What Is GRC? Governance, Risk and Compliance Explained

What is GRC? Governance, risk and compliance (GRC) is the discipline of running an organisation so it is directed well, protected from what could foreseeably go wrong, and able to prove it meets its obligations.

This guide covers each pillar with a clear and easy to understand explanation, the frameworks that matter in Australia, where AI governance now sits, and what GRC software actually does, without the enterprise jargon.

Sentrient is an Australian-built GRC platform for compliance, risk and HR. See our GRC software, workplace compliance system and workplace compliance courses, all built for Australian and New Zealand workplaces.

This guide covers the Australian context. Obligations vary by sector, size and jurisdiction, and work health and safety duties differ between states and territories.

What Is GRC, Exactly

GRC is not a product or a regulation. It is a way of joining three jobs every organisation already has, so they run off the same information instead of three separate spreadsheets.

Pillar	The question it answers	Typical working parts
Governance	Who decides, and how are decisions made and recorded?	Board and management structures, delegations, policies, codes of conduct
Risk	What could go wrong, and what are we doing about it?	Risk register, risk assessments, controls, incident and hazard reporting
Compliance	What must we meet, and can we prove it?	Obligations register, training records, acknowledgements, audits

The acronym gets used loosely, which is why answers to “what is GRC” often sound circular. The test is simpler than the vocabulary.

What GRC Stands For, Pillar By Pillar

1. Governance: The Deciding Layer

Governance is the deciding layer: who holds authority, how it is delegated, and how the organisation knows its own rules are being followed.

In a listed company that means board committees and charters. In a 120-person business it means clear delegations, current policies, and leadership that reviews the right reports.

Size changes the ceremony, not the substance.

Governance is also where personal accountability lives.

Under Australian WHS law, officers hold a due diligence duty they cannot delegate, and the evidence that discharges it is governance evidence: minutes showing the right questions asked, reports showing controls verified, and policies that match practice.

2. Risk Management: The Looking-Ahead Layer

Risk management is the looking-ahead layer: identify what could cause harm or loss, assess how likely and how severe, control it, and review whether the controls still work.

The register is the tool, not the outcome. A risk register nobody has opened since the last audit is a governance failure wearing a risk costume.

The scope of the risk pillar keeps widening. Psychosocial hazards now sit alongside physical ones in every Australian jurisdiction, and operational resilience expectations keep rising.

The process holds steady even as the content grows: identify, assess, control, review.

3. Compliance: The Proving Layer

Compliance is the proving layer: knowing which laws, regulations and industry rules apply, meeting them, and holding the evidence.

For Australian businesses that spans WHS duties, employment law, privacy, anti-discrimination law including the positive duty under the Sex Discrimination Act, whistleblower protections, and sector rules.

Most compliance failures are not exotic. They are lapsed training, unacknowledged policies, and records nobody can find.

GRC vs ERM, Internal Audit And Compliance Management

For most people the question “what is GRC” is really the question “what is GRC and how is it different from the four other acronyms I keep hearing”.

These terms overlap and get used interchangeably, which is a large part of why the field sounds harder than it is. Here is how they actually relate.

Term	What it covers	How it relates to GRC
GRC	Governance, risk and compliance run as one discipline off shared records	The umbrella. The other four sit inside it or beside it
ERM (enterprise risk management)	Risk identified, assessed and managed at whole-of-organisation scale rather than by department	The risk pillar of GRC done at enterprise scale. ERM is a subset, not a synonym
IRM (integrated risk management)	A newer framing that emphasises risk in business context and continuous monitoring	Largely the same territory as GRC, marketed differently. Compared side by side in our guide to integrated risk management
Compliance management	Tracking obligations, meeting them, and proving it	One pillar of GRC. It answers “did we meet the rule”, not “who is accountable” or “what else could go wrong”
Internal audit	Independent assurance that controls exist and work	The checking function that sits outside the three pillars and tests them. Not part of GRC delivery
Corporate governance	Board structures, director duties, delegations, reporting	The governance pillar, usually used when the focus is the board rather than the whole organisation

The practical version: if somebody says ERM, they mean risk at scale. If somebody says IRM, they usually mean GRC.

If somebody says compliance, ask whether they mean the pillar or the whole discipline, because that ambiguity causes more confusion than any other in the field.

Why Businesses Run GRC As One Program

Because real incidents refuse to stay in one pillar. Take a data breach caused by a staff member emailing a spreadsheet to the wrong address.

