Skip to main content
All glossary terms

Regulation & risk

GRC

Governance, risk, and compliance (GRC) is an umbrella approach for coordinating decision-making, risk oversight, and adherence to requirements across an organization. The acronym can refer to a program, operating model, or supporting tools rather than to one universal standard.

Also known as governance, risk, and compliance.

Why it matters in practice

Connecting these functions can make ownership and reporting more consistent, while specialists still need room to assess technical and legal details. A GRC platform may organize records and workflows, but software alone does not create sound governance. Teams should clarify which program and responsibilities the term refers to.

Example

A company routes a new vendor review through its GRC workflow, which assigns a risk owner and links the review evidence.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.