{"id":7559,"date":"2026-08-19T11:24:40","date_gmt":"2026-08-19T09:24:40","guid":{"rendered":"https:\/\/arcad.lu\/?p=7559"},"modified":"2026-08-19T11:35:04","modified_gmt":"2026-08-19T09:35:04","slug":"grc-gouvernance-risques-conformite","status":"publish","type":"post","link":"https:\/\/arcad.lu\/en\/grc-gouvernance-risques-conformite\/","title":{"rendered":"GRC: what the acronym really covers"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"7559\" class=\"elementor elementor-7559\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6db90f4 elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"6db90f4\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ebfbb07\" data-id=\"ebfbb07\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b898738 elementor-widget elementor-widget-html\" data-id=\"b898738\" data-element_type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<style>\n.arcad-grc{\n  --arcad-navy:#182a49;\n  --arcad-navy-light:#2c4774;\n  --arcad-gold:#d2bc76;\n  --arcad-gold-soft:#f0e8cf;\n  --arcad-cream:#f7f4ed;\n  --arcad-white:#ffffff;\n  --arcad-ink:#24303c;\n  --arcad-muted:#667180;\n  --arcad-line:#e3ded2;\n\n  \/* Palette VIGIL *\/\n  --vigil-deep:#071b34;\n  --vigil-navy:#0b3158;\n  --vigil-blue:#126aa3;\n  --vigil-blue-bright:#2d91ca;\n  --vigil-sky:#75c5ee;\n  --vigil-soft:#eaf6fc;\n  --vigil-white:#ffffff;\n\n  width:100%;\n  margin:0;\n  color:var(--arcad-ink);\n  font-family:inherit;\n  font-size:18px;\n  line-height:1.7;\n}\n\n.arcad-grc,\n.arcad-grc *{\n  box-sizing:border-box;\n}\n\n.arcad-grc a{\n  color:inherit;\n}\n\n.arcad-grc .arcad-grc__inner{\n  width:min(1120px, calc(100% - 48px));\n  margin:0 auto;\n}\n\n\/* HERO *\/\n.arcad-grc .arcad-grc__hero{\n  position:relative;\n  overflow:hidden;\n  background:\n    radial-gradient(circle at 88% 10%, rgba(210,188,118,.16), transparent 30%),\n    linear-gradient(135deg, var(--arcad-navy) 0%, #20385f 100%);\n  color:var(--arcad-white);\n  padding:72px 0 66px;\n}\n\n.arcad-grc .arcad-grc__hero::before{\n  content:\"\";\n  position:absolute;\n  width:190px;\n  height:190px;\n  right:-72px;\n  top:-80px;\n  border:1px solid rgba(210,188,118,.42);\n  border-radius:50%;\n}\n\n.arcad-grc .arcad-grc__hero::after{\n  content:\"\";\n  position:absolute;\n  width:130px;\n  height:2px;\n  right:7%;\n  bottom:34px;\n  background:var(--arcad-gold);\n  opacity:.65;\n}\n\n.arcad-grc .arcad-grc__hero-content{\n  position:relative;\n  z-index:1;\n  max-width:920px;\n}\n\n.arcad-grc .arcad-grc__kicker{\n  margin:0 0 18px;\n  color:var(--arcad-gold);\n  font-family:inherit;\n  font-size:.78rem;\n  line-height:1.4;\n  font-weight:700;\n  letter-spacing:.14em;\n  text-transform:uppercase;\n}\n\n.arcad-grc .arcad-grc__hero h1{\n  max-width:850px;\n  margin:0 0 22px;\n  color:var(--arcad-white);\n  font-family:inherit;\n  font-size:clamp(2.35rem, 5vw, 4.15rem);\n  line-height:1.08;\n  font-weight:650;\n  letter-spacing:-.035em;\n}\n\n.arcad-grc .arcad-grc__lead{\n  max-width:820px;\n  margin:0 0 30px;\n  color:rgba(255,255,255,.82);\n  font-size:1.22rem;\n  line-height:1.6;\n}\n\n.arcad-grc .arcad-grc__meta{\n  display:flex;\n  flex-wrap:wrap;\n  gap:9px 22px;\n  margin:0;\n  padding-top:20px;\n  border-top:1px solid rgba(210,188,118,.35);\n  color:rgba(255,255,255,.72);\n  font-size:.84rem;\n}\n\n.arcad-grc .arcad-grc__meta span{\n  position:relative;\n}\n\n.arcad-grc .arcad-grc__meta span + span::before{\n  content:\"\";\n  position:absolute;\n  left:-12px;\n  top:.55em;\n  width:3px;\n  height:3px;\n  border-radius:50%;\n  background:var(--arcad-gold);\n}\n\n\/* INTRO *\/\n.arcad-grc .arcad-grc__intro{\n  padding:52px 0 34px;\n}\n\n.arcad-grc .arcad-grc__intro-text{\n  max-width:780px;\n  margin:0;\n  color:var(--arcad-ink);\n  font-size:1.08rem;\n}\n\n\/* REP\u00c8RES *\/\n.arcad-grc .arcad-grc__facts{\n  display:grid;\n  