Governance Risk Management And Compliance

Governance risk management and compliance are three distinct disciplines, and the acronym exists because organisations kept doing the same work three times over.

• Governance. Who decides, who oversees, and how decisions are recorded. Board and executive territory.
• Risk management. What could go wrong, how likely it is, and what you are doing about it.
• Compliance. The obligations you actually have to meet, and the evidence that you did.

Run separately, they duplicate. The risk register lists a hazard, the compliance register lists the obligation attached to it, and the board paper describes both again in different language. Three teams, three spreadsheets, three versions of the truth.

Brought together, one control can satisfy an obligation, treat a risk and produce board evidence at the same time. That is the whole argument.

Safe Work Australia covers officer due diligence, which sits squarely in this space. This is general information rather than legal advice.

See Sentrient’s GRC system and GRC articles.