The same single incident	Seen through each pillar
As a compliance event	Potentially notifiable under the Privacy Act, with an assessment clock and a notification decision attached to it
As a risk control failure	A control existed on paper. It did not hold in practice, which means the register was recording an intention rather than a control
As a governance question	Who knew the training had lapsed, who was accountable for that, and when did leadership last see a report that would have shown it

Australia recorded its highest ever year for breach notifications in 2025.

The OAIC received 1,205 notifications in the 2025 calendar year, an increase of 8% on 2024 and the most since the scheme began in 2018, with health service providers the most affected sector at 19% of all notifications.

Of the notifiable data breaches reported in the first half of 2025, 37% were caused by human error, the kind of failure that crosses all three pillars at once.

Run separately, the three pillars generate three versions of the truth. Run together, one incident updates the risk register, triggers the retraining, and lands on the right desk, with a record of all of it.

What Weak GRC Costs Australian Organisations

Each pillar has a published price tag in Australia, and the figures come from the regulators themselves rather than vendor research.

Pillar under strain	What the regulators report	Period	Source
Risk (safety)	146,700 serious workers compensation claims, more than 400 a day, up 34.5% on a decade earlier	2023–24	Safe Work Australia
Risk (psychosocial)	Mental health conditions made up 12% of serious claims, up 14.7% in a single year and 161% over ten years	2023–24	Safe Work Australia
Risk (fatalities)	188 workers died from traumatic injuries at work	2024	Safe Work Australia
Compliance (records and pay)	743 infringement notices for record-keeping or pay slip breaches, and a record $23.7 million in court-ordered penalties	2024–25	Fair Work Ombudsman
Compliance (underpayment)	$358 million recovered for more than 249,000 underpaid workers, taking five-year recoveries past $2 billion	2024–25	Fair Work Ombudsman
Governance (data handling)	1,205 notifiable data breaches, the highest year on record and 8% up on 2024	2025	OAIC

None of those numbers requires villainy. They mostly require nobody being clearly responsible, which is the condition GRC exists to remove.

How GRC Shows Up In A Normal Week

Strip the acronym away and GRC is a sequence of small, connected moments. Here is one week in a disability services provider.

Day	What happens	Which pillar is working
Tuesday	A support worker logs a near miss: a client hoist that felt unstable. It lands with the right manager the same day, not in a paper form behind the tea room	Risk, through incident capture
Tuesday	The manager tags it against the manual handling risk in the register, which lifts its review date forward	Risk, through control linkage
Wednesday	The hoist is inspected and the corrective action is recorded against the original report	Risk and compliance, through evidence
Thursday	Because three similar reports have arrived this quarter, the system flags the trend and refresher training goes out to the team, with completions tracked	Compliance, through training records
Friday	The leadership report shows the incident, the action taken, and the training in progress, without anyone assembling it by hand	Governance, through visibility

Nothing in that week is sophisticated. Every step is the kind of thing organisations intend to do anyway.

The difference GRC makes is that the steps connect, they leave a record, and no single busy person carrying the process in their head can break it by going on leave.

Serious incidents also carry notification duties to the regulator on a short clock, which is far easier to meet when the report is already in a system than when it is a conversation somebody half remembers.

GRC Frameworks And Standards In Australia

Frameworks give GRC a shared vocabulary. Four come up most often in Australia, and it is worth being clear about which are certifiable and which are guidance.

Framework	What it covers	Certifiable?	Who it matters to
ISO 31000	International guidance for risk management: principles, framework and process	No, it is guidance	Any organisation building a risk process from scratch
ISO 37301	Compliance management systems: obligations, controls, culture and improvement	Yes, it is a certification standard	Useful as a maturity benchmark even if you never certify
COBIT	ISACA’s framework for governing and managing enterprise IT	Not a certification for the organisation	Larger or IT-heavy organisations. The governance pillar’s IT dialect
APRA CPS 230	Operational risk management, business continuity and service provider management	Mandatory for regulated entities, not certifiable	Banks, insurers and superannuation trustees. In force since 1 July 2025

CPS 230 is worth watching even if it does not bind you. It signals where Australian regulator expectations are heading on operational resilience and third-party service providers, and those expectations tend to travel outward from financial services rather than staying put.

Alongside these sit the obligation sources most businesses actually answer to day to day: WHS law including psychosocial hazard duties in every jurisdiction, privacy law, employment law and record-keeping obligations.

AI Governance As A GRC Obligation

Governing AI use is the newest addition to the compliance pillar and the one most organisations have not yet placed. Australia has no single AI Act.

