Governance Risk And Compliance Management

Governance risk and compliance management usually fails for an organisational reason rather than a technical one. Nobody owns it.

The work is split across functions that each hold part of it. Legal holds the obligations. Safety holds the incidents and hazards. HR holds the training and conduct. Finance holds the controls testing. Each does its part properly, and nobody holds the whole.

The symptom is recognisable. A board asks a simple question, are we compliant with X, and four people produce four partial answers over two weeks.

Three ownership models work in practice. A single accountable executive with a dotted line into each function. A standing cross-functional committee with a chair who can actually direct work rather than only convene it. Or one system of record that all four functions maintain, with defined roles and a named administrator.

Safe Work Australia covers officer due diligence. This is general information rather than legal advice.

See Sentrient’s GRC system and workplace compliance system.