A GRC platform is one system that holds every risk, policy, supplier and audit finding of a large organisation. GRC stands for governance, risk and compliance. It is also called integrated risk management. Banks, insurers, large manufacturers and government companies use it.
Governance means how the board and the senior managers direct the company and check its work. Risk means the things that could go wrong, such as a cyber attack, a fraud or a supplier failing. Compliance means following the laws and the regulators' rules. A large company tracks thousands of items under these three headings. Before GRC platforms, most companies kept them in spreadsheets, one for each department, and nobody could see them all together.
A GRC platform keeps them in one register. A register is a structured list in which every item has an owner, a status and a deadline. For each risk, the platform records how likely it is, how much damage it would do, which controls reduce it and who must act. For each policy, it records who approved it and which staff have read it. For each audit finding, it records the fix and the date by which it is due.
Consider a mid-sized private bank in Kolkata. RBI inspectors find that 40 branch servers have not received security updates for three months. The finding goes into the GRC platform. It is linked to the risk "ransomware on branch systems" and to the bank's patching policy. The head of IT is named as its owner, with a deadline of 60 days. Each week, the platform asks the IT team for evidence that more servers have been updated. On day 45, six servers are still not updated, so the finding turns red on the risk committee's report. The committee asks why, before the deadline is missed.
Many systems send items to the register. Compliance automation sends live control results. Third-party risk management sends each supplier's assessment. Suppliers matter, because breaches often arrive through them, in a supply chain attack. Privacy management sends the records that the Digital Personal Data Protection (DPDP) Act requires.
The board needs a short version. So the platform sends summaries to the board portal. Cyber risk quantification tools turn the cyber risks into a likely loss in rupees, which directors can compare with other business risks.
The register also has a people side: the code of conduct, and a channel where staff can report wrongdoing. This is covered in ethics hotline and policy management.