grid-template-columns:repeat(3, minmax(0,1fr));\n  gap:18px;\n  margin:0 0 68px;\n}\n\n.arcad-grc .arcad-grc__fact{\n  position:relative;\n  min-height:150px;\n  padding:26px 26px 25px;\n  background:var(--arcad-cream);\n  border-top:3px solid var(--arcad-gold);\n}\n\n.arcad-grc .arcad-grc__fact-label{\n  margin:0 0 11px;\n  color:var(--arcad-muted);\n  font-size:.75rem;\n  font-weight:700;\n  letter-spacing:.11em;\n  text-transform:uppercase;\n}\n\n.arcad-grc .arcad-grc__fact-value{\n  margin:0;\n  color:var(--arcad-navy);\n  font-size:1.2rem;\n  line-height:1.45;\n  font-weight:650;\n}\n\n\/* SECTIONS *\/\n.arcad-grc .arcad-grc__sections{\n  padding-bottom:28px;\n}\n\n.arcad-grc .arcad-grc__section{\n  display:grid;\n  grid-template-columns:58px minmax(0,1fr);\n  gap:30px;\n  padding:45px 0 48px;\n  border-top:1px solid var(--arcad-line);\n}\n\n.arcad-grc .arcad-grc__section:first-child{\n  border-top:0;\n}\n\n.arcad-grc .arcad-grc__number{\n  padding-top:5px;\n  color:var(--arcad-gold);\n  font-family:inherit;\n  font-size:1rem;\n  line-height:1;\n  font-weight:700;\n  letter-spacing:.08em;\n}\n\n.arcad-grc .arcad-grc__number::after{\n  content:\"\";\n  display:block;\n  width:28px;\n  height:2px;\n  margin-top:12px;\n  background:var(--arcad-gold);\n}\n\n.arcad-grc .arcad-grc__content{\n  min-width:0;\n  max-width:830px;\n}\n\n.arcad-grc .arcad-grc__content h2{\n  margin:0 0 19px;\n  color:var(--arcad-navy);\n  font-family:inherit;\n  font-size:clamp(1.55rem, 2.4vw, 2.05rem);\n  line-height:1.25;\n  font-weight:650;\n  letter-spacing:-.02em;\n}\n\n.arcad-grc .arcad-grc__content p{\n  margin:0 0 1.15em;\n}\n\n.arcad-grc .arcad-grc__content p:last-child{\n  margin-bottom:0;\n}\n\n.arcad-grc .arcad-grc__content strong{\n  color:var(--arcad-navy);\n  font-weight:700;\n}\n\n.arcad-grc .arcad-grc__content em{\n  font-style:italic;\n}\n\n.arcad-grc .arcad-grc__content ul{\n  list-style:none;\n  margin:8px 0 1.2em;\n  padding:0;\n}\n\n.arcad-grc .arcad-grc__content li{\n  position:relative;\n  margin:0 0 11px;\n  padding-left:25px;\n}\n\n.arcad-grc .arcad-grc__content li::before{\n  content:\"\";\n  position:absolute;\n  left:2px;\n  top:.72em;\n  width:7px;\n  height:7px;\n  background:var(--arcad-gold);\n  transform:rotate(45deg);\n}\n\n\/* ENCARTS *\/\n.arcad-grc .arcad-grc__note{\n  margin:28px 0 5px;\n  padding:22px 24px;\n  background:var(--arcad-gold-soft);\n  border-left:4px solid var(--arcad-gold);\n  color:var(--arcad-ink);\n}\n\n.arcad-grc .arcad-grc__note strong:first-child{\n  color:var(--arcad-navy);\n  font-weight:700;\n}\n\n\/* TRANSITION VERS VIGIL *\/\n.arcad-grc .arcad-grc__vigil-wrap{\n  margin:6px 0 48px;\n  padding-left:88px;\n}\n\n.arcad-grc .arcad-grc__vigil-context{\n  position:relative;\n  max-width:830px;\n  margin:0 0 22px;\n  padding:3px 0 3px 23px;\n  border-left:3px solid var(--vigil-blue-bright);\n}\n\n.arcad-grc .arcad-grc__vigil-context p{\n  margin:0;\n  color:var(--arcad-muted);\n  font-size:.97rem;\n  line-height:1.7;\n}\n\n.arcad-grc .arcad-grc__vigil-context strong{\n  color:var(--vigil-navy);\n  font-weight:700;\n}\n\n\/* CTA VIGIL *\/\n.arcad-grc .arcad-grc__vigil{\n  position:relative;\n  overflow:hidden;\n  max-width:830px;\n  padding:36px 38px 37px;\n  background:\n    radial-gradient(\n      circle at 89% 13%,\n      rgba(117,197,238,.22) 0,\n      rgba(117,197,238,0) 31%\n    ),\n    linear-gradient(\n      135deg,\n      var(--vigil-deep) 0%,\n      var(--vigil-navy) 52%,\n      var(--vigil-blue) 100%\n    );\n  color:var(--vigil-white);\n  border-top:4px solid var(--vigil-sky);\n  box-shadow:0 18px 42px rgba(7,27,52,.16);\n}\n\n.arcad-grc .arcad-grc__vigil::before{\n  content:\"\";\n  position:absolute;\n  right:-48px;\n  top:-66px;\n  width:205px;\n  height:205px;\n  border:1px solid rgba(117,197,238,.27);\n  border-radius:50%;\n}\n\n.arcad-grc .arcad-grc__vigil::after{\n  content:\"\";\n  