How the parts connect
| Part | Question | Working record |
|---|---|---|
| Governance | Who can decide, and what must they consider? | Owner, delegated authority, conflicts, reasons and board record. |
| Risk | What could affect the objective? | Cause, event, consequence, assessment, uncertainty and treatment. |
| Compliance | Which requirement applies to this activity? | Source, status, applicability, owner, control and review trigger. |
| Controls and evidence | What should happen, and what shows that it happened? | Operating record, sample, exceptions, test result and limitations. |
| Action and review | What must change, who owns it, and when will it be checked? | Specific outcome, target, completion evidence and follow-up decision. |
Worked example: a supplier renewal
This is a fictional example of a small service business reviewing an appointment-system supplier. It explains the connections; it is not client evidence or a compliance opinion.
- Objective: keep appointments available and protect the information handled through the service.
- Requirement: the business identifies a contractual incident-notification clause. It separately checks which data-protection duties apply to its actual processing.
- Risk: a supplier outage could prevent bookings. A restore process is described in a document, but the team has not seen a successful test.
- Control and evidence: the supplier owner obtains the exercise record, records its scope and limitations, and identifies an unresolved exception.
- Decision: the authorised decision-maker considers renewal, a conditional extension and an alternative supplier. The record explains the choice and remaining uncertainty.
- Action: a named role owns the required retest. Completion is reviewed against the original concern before the issue is closed.
Try the sequence in the connected workspace, or keep separate supplier review, risk, control and board decision records.
How to implement a proportionate GRC framework
- Define the organisation, important activities, decision-makers and review scope.
- Identify applicable requirements from operative sources. Record why they apply.
- Describe material risks in relation to objectives, with the uncertainty visible.
- Connect controls to the risks and obligations they address. Identify owners and evidence.
- Review gaps and exceptions, allocate actions and decide what must be escalated.
- Record decisions and review the framework when activities, evidence or source requirements change.
The first GRC framework playbook provides a suggested working sequence. Its planning periods are not statutory deadlines.
Which UK framework should an organisation use?
Choose after identifying the entity and activity. The FRC Code has a defined listed-company scope. The Orange Book is the government risk-management framework. The ICO audit framework addresses data-protection practice and does not guarantee compliance. These sources have different purposes and are not interchangeable.
Smaller businesses can adapt useful working methods proportionately, while separately checking their applicable legal and contractual duties. Source reference baseline: 1 November 2026. No independent human legal review is claimed.
Do you need GRC software?
The process needs clear responsibility, usable records and review. Software can help maintain connections, but it does not determine the correct legal scope or prove that controls work. Begin with a method the team can operate and evidence.
Can a checklist or maturity score prove compliance?
No. It can reveal gaps and support a discussion. Evidence quality, applicability, materiality and professional judgement still matter. Our 24-question readiness review separates completion from self-reported coverage and is not a validated maturity model.
What should the board see?
Provide the reporting scope, material risks, changes, control evidence, exceptions, overdue actions and the decisions requested. Explain uncertainty and assurance limits. Use the board reporting template and board review playbook to structure the discussion.