What Is GRC? Governance, Risk, and Compliance

GRC stands for Governance, Risk, and Compliance, three related disciplines that, together, answer one question: is this organization doing what it says it does, aware of what could go wrong, and able to prove it to someone outside the company? Engineers usually meet GRC indirectly, through the access reviews, audit logs, and approval gates that show up in a well-run system, this course builds the vocabulary and mental model behind them.

The three pillars

• Governance: the policies, roles, and decision-making structures that define how the organization is supposed to operate, who is accountable for what, and how choices get made and enforced.
• Risk: the practice of identifying what could go wrong (a breach, an outage, a regulatory fine), estimating how likely and how bad it would be, and deciding what to do about it.
• Compliance: proving, with evidence, that the organization actually meets the laws, regulations, contracts, and standards it's subject to, not just that it intends to.

Why bundle these three together?

They reinforce each other in a loop:

Governance sets the rules → Risk finds what threatens the rules → Compliance proves the rules are followed

A policy with no enforcement is just a document. A risk assessment with no governance behind it has no authority to act on its findings. And compliance with no underlying governance or risk process is just paperwork, technically passing an audit while the actual system stays unsafe.

Where engineers actually touch GRC

• Access reviews: someone periodically confirms that every person with access to a system still needs it, a governance and compliance control at the same time.
• Audit logs: recording who did what, and when, exists specifically so compliance claims ("only authorized staff can change production data") can be verified after the fact, not just asserted.
• Change management: requiring a second approver before a production deploy reduces risk (a bad change reaching users) and satisfies a compliance requirement (separation of duties) simultaneously.