position:absolute;\n  right:37px;\n  bottom:32px;\n  width:78px;\n  height:3px;\n  background:var(--vigil-sky);\n  opacity:.9;\n}\n\n.arcad-grc .arcad-grc__vigil-copy{\n  position:relative;\n  z-index:2;\n  max-width:660px;\n}\n\n.arcad-grc .arcad-grc__vigil-label{\n  display:inline-flex;\n  align-items:center;\n  gap:8px;\n  margin:0 0 13px;\n  padding:6px 10px;\n  background:rgba(117,197,238,.12);\n  border:1px solid rgba(117,197,238,.34);\n  color:var(--vigil-sky);\n  font-size:.72rem;\n  line-height:1.35;\n  font-weight:700;\n  letter-spacing:.13em;\n  text-transform:uppercase;\n}\n\n.arcad-grc .arcad-grc__vigil-label::before{\n  content:\"\";\n  width:6px;\n  height:6px;\n  flex:0 0 6px;\n  background:var(--vigil-sky);\n  border-radius:50%;\n  box-shadow:0 0 0 4px rgba(117,197,238,.12);\n}\n\n.arcad-grc .arcad-grc__vigil h3{\n  max-width:620px;\n  margin:0 0 13px;\n  color:var(--vigil-white);\n  font-family:inherit;\n  font-size:clamp(1.5rem, 2.5vw, 1.85rem);\n  line-height:1.25;\n  font-weight:700;\n  letter-spacing:-.02em;\n}\n\n.arcad-grc .arcad-grc__vigil p{\n  max-width:650px;\n  margin:0 0 24px;\n  color:rgba(255,255,255,.8);\n  font-size:.98rem;\n  line-height:1.68;\n}\n\n.arcad-grc .arcad-grc__vigil-button{\n  display:inline-flex;\n  align-items:center;\n  justify-content:center;\n  gap:8px;\n  min-height:48px;\n  padding:12px 23px;\n  background:var(--vigil-white);\n  border:1px solid var(--vigil-white);\n  color:var(--vigil-navy) !important;\n  font-size:.9rem;\n  line-height:1.3;\n  font-weight:700;\n  text-decoration:none;\n  box-shadow:0 5px 16px rgba(0,0,0,.1);\n  transition:\n    background .2s ease,\n    border-color .2s ease,\n    color .2s ease,\n    transform .2s ease;\n}\n\n.arcad-grc .arcad-grc__vigil-button:hover{\n  background:var(--vigil-sky);\n  border-color:var(--vigil-sky);\n  color:var(--vigil-deep) !important;\n  transform:translateY(-1px);\n}\n\n\/* \u00c0 RETENIR *\/\n.arcad-grc .arcad-grc__takeaway{\n  margin:18px 0 0;\n  padding:36px 38px;\n  background:linear-gradient(\n    135deg,\n    var(--arcad-navy) 0%,\n    var(--arcad-navy-light) 100%\n  );\n  color:var(--arcad-white);\n}\n\n.arcad-grc .arcad-grc__takeaway-label{\n  display:block;\n  margin:0 0 12px;\n  color:var(--arcad-gold);\n  font-size:.75rem;\n  line-height:1.4;\n  font-weight:700;\n  letter-spacing:.14em;\n  text-transform:uppercase;\n}\n\n.arcad-grc .arcad-grc__takeaway p{\n  max-width:880px;\n  margin:0;\n  color:var(--arcad-white);\n  font-size:1.08rem;\n  line-height:1.7;\n}\n\n\/* CTA ARCAD FINAL *\/\n.arcad-grc .arcad-grc__cta{\n  display:grid;\n  grid-template-columns:minmax(0,1fr) auto;\n  gap:30px;\n  align-items:center;\n  margin:36px 0 0;\n  padding:34px 36px;\n  background:var(--arcad-cream);\n  border-top:3px solid var(--arcad-gold);\n}\n\n.arcad-grc .arcad-grc__cta-copy{\n  min-width:0;\n}\n\n.arcad-grc .arcad-grc__cta-title{\n  margin:0 0 8px;\n  color:var(--arcad-navy);\n  font-size:1.35rem;\n  line-height:1.35;\n  font-weight:700;\n}\n\n.arcad-grc .arcad-grc__cta p{\n  max-width:700px;\n  margin:0;\n  color:var(--arcad-muted);\n}\n\n.arcad-grc .arcad-grc__cta-button{\n  display:inline-flex;\n  align-items:center;\n  justify-content:center;\n  min-height:48px;\n  padding:12px 23px;\n  background:var(--arcad-navy);\n  border:1px solid var(--arcad-navy);\n  color:var(--arcad-white) !important;\n  font-size:.9rem;\n  line-height:1.3;\n  font-weight:700;\n  text-align:center;\n  text-decoration:none;\n  white-space:nowrap;\n  transition:\n    background .2s ease,\n    border-color .2s ease,\n    transform .2s ease;\n}\n\n.arcad-grc .arcad-grc__cta-button:hover{\n  background:var(--arcad-navy-light);\n  border-color:var(--arcad-navy-light);\n  transform:translateY(-1px);\n}\n\n\/* SOURCES *\/\n.arcad-grc .arcad-grc__foot{\n  margin-top:58px;\n  padding:34px 0 72px;\n  border-top:2px solid