By Roma Singh
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
Far from being boring or non-technical, GRC is pivotal in protecting organizations’ most critical assets—people and data. Learn how effective GRC not only prevents disasters but also drives informed decision-making and aligns with broader business objectives, emphasizing continuous improvement and strategic insight.
I am often asked, What is GRC? Some say it’s boring, it’s non-technical.
GRC is the Skeleton System or the wooden framework of the house you live in. Governance, risk and compliance (GRC) shapes the backbone of security strategy. Governance sets the direction; risk management identifies potential obstacles; and compliance ensures cybersecurity practices remain lawful and ethical.
Let’s take the analogy of flying a plane. Have we ever asked ourselves these questions?
The pilot does not debrief the passengers around the journey or weather conditions?
What if the passengers start walking randomly along the aisle or do anything they want including unsafe behaviour?
What if someone from the cabin crew smokes a cigar, which might lead to a fire? And there are no smoke detectors or fire extinguishers.
The plane was not safety tested against controls.
The Pilot is a member of the Leadership Team.
The passengers are our People and should follow the Policies to foster governance.
The Fire Hazard are potential risks and the smoke detectors or fire extinguishers are controls we have in place to mitigate the risks. What frameworks we have used to maintain the security baseline.
If the plane was not safety tested before the flight, it is now non-compliant. Not only is there a chance of an accident or disaster taking place but there could be greater damage from fines against non compliance or reputation.
If we just were to fly the plane without any safety measures, controls testing or policies, it would have crashed causing loss of life and reputational damage to the airlines company affecting compliance laws.
To ensure smooth operations and disastrous aftermath outcomes from repercussions, GRC is an essential recipe. Without effective governance, risk management and compliance, time is only being wasted.
So next time someone tells you GRC is boring or non-technical…
Explain to them, GRC is the backbone, the framework, a critically strategic and integral aspect of cybersecurity. This reimagining positions GRC not as a secondary or ‘less technical’ role in Cybersecurity but as a pivotal role where strategic insight, regulatory knowledge and risk management are key to keeping an organisations’ most critical assets, its people and data, safe. In this light, GRC stands as a cornerstone in cybersecurity, and it’s essential for driving informed decision-making and resilient cyber practices. It is useful to highlight the need for continuous improvement within GRC, as lessons learned from compliance checks and risk assessments often feed back into refining governance and risk strategies. Lastly, the interplay between GRC and overall business strategy could be emphasised, as GRC frameworks not only ensure consistent execution but also align with broader business objectives.
“One bad incident can doom all the good you did for years, remember that!” and that is why we need effective Governance, Risk and Compliance!