What exists is the Voluntary AI Safety Standard, published by the National AI Centre, which sets out ten guardrails covering accountability, risk management, data governance, testing, human oversight, transparency, contestability, supply-chain information sharing, record keeping and stakeholder engagement.

Those ten guardrails are, almost line for line, a GRC program.

That is the useful observation for anyone wondering where to put AI governance: it is not a separate discipline, and it does not need a separate system.

The AI question	Which GRC pillar answers it
Who approved this tool being used on customer or employee data?	Governance. A delegation and an approval record
What could go wrong if the model is wrong, biased or misused?	Risk. A risk assessment with a named owner and a review date
Does this use meet privacy, discrimination and employment obligations?	Compliance. An obligation mapped, a control, and evidence
Do our people know the rules for using it?	Compliance. A policy, an acknowledgement and a training record
What happens when the model produces a bad outcome?	Risk. Incident reporting, investigation and corrective action

The standard is voluntary and creates no new legal duties.

It does not need to, because existing privacy, anti-discrimination, consumer and employment law already applies to decisions made with AI in the same way it applies to decisions made without it.

Legal responsibility stays with the organisation deploying the system, however autonomous the system is.

The practical move is unglamorous: register AI tools as assets, assess each use case as a risk, write one usable policy, train the people who use it, and keep the records.

It is the same shape as every other obligation the compliance pillar has absorbed over the past decade.

What A GRC Platform Actually Does

If the question “what is GRC” arrived with a software demonstration attached, this is the section that separates the two. A GRC platform is the filing-and-workflow layer for everything above.

Capability	What it holds	The failure it removes
Policy management	Version control, approvals, review dates and tracked acknowledgements	The policy updated in one folder but not the intranet
Risk register	Risks with owners, scoring, review dates and linked controls	The risk review that slipped because its owner changed roles
Incident and hazard reporting	Structured reports, escalation, investigation and corrective actions to closure	The near miss told to a supervisor and never written down
Compliance training	Enrolment, completion records and expiry tracking by role and site	The contractor never enrolled in induction
Audits and inspections	Templates, scheduling, findings and evidence attached to controls	The audit that takes three weeks of preparation because evidence lives in nine places
Reporting	A view across all of the above for managers and the board	The leadership pack somebody rebuilds by hand every month

One honest boundary: no platform makes an organisation compliant by itself. The software holds the framework and the evidence. People still have to do the work.

What a platform removes is the version of failure where the work was done and nobody can prove it.

Each of the failures in the right-hand column is small on its own. Together they decide whether you have a system or a scramble.

Who Does GRC, And Who Owns It

GRC is rarely one person’s job, and in mid-sized Australian organisations it is almost never a dedicated function. It is a set of accountabilities distributed across roles that already exist.

Role	What they own	What goes wrong without them
Board and directors	Risk appetite, the governance framework, and asking the questions that verify controls	Officers carry a WHS due diligence duty they cannot delegate. Without evidence of oversight, there is nothing to discharge it with
Chief executive and executive team	Making the framework real: resourcing it, and acting on what the reporting shows	Reporting that produces no decision stops being read, then stops being produced
Compliance or risk lead	The registers, the rhythm, the reporting and the regulatory horizon	In organisations of 50 to 500 staff this often lands with HR or operations as a part of the job
Line managers	Owning their own risks, actions and team training completion	The single most common stall: compliance chasing everyone else instead of managers owning their own
Every worker	Reporting hazards and incidents, acknowledging policies, completing training	The system holds nothing, because nothing gets reported into it
Internal or external audit	Independent testing that the controls exist and work	You find out at the regulator’s audit rather than at your own

Ownership matters less than clarity. Someone named, with a system behind them, beats a well-drawn org chart in which the accountability is shared and therefore held by nobody.

How Much GRC Do You Already Have? The Five Stages

Asking what is GRC is usually the first step. Working out how much of it you already have is the second, and it is the more useful one.

Organisations rarely go from nothing to a full program. They move through recognisable stages, and knowing which one you are in beats benchmarking against an enterprise you do not resemble.