var(--arcad-gold);\n}\n\n.arcad-grc .arcad-grc__foot h3{\n  margin:0 0 20px;\n  color:var(--arcad-navy);\n  font-family:inherit;\n  font-size:1.15rem;\n  line-height:1.35;\n  font-weight:700;\n}\n\n.arcad-grc .arcad-grc__foot ul{\n  list-style:none;\n  max-width:900px;\n  margin:0;\n  padding:0;\n}\n\n.arcad-grc .arcad-grc__foot li{\n  position:relative;\n  margin:0 0 10px;\n  padding-left:24px;\n  color:var(--arcad-muted);\n  font-size:.95rem;\n}\n\n.arcad-grc .arcad-grc__foot li::before{\n  content:\"\";\n  position:absolute;\n  left:2px;\n  top:.72em;\n  width:6px;\n  height:6px;\n  background:var(--arcad-gold);\n  transform:rotate(45deg);\n}\n\n.arcad-grc .arcad-grc__scope{\n  max-width:860px;\n  margin:28px 0 0;\n  padding:3px 0 3px 16px;\n  border-left:3px solid var(--arcad-gold);\n  color:var(--arcad-muted);\n  font-size:.88rem;\n  line-height:1.65;\n}\n\n\/* RESPONSIVE *\/\n@media (max-width:900px){\n  .arcad-grc .arcad-grc__inner{\n    width:min(100% - 40px,1120px);\n  }\n\n  .arcad-grc .arcad-grc__facts{\n    grid-template-columns:repeat(3,minmax(0,1fr));\n    gap:12px;\n  }\n\n  .arcad-grc .arcad-grc__fact{\n    padding:22px 20px;\n  }\n\n  .arcad-grc .arcad-grc__vigil-wrap{\n    padding-left:88px;\n  }\n}\n\n@media (max-width:767px){\n  .arcad-grc{\n    font-size:17px;\n  }\n\n  .arcad-grc .arcad-grc__inner{\n    width:calc(100% - 32px);\n  }\n\n  .arcad-grc .arcad-grc__hero{\n    padding:50px 0 46px;\n  }\n\n  .arcad-grc .arcad-grc__hero h1{\n    font-size:clamp(2rem,10vw,2.75rem);\n  }\n\n  .arcad-grc .arcad-grc__lead{\n    font-size:1.08rem;\n  }\n\n  .arcad-grc .arcad-grc__meta{\n    display:grid;\n    gap:6px;\n  }\n\n  .arcad-grc .arcad-grc__meta span + span::before{\n    display:none;\n  }\n\n  .arcad-grc .arcad-grc__intro{\n    padding:36px 0 26px;\n  }\n\n  .arcad-grc .arcad-grc__facts{\n    grid-template-columns:1fr;\n    margin-bottom:46px;\n  }\n\n  .arcad-grc .arcad-grc__fact{\n    min-height:0;\n  }\n\n  .arcad-grc .arcad-grc__section{\n    grid-template-columns:1fr;\n    gap:14px;\n    padding:34px 0 36px;\n  }\n\n  .arcad-grc .arcad-grc__number{\n    display:flex;\n    align-items:center;\n    gap:10px;\n    padding-top:0;\n  }\n\n  .arcad-grc .arcad-grc__number::after{\n    display:inline-block;\n    margin:0;\n  }\n\n  .arcad-grc .arcad-grc__content h2{\n    font-size:1.55rem;\n  }\n\n  .arcad-grc .arcad-grc__note{\n    padding:19px 20px;\n  }\n\n  .arcad-grc .arcad-grc__vigil-wrap{\n    margin-top:0;\n    padding-left:0;\n    padding-bottom:8px;\n  }\n\n  .arcad-grc .arcad-grc__vigil-context{\n    margin-bottom:18px;\n    padding-left:17px;\n  }\n\n  .arcad-grc .arcad-grc__vigil{\n    padding:28px 23px 30px;\n  }\n\n  .arcad-grc .arcad-grc__vigil::after{\n    display:none;\n  }\n\n  .arcad-grc .arcad-grc__vigil-button{\n    width:100%;\n  }\n\n  .arcad-grc .arcad-grc__takeaway{\n    padding:28px 23px;\n  }\n\n  .arcad-grc .arcad-grc__cta{\n    grid-template-columns:1fr;\n    gap:22px;\n    padding:27px 23px;\n  }\n\n  .arcad-grc .arcad-grc__cta-button{\n    width:100%;\n    white-space:normal;\n  }\n\n  .arcad-grc .arcad-grc__foot{\n    margin-top:42px;\n    padding-bottom:52px;\n  }\n}\n<\/style>\n\n<article class=\"arcad-grc\" lang=\"fr\">\n\n  <header class=\"arcad-grc__hero\">\n    <div class=\"arcad-grc__inner\">\n      <div class=\"arcad-grc__hero-content\">\n\n        <p class=\"arcad-grc__kicker\">\n          GRC \u00b7 Governance \u00b7 Control functions\n        <\/p>\n\n        <h1>GRC: what the acronym really covers<\/h1>\n\n        <p class=\"arcad-grc__lead\">\n          The acronym CRM is everywhere \u2014 in software offers, job titles, board presentations. Yet it rarely refers to the same thing from one person to another. Clarifying what it covers is not a semantic exercise: it is what distinguishes a system that truly structures the organisation from a disjointed stack of tools.