Which statement best describes how governance, risk, and compliance relate to one another?

• A. GRC is a narrow IT security program only.
• B. GRC is the integrated approach aligning governance, risk management, and compliance activities across the organization.
• C. GRC is solely about regulatory reporting.
• D. GRC is the management of vendor contracts.

Answer: (B)

GRC is the integrated approach that aligns governance, risk management, and compliance activities across the organization. Governance sets the direction, policies, roles, and accountability that shape how the business operates. Risk management continually identifies, assesses, and mitigates threats and opportunities that could affect objectives. Compliance ensures the organization follows laws, regulations, and internal policies, turning obligations into concrete controls. When these elements are coordinated in a single program, processes, data, and oversight are shared, leading to better decision-making, consistency, and accountability throughout the enterprise rather than isolated efforts. This holistic view is broader than viewing GRC as just an IT security program, solely regulatory reporting, or only about vendor contracts.