Stage	What it looks like	The signal you have outgrown it
1. Reactive	Compliance work happens when an audit, a claim or an incident forces it. Records are assembled retrospectively	Preparing for an audit takes weeks, and the answer to “can you show me” is “give me a few days”
2. Documented	Policies, a risk register and training records exist, in spreadsheets and shared drives, maintained by one or two people	You cannot tell which policy version is current, or who has acknowledged it
3. Managed	One system holds the records. Owners and review dates exist. Reporting is produced on a schedule	The reporting is accurate but nothing changes as a result of it
4. Integrated	The three pillars share records. An incident updates the risk, triggers the training and reaches leadership without anyone joining it up manually	You are managing well but still reacting to regulatory change rather than anticipating it
5. Anticipatory	Trends are visible before they become incidents. New obligations are absorbed by registering them rather than by running a project	This is the destination. The work here is maintaining it, because maturity decays without rhythm

Five stages is the short version, scoped to GRC as a whole. If you want to assess the risk pillar properly, with level-by-level detail, the signs of being stuck, and a roadmap for moving up, that is a separate piece of work covered in risk management maturity: the five levels and how to move up.

GRC Is Not Just For Banks And Big Corporates

GRC grew up in financial services, so the language skews enterprise. The obligations do not.

A 150-person aged care provider carries WHS duties, privacy obligations, employment law and sector accreditation, the same categories as a bank, with a fraction of the administrative headcount.

The case for GRC at 50 to 500 staff is not regulator theatre. It is replacing the spreadsheet-and-goodwill system before it fails an audit, a claim or a tribunal.

The businesses that struggle are rarely the ones short on intent. They are short on evidence.

Sector accreditation sharpens the point. An aged care or NDIS provider facing an audit does not get asked whether it cares about compliance.

It gets asked for the training matrix, the incident register, the policy acknowledgements and the risk reviews, dated. Providers who can produce those in minutes have GRC, whatever they call it internally.

GRC System vs GRC Software

You will see both terms, and they are not quite the same thing.

	GRC software	GRC system
What it is	The tool: modules, workflows and reports	The tool and the operating approach around it
What it includes	Policy management, registers, reporting, training records	All of that, together with the framework, the content and the way the organisation runs the process
What you get	Capability	Outcomes you can show a director, an auditor or a regulator
What is missing without the other	A licence nobody uses in a rhythm nobody runs	A framework with no place to hold the evidence

Buy software and you get capability. Stand up a GRC system and you get outcomes. The difference is not marketing.

It is the reason two organisations can license the same product and get completely different results from it.

How To Start With GRC In Five Steps

If you are asking what is GRC because you have been handed the job, this is the shortest useful path. It works whether or not you ever buy software.

1. Write down what applies to you: One list of obligations: WHS, privacy, employment law, anti-discrimination, sector accreditation, anything with a licence or a clearance attached. Most organisations have never written this list, which is why it is step one.
2. Put a name against each line: Not a department. A person. This is the step that produces the hardest conversation and the most value, because an obligation without an owner is a task nobody performs.
3. Find out what you can actually prove today: Pick one obligation and one named worker and time how long it takes to produce the evidence. Write the number down. It is the only before-and-after figure that will mean anything to a board later.
4. Fix the thing that expires first: Credentials, clearances and mandated training have dates. Anything with a date is the highest-risk gap and the easiest early win.
5. Set the rhythm before you buy anything: Fifteen minutes a week, a named owner, a standing review of overdue actions. Software supports a rhythm. It does not create one, and it does not survive the absence of one.

Only after those five does the software question become answerable, because you will know what you are asking it to hold.

The full rollout sequence is in how to implement a GRC system in your business, and what happens in the 90 days after go-live is in how to transform your compliance strategy.

Where To Go Next In This GRC Guide Series

This page answers what is GRC. It deliberately does not answer which product to buy, because those are different questions with different answers. Each of the guides below owns one of them.

If you are asking	Go to
What does a GRC system contain, end to end	The ultimate guide to GRC systems in Australia
Do we need a system at all, or should we fix the process first	How to select GRC software
Which products should be on my shortlist	The 10 best GRC software tools in Australia
Which options suit a small business	Best GRC systems for small business in Australia
Which Australian-built options are there	Best GRC systems in Australia
How do I score two shortlisted platforms against each other	Comparing GRC systems in Australia
What should I ask a vendor before signing	What to look for in a GRC system
What does each capability actually do	Top 12 GRC system features Australian organisations need
Which Australian regulations must a platform support	GRC systems compliance in Australia
What is the business case for the board	The benefits of GRC software
How do we run the rollout, step by step	How to implement a GRC system
What goes wrong during implementation	Overcoming GRC implementation challenges
What changes in the first 90 days after go-live	How to transform your compliance strategy
What does the rhythm look like after that	The operating rhythm for a GRC system
What do we gain by joining the three pillars up	The benefits of integrating GRC into your business operations
What usually goes wrong with GRC, and how do we avoid it	5 common GRC challenges and how to overcome them
How do integrated risk management and GRC compare	Integrated risk management: the 5-step framework
How mature is our risk management, level by level	Risk management maturity: the 5 levels and how to move up
How is AI changing the way GRC work gets done	The future of AI in governance, risk and compliance
Where is GRC heading more broadly	5 key trends of GRC and its future

