GRC and integration into the service value system
Governance is not management
Governance is the system by which an organization is directed and controlled. It has three recurring activities - evaluate (assess needs, options, risks), direct (set policy, priorities and decision rights) and monitor (check performance, risk and compliance against the direction given). A governing body is accountable and cannot delegate that accountability, even when it delegates authority.
Risk and compliance sit alongside governance because they are how direction is made safe: compliance means conforming to obligations (legal, regulatory, contractual, standards, internal policy), and risk management provides the structured view of uncertainty. Together, GRC is an integrated set of capabilities - treating them as three separate silos is a classic exam trap.
Relating GRC to the service value system is essential: governance is a component of the SVS, sitting alongside the guiding principles, the service value chain and the practices, with continual improvement running through all of it. Governance sets guardrails and decision rights; management executes within those guardrails. Risk and compliance are built in, not bolted on at the end.
Traps: confusing governance with management or day-to-day delivery; assuming governance is only for the board of a large enterprise; assuming a discrete 'governance practice' exists separately from SVS governance; treating compliance as paperwork completed by the audit team.
Rule of thumb: if a scenario asks who is accountable, the answer is the governing body; if it asks who does the work, the answer is management and the practices, within the guardrails governance defined.