What is GRC? Governance, Risk and Compliance explained
GRC stands for governance, risk and compliance. The three are usually spoken about as one discipline because in practice they are inseparable: governance sets the direction and the accountability, risk management decides what the organisation worries about and in what order, and compliance demonstrates to a third party that the first two are genuinely happening. Take any one away and the other two stop working properly.
What this session covers
- Governance is about decision rights and accountability — who owns a risk, who approves an exception, and who answers for it at board level.
- Risk management is the process of identifying what could go wrong, judging how likely and how damaging it would be, and deciding whether to accept, reduce, transfer or avoid it.
- Compliance is the evidence layer: showing a regulator, an auditor, a customer or an insurer that the controls you claim to have are real and working.
- A GRC analyst spends far more time on writing, structuring and evidencing than on technical tooling — which is why the role is open to people from non-technical backgrounds.
The most common misunderstanding about GRC is that it is a paperwork function. It is better understood as the part of security that turns technical reality into decisions the business can actually make. A vulnerability scan produces findings; GRC decides which of those findings the organisation is willing to live with, records why, and makes sure someone senior owns that choice.
That is also why GRC is one of the more accessible entry points into cybersecurity. The core skills — clear writing, structured thinking, asking good questions, being comfortable with ambiguity — transfer directly from audit, law, project management, operations and many other backgrounds.
Go further with mentorship
This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation.