IT Governance Risk and Compliance

What is governance, risk and compliance (GRC)?
Governance, risk and compliance (GRC) refers to an organization's strategy for handling the interdependencies between the following three components:

• corporate governance policies
• enterprise risk management programs
• regulatory and company compliance

Does business understand how IT operates or what it can and cannot do within a certain time frame?

• Is the IT organisation faced with dramatic change following a merger/acquisition?
• Is there adequate view or control over IT spending, or are IT costs perceived to be too high?
• Is there good understanding of IT related risk? Are IT related risks properly managed?

Combining descriplines for better enterprises security. Adopting a unified IT governannce, risk management and compliance (IT GRC) approach, and managing associated activities coherently will create efficiencies, provide a holistic view of the IT environemnt and ensure responsiblity.

1. Effectiveness
2. Efficiency
3. Confidentiality
4. Integrity
5. Availability
6. Reliability
7. Confidentiality
IT GRC Capabilities

• IT controls assessment and measurement
• IT governance
• IT risk assessment / IT control benchmarking
• IT audit training
• IT internal audit outsourcing / co-sourcing
• IT policy & procedure manual
• ERP control and assurance
• Data assurance