Contents
The comparison
| Criterion | Traditional compliance | Integrated GRC approach |
|---|---|---|
| Starting point | Each regulation and each audit, taken separately | The organisation's objectives and the risks that threaten them |
| Organisation | Teams each working in isolation | A shared register of risks, obligations and controls |
| Posture | Reactive: responding to an audit or an incident | Proactive: anticipating in line with risk appetite |
| Controls | Repeated for each requirement | A single control covers several requirements |
| Reporting | Several unconnected reports | A consolidated view for senior management and the board |
| Cost | Duplication and repeated demands on the business | Pooled effort |
The three lines model
Published by the Institute of Internal Auditors (IIA) in 2020, this model clarifies who does what:
- The governing body (board of directors) is accountable to stakeholders and provides oversight.
- Management holds the first-line roles (the business units that manage risk day to day) and the second-line roles (risk management and compliance, which provide expertise and oversight).
- Internal audit, as the third line, provides independent assurance.
The 2020 model emphasises collaboration between the lines rather than rigid boundaries.
Maturity levels
- Reactive: compliance is dealt with when an inspection or incident occurs.
- Structured: each function has its own procedures, but they are not connected.
- Coordinated: a shared register of risks and obligations exists.
- Integrated: risk, compliance and control inform strategic decisions.
- Optimised: the framework improves continuously through reliable, shared indicators.
When to move to a GRC approach
- When several regulators or frameworks apply at the same time: Law 09-08 on personal data protection, the AI Act, ISO 27001, sector requirements.
- When the business complains about being asked several times for the same controls.
- When senior management lacks an overall view of the major risks.
- When international customers or partners demand evidence that risks are under control.
Getting started without rebuilding everything
You do not need to buy GRC software to get started. A shared register, even in a spreadsheet, that links each risk to the corresponding obligations and controls, with a named owner for each, is already a real step towards integration. See the COSO ERM framework.
Further reading
- 4 min read
- 3 min read
- 4 min read
Frequently asked questions
What is the difference between GRC and compliance?
Compliance means meeting your obligations. GRC integrates compliance with governance and risk management under a single management system, to avoid duplication and give senior management a complete picture.
Do you need software to do GRC?
No, not at the outset. A shared register of risks, obligations and controls, even kept in a spreadsheet, is enough to get started. Software becomes useful as the volume of work and the number of contributors grow.
What is the three lines model?
A model published by the IIA in 2020 that allocates roles between the governing body, management (the operational first line and the second line providing risk and compliance expertise) and internal audit, which provides independent assurance.
General information, not legal advice.
Report an errorReferences (4)
- OCEG — GRC Capability Model ("Red Book").
- The Institute of Internal Auditors (2020). The IIA's Three Lines Model.
- COSO (2017). Enterprise Risk Management — Integrating with Strategy and Performance.
- ISO 37301:2021 — Compliance management systems — Requirements with guidance for use. (opens in a new tab)