\n        <\/p>\n\n        <div class=\"arcad-grc__meta\">\n          <span>Category: Governance<\/span>\n          <span>Reading time: 8 minutes<\/span>\n        <\/div>\n\n      <\/div>\n    <\/div>\n  <\/header>\n\n  <div class=\"arcad-grc__inner\">\n\n    <div class=\"arcad-grc__intro\">\n      <p class=\"arcad-grc__intro-text\">\n        GRC stands for governance, risk and compliance<em>governance, risk and compliance<\/em>). Beyond this obvious fact, usage is fluid. Three confusions regularly crop up.\n      <\/p>\n    <\/div>\n\n    <div class=\"arcad-grc__facts\">\n\n      <div class=\"arcad-grc__fact\">\n        <p class=\"arcad-grc__fact-label\">An ability<\/p>\n        <p class=\"arcad-grc__fact-value\">\n          Not a department, not a piece of software\n        <\/p>\n      <\/div>\n\n      <div class=\"arcad-grc__fact\">\n        <p class=\"arcad-grc__fact-label\">Three dimensions<\/p>\n        <p class=\"arcad-grc__fact-value\">\n          Governance, risk management, compliance\n        <\/p>\n      <\/div>\n\n      <div class=\"arcad-grc__fact\">\n        <p class=\"arcad-grc__fact-label\">Everyone<\/p>\n        <p class=\"arcad-grc__fact-value\">\n          Nobody has exclusive ownership of business advisory services.\n        <\/p>\n      <\/div>\n\n    <\/div>\n\n    <div class=\"arcad-grc__sections\">\n\n      <section class=\"arcad-grc__section\">\n        <div class=\"arcad-grc__number\">01<\/div>\n\n        <div class=\"arcad-grc__content\">\n          <h2>An acronym used for three different things<\/h2>\n\n          <p>\n            The first consists of treating the GRC as a <strong>risk management<\/strong>. That is oversimplifying: risk management is only one of the three dimensions, and GRC does not replace it \u2014 it integrates it into the pursuit of the organisation's objectives.\n          <\/p>\n\n          <p>\n            The second one makes one <strong>compliance matter<\/strong>. This reading can be explained historically, as a portion of the foundational work originated in the field of compliance, but it strips the concept of its strategic dimension.\n          <\/p>\n\n          <p>\n            The third, which is the most widespread in organisations, reduces GRC to a <strong>IT subject<\/strong> \u2014 often because the initial contact with the term was through software. Yet no single tool in itself constitutes a CRM arrangement.\n          <\/p>\n        <\/div>\n      <\/section>\n\n      <section class=\"arcad-grc__section\">\n        <div class=\"arcad-grc__number\">02<\/div>\n\n        <div class=\"arcad-grc__content\">\n          <h2>A definition that fits into three verbs<\/h2>\n\n          <p>\n            The most operational definition, stemming from the work of the OCEG (<em>Open Compliance and Ethics Group<\/em>), organisation at the origin of the formalisation of the concept, describes GRC as a <strong>capacity<\/strong> enabling an organisation to reliably achieve its objectives, address uncertainty and act with integrity.\n          <\/p>\n\n          <p>Each term corresponds to a dimension:<\/p>\n\n          <ul>\n            <li>\n              <strong>Governance<\/strong> - reliably achieve the right objectives: define them, manage them, and report on them.\n            <\/li>\n            <li>\n              <strong>Risks<\/strong> \u2014 manage uncertainty: identify what could affect these objectives, and take justified risks rather than shunning them.\n            <\/li>\n            <li>\n              <strong>Compliance<\/strong> - act with integrity: respect applicable obligations <em>and<\/em> the values the organisation has adopted.\n            <\/li>\n          <\/ul>\n\n          <div class=\"arcad-grc__note\">\n            <strong>What this definition changes:<\/strong> GRC is not a control exercised over the activity, but a capability in the service of performance. It does not ask \u00abhave we complied with the rules?