GRCP key terms

An integrated approach to directing an organization, managing uncertainty, and meeting obligations by aligning decision rights, risk treatment, and compliance activities so they reinforce rather than duplicate one another.

A structured reference describing the components and activities an organization needs in order to govern, align, perform, and review GRC work in a repeatable, measurable way.

One of the four top-level groupings of the model: Learn, Align, Perform, and Review. Each component contains elements that describe what the organization must be able to do.

A named capability within a component, such as culture or objective setting. Elements group related practices and are further described by activities and sub-activities.

A concrete practice that must be performed to achieve an element. Activities are the actionable layer of the model and are typically assessed for maturity or coverage.

Coordinating governance, risk, and compliance work across functions and business units so that shared information, common processes, and consistent reporting replace isolated silos.

A condition in which a function such as audit, risk, or compliance operates with its own data, methods, and reporting, causing duplicated requests, conflicting conclusions, and limited enterprise visibility.

The organized set of roles, processes, technology, and reporting an organization uses to deliver GRC outcomes, ideally designed as a coherent whole rather than as disconnected projects.

A way of describing accountability for risk: operational management owns risk, a risk and compliance function provides oversight and challenge, and internal audit gives independent assurance to the governing body.

The board or equivalent body accountable for overseeing the organization's direction, risk appetite, and the adequacy of its governance, risk, and compliance arrangements.

An independent, evidence-based conclusion about whether controls, processes, or reported information meet defined criteria, typically provided by internal audit or an external reviewer.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in statements or limits that guide decisions and tolerance setting.

A measurable range or threshold applied to a specific risk or objective, translating the broader risk appetite into operational limits that trigger escalation or action.

A requirement the organization must satisfy, arising from law, regulation, contract, standard, or voluntary commitment, which is identified, interpreted, and assigned to an accountable owner.

A single set of controls mapped to multiple obligations and risks, allowing one control to satisfy several requirements and reducing duplicate testing and documentation.

The part of the model concerned with building awareness and understanding: culture, training, communication, and the shared knowledge that enables sound GRC decisions.

The shared values, norms, and behaviors that determine how people treat risk and compliance in daily decisions, including willingness to raise concerns and challenge conduct.

The signals sent by senior leaders through their words and actions about the importance of ethics, risk management, and compliance, which shape behavior throughout the organization.

An environment in which employees feel safe to report concerns, errors, or misconduct without fear of retaliation, supported by accessible channels and visible follow-through.

A confidential route, often independently operated, through which staff and third parties can report suspected wrongdoing and receive confirmation that the report was received and handled.

Ensuring that people understand the risks, obligations, and expected behaviors relevant to their role, so they can recognize issues and act appropriately without needing specialist knowledge.

Structured learning activities that build the specific competencies people need for their responsibilities, delivered at the right time and evaluated for effectiveness rather than completion alone.

A description of the knowledge, skills, and behaviors required for GRC roles and responsibilities, used to target training, assess capability, and plan succession.

Systematically capturing what worked and what did not after an incident, review, or project, then feeding those findings back into policies, controls, and training.

The part of the model concerned with direction and coordination: setting objectives, defining roles, allocating resources, and establishing the policies and structures that let GRC work proceed consistently.

Defining clear, measurable goals for the organization and for GRC activities, so that risk decisions, controls, and reporting can be judged against an explicit standard.

Documented allocation of who decides, who performs, who reviews, and who is informed for each GRC activity, preventing gaps and duplicated accountability.

A grid assigning each activity to those responsible, accountable, consulted, and informed, used to clarify decision rights and reduce ambiguity in cross-functional GRC processes.

A formal statement of management intent and mandatory requirements that translates obligations and risk appetite into rules people must follow, supported by standards and procedures.

The end-to-end process of drafting, approving, publishing, training on, reviewing, and retiring a policy, with clear ownership and scheduled review dates.

A documented, time-bound approval allowing a deviation from a policy requirement, with a stated rationale, compensating controls, and an owner accountable for closure.

The committees, reporting lines, and decision forums through which GRC matters are escalated, decided, and overseen, including their charters and membership.

The part of the model concerned with execution: identifying and treating risk, operating controls, managing obligations and incidents, and running GRC processes day to day.

Identifying, analyzing, and evaluating risk against defined criteria, typically by combining likelihood and impact, to decide whether treatment is needed and at what priority.

The level of risk before any controls or mitigations are applied, used as a baseline for judging how much protection existing controls actually provide.

The level of risk remaining after controls and treatments are applied, compared against tolerance to decide whether further action or formal acceptance is required.

Choosing and implementing a response to risk, such as avoiding, reducing, sharing, or accepting it, with an owner, timeline, and evidence of completion.

A documented decision by an authorized person to bear a risk without further treatment, recorded with rationale, level of residual risk, and a review date.

A measure that modifies risk or helps ensure obligations are met, designed with an owner, frequency, evidence, and a clear link to the risks or requirements it addresses.

Linking controls to the risks, obligations, and policies they address, which reveals gaps, redundancy, and opportunities to rely on a single control for multiple purposes.

Examining evidence to determine whether a control is designed appropriately and operating effectively over a period, producing a conclusion that feeds reporting and remediation.

Recording, prioritizing, assigning, and tracking problems found through testing, incidents, or reviews until they are remediated or formally accepted, with escalation for overdue items.

A documented set of actions, owners, and dates to correct a deficiency, including interim compensating measures and evidence that the fix has been validated.

A metric that provides early warning of increasing risk exposure, chosen for its predictive link to a specific risk and monitored against defined thresholds.

A metric that measures progress toward an objective, used alongside risk indicators so that performance gains are not achieved by taking unacceptable risk.

A maintained inventory of legal, regulatory, contractual, and voluntary requirements, each interpreted into specific obligations and assigned to an accountable owner.

Monitoring for new or amended requirements, assessing their impact, and updating policies, controls, and systems before the effective date to avoid breaches.

The part of the model concerned with monitoring and improvement: measuring performance, obtaining assurance, reporting to stakeholders, and acting on findings.

A structured view of which risks and controls are covered by which assurance sources, showing overlaps and gaps so that assurance effort can be targeted and relied upon.

Presenting risk, compliance, and control information to decision-makers in a form that is accurate, timely, and relevant to their level of accountability.

A structured investigation to determine why a problem occurred at a systemic level, so that remediation addresses the underlying cause rather than only the visible symptom.

An ongoing cycle of measuring GRC performance, comparing it with expectations, and adjusting processes so capability grows over time rather than remaining static.

A graded description of how consistently and effectively a GRC activity is performed, ranging from ad hoc practice through defined and measured practice to optimized practice.

An independent function that evaluates the design and operation of governance, risk, and control processes and reports its conclusions to the governing body.