rebooting itself every two years.
GRC vs ERM vs Internal Audit: How They Relate
These three terms are often used interchangeably, which is a mistake. They refer to different things:
- ERM (Enterprise Risk Management) is the risk discipline within GRC. It is the methodology and tooling used to identify, assess, treat and monitor risk across the enterprise. ERM is a subset of GRC.
- GRC is the broader integrated framework: governance + ERM + compliance, run as one connected system rather than three.
- Internal audit is the independent assurance function (the third line of defence) that tests whether GRC actually works. It is not part of GRC; it audits GRC.
When Does an Organisation Need a GRC Platform?
Every organisation does some governance, risk and compliance work - even if it lives in spreadsheets and email. The question is when it stops being enough. Typical triggers:
- Regulatory expectations - the regulator wants documented evidence of how risks are managed, not just a list of them.
- Board visibility - the board cannot get a single, current view of the top risks without someone spending a week assembling it.
- Operational drag - the time spent chasing spreadsheets and reconciling versions outweighs the cost of a tool.
- Audit fatigue - the organisation is rebuilding the same evidence pack for every internal audit, external audit, regulatory visit and customer due diligence questionnaire.
- Provision 29 (UK) - listed firms must, from 2026, declare the effectiveness of their material internal controls. See our end-to-end Provision 29 compliance guide.
When you reach those triggers, the question becomes how to choose a tool. We have a dedicated guide on how to choose a GRC tool in 2026 and on the best GRC software for mid-market companies.
The Mid-Market GRC Problem
The GRC software market is split. At the top end, enterprise platforms (ServiceNow GRC, Archer, MetricStream) require six-figure budgets and long consultant-led implementations. At the bottom end, single-purpose point tools (a policy management app, a compliance checklist app) cover one slice of the picture but do not connect.
Mid-market regulated firms - typically 100 to 5,000 employees in financial services, healthcare, professional services, technology and manufacturing - sit awkwardly between the two. They have outgrown spreadsheets but cannot justify enterprise platform pricing. Right-sized GRC platforms exist precisely for this gap: enough capability to cover the full GRC framework, but proportionate in price, deployment time and operating model. See our piece on GRC software pricing in the UK for how to read the commercial side.
Takeaway
GRC is the integrated discipline of running an organisation in a way the board, the regulator and the auditor can defend. It is not a piece of software - it is a framework of governance, risk and compliance practices, supported by a system of record that ties them together.
If you want to see what a right-sized GRC platform looks like in practice for a mid-market firm, book a conversation.