How Sentrient Helps With Governance, Risk And Compliance

Sentrient is an Australian-built GRC platform for organisations that need the system, not just the software: pre-built policies, legally endorsed training content for mandated topics, incident and hazard reporting, risk registers, and audits in one place with reporting across all of it.

It is hosted and supported in Australia, most customers are operational within about a week, and more than 1,000 organisations across Australia and New Zealand use it.

The clearest fit is regulated mid-sized employers between 50 and 500 staff in sectors such as healthcare, aged care, NDIS, not-for-profits, local government and schools.

It is a poor fit for businesses under 20 staff, for organisations that primarily need payroll or rostering, and for buyers who need one specialist module rather than connected coverage.

Being specific about the second list matters more than the first.

Explore the GRC system or see the GRC software modules in detail.

So What Is GRC? Start With The Questions, Not The Acronym

What is GRC, once the vocabulary falls away? Three questions asked continuously: who decides, what could go wrong, and can we prove we met our obligations?

If your organisation can answer all three from a system, you already run GRC, whatever you call it.

If any answer lives in someone’s head or an unopened spreadsheet, that is the place to start, and it is a smaller first step than the enterprise language around this field suggests.

Frequently Asked Questions About GRC

1. What does GRC stand for?

Governance, risk and compliance. Governance is how an organisation is directed and decisions are made. Risk is how it identifies and manages what could go wrong. Compliance is how it meets its legal and regulatory obligations and proves it.

2. What is GRC in simple terms?

GRC is the discipline of running an organisation so it is directed well, protected from foreseeable harm, and able to show it meets its obligations. In practice it means clear accountabilities, a living risk register, current policies, trained staff, and records that hold up when someone checks.

3. What is an example of GRC in practice?

A support worker reports a near miss. It reaches the right manager the same day, is linked to the matching risk in the register, produces a corrective action with a due date, triggers refresher training for the team, and appears in the leadership report that Friday with the evidence attached. That single chain touches all three pillars, and none of the steps are unusual. What makes it GRC is that they connect and leave a record.

4. What is GRC used for?

Three things. It gives an organisation a defensible answer to who is accountable for a decision, an early view of what could go wrong rather than a retrospective one, and evidence it met its obligations that can be produced on request instead of assembled under pressure. Everything else, the registers, the reporting, the training records, exists to serve those three.

5. What is GRC in HR?

In an HR context, GRC is the governance, risk and compliance work that sits around people: employment law obligations, WHS duties including psychosocial hazards, anti-discrimination law and the positive duty, policy acknowledgements, mandated training, and the records that evidence all of it. In Australian organisations of 50 to 500 staff, GRC frequently lands with HR by default, because HR already holds the training records, the policies and the people data that the compliance pillar depends on.

6. What is GRC in cyber security?

The same three pillars applied to information security: who is accountable for security decisions (governance), what could go wrong and which controls address it (risk), and which obligations apply and how you evidence them (compliance). In Australia the anchor obligation for most organisations is the Notifiable Data Breaches scheme under the Privacy Act. Cyber GRC is a specialism inside GRC, not a separate discipline, and the failure mode is the same: a control that exists on paper and not in practice.

7. What is the difference between GRC and ERM?

Enterprise risk management (ERM) is the risk pillar done at whole-of-organisation scale. GRC is broader: it joins risk management with governance structures and compliance obligations so the three work off the same information. An organisation can have strong ERM and weak compliance evidence, which is exactly the gap GRC exists to close.

8. What is the difference between GRC and IRM?

Integrated risk management (IRM) is a newer framing that emphasises risk in business context and continuous monitoring. In practice it covers largely the same territory as GRC and the distinction is closer to vendor vocabulary than to substance. If a platform describes itself as IRM rather than GRC, evaluate what it does rather than what it is called.

9. What is the difference between GRC and compliance management?

Compliance management tracks obligations and proves they are met. GRC wraps that in governance (who is accountable) and risk (what could go wrong beyond the rulebook). Compliance is one pillar of GRC, not a synonym, and treating them as the same thing is the most common source of confusion in this field.

