Governance, Risk, and Compliance Fundamentals
The GRC operating model
Governance sets direction and accountability; risk management identifies and prioritizes uncertainty; compliance confirms obligations are met. Candidates must know the three-lines model: the first line (business operations) owns and manages risk, the second line (risk and compliance functions) sets frameworks, advises, and monitors, and the third line (internal audit) provides independent assurance. A frequent trap is assigning risk ownership to the second line - the framework owner is not the risk owner; the business owner accountable for the outcome is.
Core vocabulary
Distinguish inherent risk (before controls), residual risk (after controls), risk appetite (the amount of risk the organization is willing to accept in pursuit of objectives), and risk tolerance (acceptable variation around appetite, often expressed as thresholds). Questions often swap appetite and tolerance; remember appetite is directional and strategic, tolerance is measurable and operational. Control types matter too: preventive vs. detective, manual vs. automated, and directive. A single control can be more than one type, but its primary purpose determines classification.
Governance structures
Know the roles of the board (oversight, not management), the audit committee (independent oversight of financial reporting and internal control), senior management (execution), and the CCO or risk officer (program leadership). Segregation of duties and the concept of tone at the top recur constantly.
Rule of thumb
If a question asks who owns a risk, choose the business unit accountable for the objective; if it asks who provides assurance, choose internal audit; if it asks who sets the framework, choose the second line. Worked example: a vendor outage threatens a payment process. The payments manager owns the risk, compliance/risk advises and monitors, and internal audit later tests whether the control worked - three distinct answers for three distinct questions.