UK GRC Guidance: Governance, Risk and Compliance
Explore UK governance, risk and compliance guides, with primary sources, clear applicability limits, practical examples, working tools and editable templates.
Open resource ↗Search the reference desk
Find the resource for your next task.
Search guidance, tools, working templates, news and implementation analysis.
GRC news & analysis
Read verified UK GRC news and source-linked analysis. Find original sources, publication and check dates, applicability and practical implications.
Open resource ↗Risk Appetite Statements and Governance
Connect the organisation’s objectives to clear decision limits, escalation routes and evidence of what the board will accept.
Open resource ↗Directors’ Duties and Board Decision Records
Build a useful record of authority, evidence, challenge, conflicts and follow-through without reducing directors’ duties to a tick-box exercise.
Open resource ↗Board Assurance and Internal Control Testing
Explain what each important control does, how it was tested and what the evidence allows the board to conclude.
Open resource ↗Policy Ownership and Review: A Practical Guide
Turn a folder of policies into a manageable register of decisions, responsibilities, training and evidence.
Open resource ↗Failure to Prevent Fraud: Scope and Governance
Understand the failure-to-prevent-fraud starting point and connect prevention to incentives, associated persons, practical controls and oversight.
Open resource ↗Provision 29: Board Evidence and Reporting
Understand Provision 29’s financial-year scope and prepare material-control evidence, exceptions and board conclusions for UK Corporate Governance Code reporting.
Open resource ↗Fraud Prevention: Review Controls in Operation
After implementation, the useful question is whether prevention measures influence real decisions, transactions and representations.
Open resource ↗Enterprise Risk Register: A Practical UK Guide
Connect each risk to an objective, accountable owner, control evidence and a decision that someone can act on.
Open resource ↗Control Testing: Evidence and Sample Reviews
Distinguish a policy being written from a control being designed well and operating consistently.
Open resource ↗Third Party Risk Management and Supplier Reviews
Prioritise critical dependencies, ask for relevant evidence, and plan monitoring and exit before a supplier fails.
Open resource ↗Business Continuity and Scenario Exercises
Use a focused scenario to test decisions, dependencies and recovery assumptions, then track the lessons to completion.
Open resource ↗Cyber Governance: Board Responsibilities and Evidence
Translate technical reporting into business exposure, accountable decisions and evidence of resilience.
Open resource ↗FCA Operational Resilience after the Transition
The FCA's 2026 observations reinforce the need to keep testing, strengthening dependencies and informing board decisions.
Open resource ↗Compliance Obligations Register: A Practical Guide
Connect each applicable requirement to a responsible owner, a practical control and evidence that it operates.
Open resource ↗UK GDPR Accountability and DPIA Triage
Connect data protection decisions to evidence, and identify when a project needs a data protection impact assessment.
Open resource ↗AML Scope, Controls and Assurance
Identify the relevant AML regime, then connect the business risk assessment to controls, case evidence and review.
Open resource ↗Incident and Personal Data Breach Escalation
Prepare a clear response route, assess harm and record the reasons for reporting or not reporting a personal data breach.
Open resource ↗Compliance Training and Monitoring Plans
Turn policy awareness into role-specific decisions, then use monitoring results to improve the programme.
Open resource ↗Data Protection Accountability: Board Evidence
Use the ICO's accountability resources to structure a proportionate review, then show decisions and unresolved weaknesses.
Open resource ↗DUAA: Managing Data Protection Regulatory Change
The Data (Use and Access) Act illustrates why a change register needs provision-specific dates and evidence of implementation.
Open resource ↗FRC revises auditing standards for legal and regulatory non-compliance
Revised auditing standards set a risk-based approach, with application tied to financial periods beginning from 15 December 2027.
Open resource ↗NCSC highlights how cyber incident sharing can meet market disclosure duties
NCSC explains how cyber incident information sharing can meet market disclosure obligations, with organisations responsible for case-by-case decisions.
Open resource ↗FCA consults on a second phase of SM&CR reforms
The regulator proposes changes to certification and senior management processes; responses are due by 22 January 2027.
Open resource ↗GRC working tools
Browser-local GRC readiness review, risk register, obligations register and action tracker, with useful exports and print views.
Open resource ↗GRC Readiness Assessment: 24 Practical Questions
Review 24 GRC questions, record evidence gaps and assign actions. Use a browser-local readiness assessment with working-copy exports and a printable board summary.
Open resource ↗Risk Register Tool: Assess, Record and Export
Record inherent and residual risks, controls, evidence, owners and treatment. Explore a 5 × 5 matrix and export your working record.
Open resource ↗Compliance Obligations Register Tool
Build an obligations register linking each requirement to its source, applicability, owner, controls and review date. Edit locally and export your working record.
