GRC Policies

GRC policies are usually approved carefully and owned loosely, and the second problem is the one that shows up later.

Approval is a single moment. A board or committee signs off, the minutes record it, and the policy goes live. Ownership is continuous, and ownership is what keeps the document true afterwards.

An owner has to be a named person rather than a function or a committee, senior enough to make the calls the policy describes, and accountable for the review actually happening rather than for the underlying risk itself.

Without that, the familiar pattern follows. Legislation changes and nobody traces the change back to the policy. A restructure removes the role named inside it. Two years pass and the document describes an organisation that no longer exists.

ASIC publishes governance guidance. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s policy management software and GRC system.