thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

Governance, Risk, and Compliance (GRC)

Integrated approach to aligning IT and security with business objectives, managing risk, and meeting legal and regulatory requirements.

Definition

GRC combines corporate governance (direction and oversight), enterprise risk management (identifying and treating risk), and compliance (conforming to laws, regulations, contracts, and policies) into a coordinated program. Integrating the three reduces duplicated control testing and gives leadership a single view of risk posture. GRC platforms such as ServiceNow IRM or Archer automate control libraries, assessments, and reporting.

Example

A company maps one access-review control to SOX, PCI DSS, and ISO 27001 requirements in its GRC tool and tests it once.

Exam tip

Exams treat governance as setting direction and management as executing it; GRC is the umbrella, not a synonym for compliance.

Related terms