GRC Capability Model Details - Align Component
The Align component converts understanding into commitment. This domain tests how governance structures, accountability, appetite, policy, culture and resources are arranged so the GRC program and the business point in the same direction.
Purpose
Align ensures the capability is embedded in how the organization is directed and resourced, so that obligations and risks identified in Learn have named owners, authority, budget and behavioral support.
Core elements
- Oversight and accountability - board and committee oversight, delegation of authority, a named accountable owner for each objective, risk and obligation; clear responsibility between the three lines.
- Risk appetite in practice - board appetite statements converted into limits, thresholds and escalation triggers at business-unit and process level.
- Policy framework - each policy traceable to an obligation from Learn, with an owner, review cycle, and linked procedures and controls.
- Culture and tone - leaders' behavior, incentives and performance measures, speak-up mechanisms, training and awareness.
- Integration - GRC activities embedded in existing business processes rather than bolted on, with a shared taxonomy and coordinated calendars.
Why alignment matters
Most GRC failures are misalignment: an appetite the business never heard of, a policy nobody applied, an owner who does not exist in practice. Align turns information into commitments and resources.
Worked example
A business unit's growth plan would push group exposure to a single counterparty above its appetite limit. Reasoning: the limit derives from board-approved appetite, so the business unit cannot self-approve a breach. The request escalates with the exposure quantified; the board or a delegated committee decides - reject, restructure the deal, or temporarily raise appetite with conditions. The decision is documented, limits are updated, and reporting reflects the change. Incentives must not reward the breach that policy forbids.
Traps
- Conflating tone at the top with culture; incentives and measured behavior are stronger signals.
- Writing policies with no mapped obligation, producing policy for its own sake.
- Assigning accountability to a committee rather than a named role.
- Appetite statements with no measurable thresholds or escalation path.
- Aligning once; reorganizations and new strategy quietly break the mapping.