10. What is COBIT?

COBIT is a framework for the governance and management of enterprise IT, published by ISACA. It helps organisations align IT decisions with business goals and manage technology risk. It sits inside the governance pillar of GRC and is common in larger or IT-heavy organisations.

11. What are GRC tools or GRC platforms?

Software that holds the working parts of GRC in one place: policy management with acknowledgements, risk registers and assessments, incident and hazard reporting, compliance training with completion records, audits and inspections, and reporting across all of it. The platform holds the evidence. It does not perform the obligation.

12. Who owns GRC in an organisation?

The board and executives own governance and the risk appetite. Day to day, GRC commonly sits with a compliance or risk lead, and in businesses of 50 to 500 staff it often lands with HR or operations. Line managers own their own risks and actions, which is the accountability most often missing. Ownership matters less than clarity: someone named, with a system behind them.

13. Do mid-sized Australian businesses need GRC?

Yes, because the obligations already apply. WHS duties, privacy law, employment law and industry rules do not scale down for size. What scales down is the administration available to manage them, which is why mid-sized businesses feel the gap first. The clearest signal is anything that expires, because a spreadsheet cannot tell you a clearance lapses in 30 days.

14. Which standards and frameworks apply to GRC in Australia?

Commonly: ISO 31000 for risk management guidance, ISO 37301 for compliance management systems, COBIT for IT governance, and sector rules such as APRA CPS 230 for banks, insurers and superannuation trustees, in force since 1 July 2025. Most businesses use these as reference points rather than certifications. Only ISO 37301 is certifiable for the organisation.

15. How does AI governance fit into GRC?

It sits inside the existing pillars rather than beside them. Australia’s Voluntary AI Safety Standard sets out ten guardrails covering accountability, risk management, data governance, testing, human oversight, transparency, contestability, supply-chain information sharing, record keeping and stakeholder engagement, which together describe a GRC program. The standard creates no new legal duties, because privacy, anti-discrimination, consumer and employment law already apply to decisions made with AI. Legal responsibility stays with the organisation deploying the system.

16. How long does it take to set up GRC?

Mapping obligations and assigning owners is weeks of work, not months, and can start before any software decision. If you implement a platform, expect roughly 90 days from go-live to business as usual: records and owners in month one, the reporting and review rhythm in month two, and the first real evidence request in month three. Compliance numbers usually look worse around week three, because they are finally being measured rather than assumed.

17. How does Sentrient help with GRC?

Sentrient is an Australian-built GRC platform that puts policies, compliance training, incident and hazard reporting, risk registers, and audits in one system with reporting across the lot. Training content for mandated topics is legally endorsed by Australian lawyers, support is based in Melbourne, and most customers are operational within about a week.

Disclaimer: This article is general information for Australian workplaces, not legal advice. Obligations differ by state, territory, industry and company structure. Get advice on your specific circumstances from a qualified professional.

Sources

Safe Work Australia – Key Work Health and Safety Statistics Australia, latest release

Safe Work Australia – Duties under WHS laws

Safe Work Australia – Psychosocial hazards

Safe Work Australia – Incident notification

OAIC – Data breach notifications increase to all-time high in 2025

OAIC – Notifiable Data Breaches scheme

OAIC – The Privacy Act

Fair Work Ombudsman – Annual Report 2024-25, $358 million back-paid to Australian workers

Fair Work Ombudsman –Pay slips and record-keeping

Australian Human Rights Commission – Positive duty under the Sex Discrimination Act

ASIC – Whistleblowing

APRA – Prudential Standard CPS 230 Operational Risk Management

ISO – ISO 31000 Risk management

ISO – ISO 37301 Compliance management systems

ISACA – COBIT framework

Department of Industry, Science and Resources – Voluntary AI Safety Standard

Read More About GRC

• The Ultimate Guide To GRC Systems In Australia
• GRC Software For Australian Businesses: Which Tier To Buy
• What Are The Benefits Of GRC Software And Its Importance For Australian Businesses?
• Top 10 Best GRC Software Tools For Every Business
• How To Implement A GRC System In Your Business
• Using GRC Platforms To Prepare For Your Next Audit
• Responding To And Managing GRC Incidents Effectively
• Surviving Uncertainty: Develop An Efficient GRC Strategy
• Top 5 Tips To Create The Best GRC Policies For Your Organisation