What are compliance, governance and risk management? They are three connected jobs inside an organization. Governance sets who decides what and how. Risk management finds what could go wrong and decides what to do about it. Compliance proves the organization follows the rules and standards that apply to it. Together they are often called GRC, short for governance, risk and compliance.
The three are easy to blur, because the same people and tools often handle all of them. Keeping them apart makes it easier to see what a policy, an audit or a consultant is actually for, and what to ask a security or managed service provider about.
This guide explains each term, how they fit together, which frameworks you will meet, how a typical GRC program runs, and how managed providers support it.
What is governance?
Governance is the structure for making and enforcing decisions. It answers questions such as who owns security, who approves a new system, who accepts a risk, and how the board hears about problems.
Good governance is mostly clarity:
- Roles. Named owners for systems, data and decisions.
- Policies. Written rules for acceptable use, access, data handling and incident response.
- Oversight. A regular forum where leaders review risks and results.
- Accountability. Consequences, and recognition, tied to following the rules.
What is risk management?
Risk management is the practice of identifying threats and weak points, estimating how likely and how damaging they are, and choosing a response. For each risk an organization can reduce it, transfer it (for example with insurance), accept it, or avoid the activity that creates it.
A simple risk process looks like this:
- Identify. List assets, threats and weaknesses.
- Assess. Rate each risk by likelihood and impact.
- Decide. Choose to reduce, transfer, accept or avoid.
- Act. Put controls in place and assign owners.
- Review. Re-check on a schedule and after any major change.
The output is usually a risk register, a living list of risks with owners and actions. If it never changes, it is not being used.
What is compliance?
Compliance means meeting the requirements set by laws, regulations, industry standards, contracts and your own policies, and being able to show it. Compliance is about evidence. "We do this" is not enough. You need records, logs, reports and sometimes an independent assessment.
Compliance is not the same as being secure. A company can pass an audit and still be breached, and a company with strong security can fail an audit through poor paperwork. The aim is to do both.
How do governance, risk and compliance fit together?
| Part | Question it answers | Typical output |
|---|---|---|
| Governance | Who decides, and by what rules? | Policies, roles, committees |
| Risk | What could go wrong, and what will we do about it? | Risk register, treatment plan |
| Compliance | Can we show we meet the requirements? | Evidence, audit reports, certifications |
Which frameworks and standards come up most?
You do not need to know them all. Which ones matter depends on your industry, customers and countries.
- ISO 27001. An international standard for an information security management system.
- SOC 2. An attestation report about a service provider's controls, often requested by business customers.
- NIST frameworks. Guidance from the United States, widely used as a common language for security and risk.
- HIPAA. United States rules for protecting health information.
- PCI DSS. Requirements for organizations that handle payment card data.
- GDPR. European data protection law covering personal data.
Check the current text of any standard and the rules in your own markets. This article is general information, not legal advice.
What does a GRC program look like day to day?
- A policy set that is reviewed on a schedule and understood by staff.
- A risk register reviewed at regular meetings.
- Control checks that run continuously where possible, and are sampled where not.
- Vendor reviews for the suppliers who handle your data.
- Training and simple ways for staff to report issues.
- Evidence kept in one place, ready for an auditor or a customer questionnaire.
- Incident response plans that are tested, not just written.
Where do managed providers fit in?
Smaller organizations often lack the staff to run a GRC program alone, so they lean on providers:
- MSPs keep systems patched, backed up and documented, which produces a lot of the evidence auditors ask for.
- MSSPs monitor and respond to threats and can report on controls.
- Compliance and governance consultancies help design policies, run assessments and prepare for audits. You can browse them on our page for compliance consulting firms.
When you choose a provider, ask which standards they have been assessed against, what evidence they can share, and how they handle your data.
What are common GRC mistakes?
- Treating compliance as a yearly event. Controls drift between audits.
- Writing policies nobody reads. A policy is only useful if people can follow it.
- Keeping risk in a spreadsheet nobody owns. Every risk needs a named owner.
- Buying a tool before a process. Software supports a program, it does not replace one.
- Ignoring suppliers. Your risk includes the vendors who touch your data.
Related reading
- what is managed detection and response: continuous monitoring and response.
- what is a managed security service provider: outside help with security and evidence.
- what is healthcare data analytics: a regulated field where these rules apply daily.
Where to go next
Governance sets the rules, risk management sets the priorities and compliance proves the result. If you are choosing outside help, start with our managed security service provider list and our page on compliance consulting firms. If you sell to them, request a free 100-record sample of verified contacts.
ChatGPT
Claude
Google AI Mode