\u00bb, but \u00abare we in a position to achieve our objectives, knowingly and with integrity?\u00bb\n          <\/div>\n        <\/div>\n      <\/section>\n\n      <section class=\"arcad-grc__section\">\n        <div class=\"arcad-grc__number\">03<\/div>\n\n        <div class=\"arcad-grc__content\">\n          <h2>A capability, not a department<\/h2>\n\n          <p>\n            From this definition stems an important practical consequence: <strong>CRM does not embody itself in a department.<\/strong> Creating a \u00abGRC department\u00bb that would absorb existing functions is a contradiction in terms, and a source of inefficiency.\n          <\/p>\n\n          <p>\n            GRC actually spans the entire organisation. The board of directors participates when setting the direction and risk appetite. Management, when making trade-offs. Control functions \u2014 compliance, risk management, internal control \u2014 when providing oversight. Internal audit, when providing independent assurance. Legal, IT, human resources, finance, and above all the business lines themselves, all contribute at their own level.\n          <\/p>\n\n          <p>\n            This also invites caution regarding job titles. A compliance officer, a risk manager or an internal auditor perform distinct jobs, with different independence requirements. Grouping them under the generic label of \u00abGRC professionals\u00bb blurs boundaries that regulations carefully maintain \u2014 particularly within the regulated financial sector.\n          <\/p>\n        <\/div>\n      <\/section>\n\n      <section class=\"arcad-grc__section\">\n        <div class=\"arcad-grc__number\">04<\/div>\n\n        <div class=\"arcad-grc__content\">\n          <h2>The real contribution of the concept: orchestration<\/h2>\n\n          <p>\n            If GRT is neither a department nor a tool, what is left? The most important thing: the idea that these activities, historically organised in silos, must operate in a coordinated manner.\n          <\/p>\n\n          <p>\n            The situation is familiar in many organisations. Compliance maintains its own tracking tables. Risk management maintains its mapping. Internal control documents its controls elsewhere. Internal audit formulates recommendations in a third repository. Each function requests the same operational teams, with similar requests and different formats. No one has the big picture.\n          <\/p>\n\n          <p>\n            Orchestration consists of ensuring that these functions share a common understanding of objectives, risks and obligations \u2014 and that the right people receive the right information at the right time. It does not involve merging teams, but linking their work.\n          <\/p>\n\n          <div class=\"arcad-grc__note\">\n            <strong>A simple indicator:<\/strong> Ask three control functions to name the organisation's five major risks. If the lists diverge significantly, the problem is not with their skills \u2014 it is the lack of orchestration.\n          <\/div>\n        <\/div>\n      <\/section>\n\n      <div class=\"arcad-grc__vigil-wrap\">\n\n        <div class=\"arcad-grc__vigil-context\">\n          <p>\n            <strong>Once this orchestration has been defined, tooling can facilitate its execution.<\/strong> A common environment makes it possible, amongst other things, to link risks, controls, documents, recommendations and action plans, whilst maintaining the traceability required to manage the framework.