Chapter 1 of 13 · Day 1
What GRC Is Actually For
- What does a GRC person actually do all day?
- Is my job just filling in spreadsheets for auditors?
- Who am I working for: the auditor, the CISO or the business?
GRC stands for governance, risk and compliance. The three words describe three jobs that are easy to blur together.
- Governance is who decides what, and how those decisions are written down. Who can accept a risk? Who approves a policy? Who is told when something goes wrong?
- Risk is working out what could hurt the organisation, how badly, and what to do about it. It ends in a decision, not a score.
- Compliance is showing that you meet the rules you have agreed to or are bound by: laws, contracts, standards and your own policies.
If you only remember one sentence, make it this one: GRC exists so that leaders make risk decisions on purpose, and can explain them later. An audit report, a certificate or a clean questionnaire is a sign that this works. It is not the work itself.
Who you work for
You work for the organisation, through whoever owns security risk. That might be a CISO, a CIO, a chief risk officer or a founder. You do not work for the auditor. The auditor checks your work; they are not your customer. Treat them with respect and honesty, but do not let their checklist become your whole job.
You also work with nearly everyone. Engineers own controls. HR owns joiners and leavers. Procurement owns supplier contracts. Legal owns contracts and regulators. Your job is to make the system hang together, not to do every part of it yourself.
What a normal week looks like
- Chasing evidence that a control ran: a review, a backup test, an access recertification.
- Updating the risk register after a change, an incident or a new supplier.
- Answering a customer security questionnaire, using answers that are true today.
- Helping a team write or update a procedure so it matches what they actually do.
- Preparing a short report for leadership on open risks and overdue actions.
The question you might not ask out loud
Is it normal to feel like I do not know enough about security to do this job?
Yes. Many good GRC people did not start as engineers. You need to understand risks well enough to ask clear questions, and you need to know who can answer them. Learn the technical side steadily, but do not pretend. "Can you show me how that works?" is a respected question.
Rule of thumb:Rule of thumb: if a task produces paper but changes no decision and no behaviour, ask why you are doing it. Sometimes the answer is a real obligation. Often it is habit.
In your first week, write one paragraph in your own words: what is this organisation trying to protect, and from what? You will rewrite it many times. That paragraph is the start of your job.