Open resource ↗GRC Action Tracker: Findings and Remediation
Track GRC findings, remediation owners, target dates and evidence. Keep claimed completion separate from recorded review, with browser-local exports and print views.
Open resource ↗Risk Register Template: Assessment and Treatment
Connect a specific objective, risk, control and accountable treatment decision.
Open resource ↗Compliance Obligations Register Template
Trace a requirement to the business activity, responsible owner and proof.
Open resource ↗Internal Control Inventory and Testing Template
Distinguish a documented control from one that operates effectively.
Open resource ↗Board Risk Reporting and Decision Pack Template
Prepare a board risk report with scope, risk appetite, control evidence, exceptions and decisions. Edit the template locally, export a working copy or print it.
Open resource ↗Policy ownership & review record
Keep a policy connected to the people and processes that use it.
Open resource ↗Supplier due diligence & decision
Review the supplier’s role, dependencies, evidence and exit arrangements.
Open resource ↗Incident assessment & response log
Record facts, timestamps, risk decisions and accountable escalation.
Open resource ↗Role-based training plan
Connect role, risk, learning needs and understanding.
Open resource ↗Assurance finding & remediation
Separate findings, claimed remediation and verification.
Open resource ↗Regulatory change impact record
Follow a source change through applicability, implementation and verification.
Open resource ↗Risk, control & assurance map
See which material risks have useful assurance and which do not.
Open resource ↗Decision, rationale & conflict record
Preserve a clear account of a significant organisational decision.
Open resource ↗GRC templates & working registers
Twelve editable governance, risk and compliance templates with JSON working copies, print layouts and blank CSV downloads.
Open resource ↗Build your GRC foundations
A practical 90-day starting plan
Open resource ↗Review a new supplier
A practical onboarding playbook
Open resource ↗Prepare a board GRC review
A practical assurance playbook
Open resource ↗Review a control in practice
A practical control-testing playbook
Open resource ↗Turn a source change into controlled action
A practical regulatory-change playbook
Open resource ↗GRC implementation playbooks
Follow practical steps for a first GRC framework, supplier onboarding or board assurance review.
Open resource ↗Business owners & SMEs GRC
Build proportionate controls around the work you actually do.
Open resource ↗Legal & notarial practices GRC
Connect professional duties, client risk and matter evidence.
Open resource ↗Clinics & care organisations GRC
Connect patient information, suppliers and operational continuity.
Open resource ↗Technology & service providers GRC
Manage change, supplier dependencies and assurance requests.
Open resource ↗GRC sector starter packs
Practical starter questions, evidence checklists and GRC routes for SMEs, legal and notarial practices, healthcare and technology providers.
Open resource ↗About the Independent UK GRC Reference Desk
An independent information publication connecting governance, risk and compliance to the work organisations actually do.
Open resource ↗GRC Editorial Standards, Sources and Corrections
Our editorial method distinguishes legal requirements, official guidance, optional frameworks and suggested working methods.
Open resource ↗Understand the review before using the result.
A transparent method for an organisation’s own readiness review. It is an editorial checklist, not a statutory audit or assurance opinion.
Open resource ↗Privacy & browser storage
How the publication and its browser-local working tools handle information.
Open resource ↗Disclaimer
Read the scope and limitations of this independent information publication and its working tools.
Open resource ↗Accessibility
An accessible experience is part of making the guidance useful.
Open resource ↗Corrections & review history
Keep the source, the change and the reasoning visible.
Open resource ↗Primary source directory
Inspect the primary sources behind the GRC library, the pages that use them and their check dates.
Open resource ↗Find your GRC starting point
Choose your next task and sector to find a practical route through GRC guidance, working tools and templates.
Open resource ↗GRC Workspace: Risks, Controls and Board Reports
Link risks, controls, obligations and actions in a browser-local working review, then prepare a printable board pack.
Open resource ↗Illustrative GRC control starter library
Eighteen illustrative control examples with operating prompts, evidence, sample tests and editable template working copies.
Open resource ↗Corporate governance guidance for UK organisations
Build clear board responsibilities, risk appetite, policy ownership and evidence-based decisions with UK governance guides and editable templates.
Open resource ↗Risk management guidance and registers for UK teams
Build an enterprise risk register, review controls and suppliers, and plan continuity exercises using practical guidance and browser-local working tools.
Open resource ↗Compliance management guidance and obligation registers
Trace applicable UK requirements to owners, controls and evidence. Use practical guides for obligations, data protection, AML, incidents and training.
Open resource ↗What is GRC? A practical framework for UK organisations
Understand governance, risk and compliance with a worked example, a proportionate implementation checklist, clear scope and links to practical tools and templates.
Open resource ↗GRC Site Map: Guides, Tools and Templates
Browse the GRC topic hubs, UK guidance, browser-local tools, editable templates, sector starter packs and implementation playbooks.
Open resource ↗No resources found. Try another term or clear the filter.