Governance Risk And Compliance Policies

Governance risk and compliance policies get filed alongside HR policies and they answer a different question.

An HR policy describes expected behaviour. A GRC policy describes how the organisation decides, escalates and reports.

The set is short. A risk management policy stating appetite and who can accept a risk at each level. A compliance policy naming who owns which obligations. A delegations policy setting who can commit the organisation to what, and to how much. An incident and escalation policy defining what must reach the board and how quickly it has to get there. And a conflicts of interest policy covering disclosure and management.

They are approved higher up the organisation, changed rarely, and read by far fewer people. That is entirely appropriate, because their audience is decision-makers rather than every employee.

ASIC publishes governance guidance. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s GRC system and policy management software.