Three areas looking at the same risk
In a typical organization, the risk of a critical system becoming unavailable tends to appear in three places: in the corporate risk map, in IT's continuity plan and in the audit compliance matrix. Each with a different owner, different terminology and a different status.
When someone asks whether that risk is being handled, there are three answers, and none of them is wrong from the point of view of whoever maintains it. That is the problem GRC tackles: not the lack of control, but its fragmentation.
What each letter means in practice
- Governance: who decides what, with what authority, and how it is tracked. Without this defined, an identified risk has no owner.
- Risk: what can go wrong, what the impact is, what the probability is and what is being done. It needs to be a living thing, not an annual document.
- Compliance: the external and internal obligations that need to be demonstrable, with evidence, not with a statement.
The three meet at one point: the control. The same control mitigates risk, meets an obligation and is tracked by governance. When it exists only once, maintained in one place, the cost of sustaining everything drops.
Why the spreadsheet cannot keep up
A spreadsheet works to get started, and it is fair to acknowledge that. The limit shows up when the organization needs to answer something simple: is this control working today?
In the spreadsheet, the answer is the date of the last update, made by someone who had to remember to do it. There is no attached evidence, no history of who changed what, and no way to show in an audit that the control operated throughout the period, and not just on the day it was checked.
There is also the version problem: when the same subject lives in five spreadsheets, the organization does not have five views, it has five competing truths.
Evidence is what separates saying from demonstrating
In an audit, stating that a control exists is worth nothing without proof that it operated. The difference between a smooth audit and an expensive one almost always lies here: if the evidence is generated by the process itself, it is already there; if it has to be collected afterward, someone will spend weeks hunting for screenshots, emails and logs.
That is why the useful design is one in which the control produces the evidence when it is executed, not one in which the evidence is assembled for the audit.
Where AI comes in
In GRC, AI pays off in correlation work, which is voluminous and mechanical: matching regulatory obligations to existing controls and flagging what is uncovered, reading a new regulation and suggesting where it has an impact, classifying and prioritizing risk based on historical patterns, and monitoring continuously instead of sampling once a year.
Judgment about risk appetite and about what is acceptable remains human. This is not a technical limitation, it is the responsibility of those who answer for the organization.
Where to start
With an inventory of the controls that already exist, even if scattered. Much of the initial GRC effort is discovering that the organization already does a lot of things right, without a common record, and that the same control meets three different obligations.
Consolidating this usually reduces work before it increases it, which helps sustain the project politically.
FAQ
What is GRC?
It is the practice of treating governance, risk management and compliance as a whole, rather than as three parallel areas. The gain is not in having more control, but in no longer maintaining the same control three times, in three places, with three different answers about the same risk.
Why can't a spreadsheet sustain compliance?
Because it does not tell you whether the control is working today. The only answer available is the date of the last update, made by someone who had to remember to do it, with no attached evidence, no change history and no way to show that the control operated throughout the period. When the same subject lives in five spreadsheets, there are not five views, there are five competing truths.
What is the difference between saying a control exists and demonstrating it?
In an audit, a statement is worth nothing without proof that the control operated. That is the difference between a smooth audit and an expensive one: if the evidence is generated by the process itself, it is already available; if it has to be collected afterward, someone spends weeks hunting for screenshots, emails and logs.
How does AI help with GRC?
In correlation work, which is voluminous and mechanical: matching regulatory obligations to existing controls and flagging what is uncovered, reading a new regulation and suggesting where it has an impact, classifying and prioritizing risk based on historical patterns, and monitoring continuously instead of sampling once a year. Judgment about risk appetite remains human.
Where should you start implementing GRC?
With an inventory of the controls that already exist, even if scattered. Much of the initial effort is discovering that the organization already does a lot of things right without a common record, and that the same control meets three different obligations. Consolidating this usually reduces work before it increases it, which helps sustain the project.
Ready to raise your operational maturity?
Discover the CITSmart platform and how Central IT helps run technology, services and business with governance.