“GRC (Governance, Risk, and Compliance) is the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty, and act with integrity — to achieve Principled Performance.”OCEG (Open Compliance and Ethics Group) · What Is GRC (Governance, Risk, and Compliance)? · 2002 · OCEG, «What Is GRC (Governance, Risk, and Compliance)?» — definiția de deschidere; acronimul a fost creat de OCEG în 2002
GRC is not a department but the property of not having three different truths about the same control.
The acronym was coined by OCEG in 2002, and its definition is less bureaucratic than it sounds: the integrated collection of capabilities that let an organisation reliably achieve objectives, address uncertainty and act with integrity. The load-bearing word is integrated. Governance sets direction and accountability, risk management says what can break that direction, compliance says what is mandatory along the way. Kept apart, they trip over each other: the same controls get inventoried three times, the same evidence is requested by three teams, and the board receives three dashboards that disagree. That is why GRC cannot be bought as a department or as a tool. It shows up in artefacts: one risk register, one set of controls with named owners, one list of legal obligations linked to those controls, and one report to the board. Everything else is a label stuck over the same three silos.
Passage 1. Integration is not just shared registers; it flips the order of work: leadership questions come first, and governance, risk and compliance answer them together. In siloed practice it works backwards — each team builds its own inventory, then hopes someone will assemble it. A concrete example: launching a new product, the risk team assesses separately, the legal team checks separately, and the board hears two stories instead of one. An integrated organization starts from the question “can we launch this safely?” and gathers risks, obligations and controls as a single answer. Next step: what this looks like day to day, among people who never call it “GRC”.
Passage 2. Day to day, integration looks less like a program and more like small habits. People never say "GRC"; they simply stop asking for the same evidence twice. An accountant receiving an audit request asks whether the answer can also serve the security policy. A manager opening an incident immediately checks which legal obligations it triggers, not only at the end. A mundane example: when a payment vendor changes, one person gathers the risk assessment, the legal requirements and the control tests, then sends them together. The telltale sign is that nobody later discovers someone else had already done the same work. But these habits do not appear on their own; what makes them possible is the next question.
Passage 3. What binds these habits is not software but ownership: every control has a named person accountable for it. Without that, integration stays a drawing on paper. When a control has a single owner, the same test can serve many purposes, because someone is obliged to keep it alive. A concrete example: the control "access is reviewed quarterly" belongs to a specific team lead, and audit, security and legal all ask that one person, not three. If nobody signs up, each team builds its own copy and the silos come back to life. The named owner is the glue that keeps the register, obligations and controls in one place. But what happens when the organization grows and owners multiply? That is where integration is truly put to the test.
As an organization grows, owners multiply, and integration usually breaks on language. Each team names the same risk differently, so three lists about the same thing look like three different problems. The fix is not a department but a shared vocabulary: one risk, one obligation, one control each get a fixed name everyone uses. A concrete example: late payments to suppliers means exactly the same thing to procurement, legal, and finance, so their three registry entries merge without debate. Without that dictionary, even named owners quietly rebuild silos, only bigger. That leaves the question of what leadership actually does with the single picture this common language gives them.
Leadership now receives a single picture. But that unified view is not a report to read; it is a decision tool: it shows where risk, obligations and objectives collide. Concrete example: the budget is tight, and the picture shows one weak control covering both a legal duty and a major fraud risk. Money goes there, not to a project that merely looks good. Without the integrated view, each team asks for funds with its own story, and the choice becomes an auction. With it, the choice becomes a comparison on one scale. This is where Principled Performance appears: results that are not bought by compromising integrity. Next step: what happens when an unexpected event hits and decision time suddenly shrinks.
An unexpected event is the real test of integration, because decision time suddenly shrinks. In an integrated organization, leadership does not gather information during the crisis; it already has it, because the risk register, obligations and controls live in one place. A concrete example: a cloud provider goes down on a Thursday evening. Instead of three parallel meetings, the single picture immediately shows which clients are affected, which notification obligations kick in, and which backup controls exist. In siloed organizations, those same hours are spent hunting for who knows what. The crisis does not create the chaos; it only reveals it. And how decisions get made under pressure shows whether the integration is real or just a label.
Integration is not finished once built; it wears out if unmaintained. Registers, obligations and controls change constantly, and a stale single picture misleads as elegantly as three separate ones. Maintenance is not an annual project but a small, regular rhythm: who reviews what, when, and what triggers an update outside the calendar. Concrete example: a new data-protection law appears in spring; the obligation list is updated that same week, the matching control gets an owner, and the board picture reflects the change at the next meeting. Without that rhythm, integration becomes a snapshot of the past, not a picture of the present. The open question: who guards this rhythm when nobody explicitly demands it.
Why it matters Whoever treats GRC as three neighbouring departments pays three times for the same evidence and still cannot answer a single board question.