Governance, compliance and audit are often mentioned together, sometimes as “GRC” with risk management added. They are related but different. Governance sets direction, compliance makes sure the organization follows the rules, and audit gives independent assurance that both are working.
This guide explains audit, compliance and governance in plain language and shows how they fit together.
Governance: setting direction
Governance is the system by which an organization is directed and controlled. The board and senior management:
- set strategy and objectives;
- define risk appetite, meaning how much risk the organization will accept;
- assign roles and accountability;
- approve key policies;
- monitor performance and act on problems.
In IT, governance makes sure technology supports business goals and that technology risks are managed. Frameworks such as COBIT and ISO/IEC 38500 guide IT governance.
Compliance: following the rules
Compliance means meeting obligations from laws, regulations, contracts, standards and internal policies. A compliance function typically:
- maintains a register of obligations;
- translates them into policies and controls;
- trains staff;
- monitors and reports on adherence;
- manages breaches and regulator relations.
For practical steps, see what an organization needs to do to be compliant.
Audit: independent assurance
Audit checks, independently and with evidence, whether governance and compliance actually work. Internal audit reports to the board’s audit committee and covers the whole organization. External auditors focus on financial statements, certifications or specific regulatory requirements.
How they differ
| Governance | Compliance | Audit | |
|---|---|---|---|
| Main role | Direct and oversee | Ensure rules are followed | Provide independent assurance |
| Owned by | Board and senior management | Compliance and risk teams, with business owners | Internal and external auditors |
| Timing | Continuous | Continuous | Periodic |
| Output | Strategy, policies, decisions | Controls, monitoring, reports | Findings and opinions |
Adding risk: the GRC model
Risk management sits between them. It identifies and evaluates risks, so governance can set priorities and compliance can focus effort. Together, governance, risk and compliance (GRC) form an integrated approach, often supported by GRC software.
The three lines model
The Institute of Internal Auditors describes roles in three lines:
- First line: business and IT managers who own and manage risks day to day.
- Second line: risk management and compliance functions that set frameworks and monitor.
- Third line: internal audit, which gives independent assurance to the board.
The governing body oversees all three, and external auditors and regulators add outside assurance.
Why it matters for information security
Security programmes fail without governance. For example, an ISO 27001 ISMS needs top management commitment (governance), legal and contractual requirements (compliance) and internal audits (audit). As a result, all three must work together.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