\n          <\/p>\n        <\/div>\n\n        <aside class=\"arcad-grc__vigil\">\n\n          <div class=\"arcad-grc__vigil-copy\">\n\n            <span class=\"arcad-grc__vigil-label\">\n              VIGIL \u00b7 GRC \/ RegTech Platform\n            <\/span>\n\n            <h3>\n              Transitioning from fragmented tracking to a shared GRC environment\n            <\/h3>\n\n            <p>\n              VIGIL centralises your risk, compliance, internal control and audit systems within a structured environment: data, controls, evidence, recommendations, actions and reporting can be tracked in a consistent and traceable manner.\n            <\/p>\n\n            <a\n              class=\"arcad-grc__vigil-button\"\n              href=\"https:\/\/vigil-solutions.eu\/\"\n              target=\"_blank\"\n              rel=\"noopener noreferrer\"\n            >\n              Discover VIGIL \u2192\n            <\/a>\n\n          <\/div>\n\n        <\/aside>\n\n      <\/div>\n\n      <section class=\"arcad-grc__section\">\n        <div class=\"arcad-grc__number\">05<\/div>\n\n        <div class=\"arcad-grc__content\">\n          <h2>What GRC means for a regulated Luxembourg entity<\/h2>\n\n          <p>\n            For industry stakeholders, the question is not about adopting an additional concept: the components of GRC are already in place, often because regulations require them. A compliance function, a risk management function, an internal control system, an independent internal audit function: these are all elements expected by the internal governance framework applicable to entities regulated by the Commission de Surveillance du Secteur Financier (CSSF).\n          <\/p>\n\n          <p>\n            The issue is therefore shifting. It is not a matter of creating, but of <strong>connect<\/strong> \u2014 and to demonstrate this consistency. Three expectations converge in this direction:\n          <\/p>\n\n          <ul>\n            <li>\n              <strong>Consistency<\/strong> \u2014 a supervisor questioning the system expects consistent responses from one function to the next, not three versions of the same subject.\n            <\/li>\n\n            <li>\n              <strong>Traceability<\/strong> decisions, approvals and corrective actions must be traceable; assertion is not enough, proof is expected.\n            <\/li>\n\n            <li>\n              <strong>Proportionality<\/strong> \u2014 the arrangement is assessed with regard to the size, risk profile and complexity of the entity, rather than according to a single model.\n            <\/li>\n          <\/ul>\n        <\/div>\n      <\/section>\n\n      <section class=\"arcad-grc__section\">\n        <div class=\"arcad-grc__number\">06<\/div>\n\n        <div class=\"arcad-grc__content\">\n          <h2>Common pitfalls<\/h2>\n\n          <ul>\n            <li>\n              <strong>Confusing the tool with the device.<\/strong> Software structures data and streamlines a process; it does not set objectives, arbitrate or replace professional judgment.\n            <\/li>\n\n            <li>\n              <strong>Create a mega-department.<\/strong> Grouping functions under a single authority undermines the independence that the regulatory framework protects.\n            <\/li>\n\n            <li>\n              <strong>Reducing GRC to compliance.<\/strong> This results in a defensive setup, disconnected from strategy and perceived as a blocker by the business lines.\n            <\/li>\n\n            <li>\n              <strong>Increase the number of requests from the business areas.<\/strong> Without coordination, each function separately queries the same teams \u2014 the setup ends up being more of a burden than a benefit.\n            <\/li>\n\n            <li>\n              <strong>Neglecting the \u00abobjectives\u00bb dimension.<\/strong> A GRC that is not connected to what the organisation is trying to achieve loses its raison d'\u00eatre.\n            <\/li>\n          <\/ul>\n        <\/div>\n      <\/section>\n\n      <section class=\"arcad-grc__section\">\n        <div class=\"arcad-grc__number\">07<\/div>\n\n        <div class=\"arcad-grc__content\">\n          <h2>The ARCAD approach<\/h2>\n\n          <p>\n            ARCAD approaches GRC as a capability to be structured, not as a product to be installed. The approach starts with the organisation's objectives and risk profile, then connects existing mechanisms \u2014 compliance, risk, internal control, internal audit \u2014 rather than piling them on top of one another. The tooling comes afterwards, once the method is established: it is in this order that it produces results.\n          <\/p>\n        <\/div>\n      <\/section>\n\n    <\/div>\n\n    <aside class=\"arcad-grc__takeaway\">\n\n      <span class=\"arcad-grc__takeaway-label\">\n        To remember\n      <\/span>\n\n      <p>\n        GRC is neither a department, nor software, nor a synonym for risk management. It is an organisation's ability to reliably achieve objectives, address uncertainty and act with integrity. Its true value lies in orchestration: getting functions that too often ignore one another to work together.\n      <\/p>\n\n    <\/aside>\n\n    <div class=\"arcad-grc__cta\">\n\n      <div class=\"arcad-grc__cta-copy\">\n\n        <p class=\"arcad-grc__cta-title\">\n          Structure your GRC framework on clear foundations.\n        <\/p>\n\n        <p>\n          ARCAD supports Luxembourg regulated entities in aligning their control functions.\n        <\/p>\n\n      <\/div>\n\n      <a\n        class=\"arcad-grc__cta-button\"\n        href=\"mailto:administration@arcad.lu?subject=Demande%20d'\u00e9change%20-%20Dispositif%20GRC\"\n      >\n        Schedule an exchange \u2192\n      <\/a>\n\n    <\/div>\n\n    <footer class=\"arcad-grc__foot\">\n\n      <h3>\n        References &amp; further reading\n      <\/h3>\n\n      <ul>\n        <li>\n          OCEG works (<em>Open Compliance and Ethics Group<\/em>) on the definition and capabilities of the CRM.\n        <\/li>\n\n        <li>\n          Global Internal Audit Standards and the Three Lines Model, Institute of Internal Auditors (IIA).\n        <\/li>\n\n        <li>\n          Internal governance framework applicable to CSSF-regulated entities.\n        <\/li>\n      <\/ul>\n\n      <p class=\"arcad-grc__scope\">\n        Note: Good practice to be adapted to the profile, size and regulatory framework specific to each organisation.\n      <\/p>\n\n    <\/footer>\n\n  <\/div>\n\n<\/article>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>GRC links governance, risk management and compliance in order to connect control functions with the organisation's objectives.<\/p>","protected":false},"author":2,"featured_media":7570,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[1],"tags":[30],"class_list":["post-7559","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-grc"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.3.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>GRC : gouvernance, risques et conformit\u00e9 | ARCAD<\/title>\n<meta name=\"description\" content=\"Comprendre ce que recouvre r\u00e9ellement le GRC, ses trois dimensions et son r\u00f4le dans l&#039;orchestration de la gouvernance, des risques et de la conformit\u00e9.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/arcad.lu\/en\/grc-gouvernance-risques-conformite\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GRC : gouvernance, risques et conformit\u00e9 | ARCAD\" \/>\n<meta property=\"og:description\" content=\"Comprendre ce que recouvre r\u00e9ellement le GRC, ses trois dimensions et son r\u00f4le dans l&#039;orchestration de la gouvernance, des risques et de la conformit\u00e9.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/arcad.lu\/en\/grc-gouvernance-risques-conformite\/\" \/>\n<meta property=\"og:site_name\" content=\"ARCAD\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-19T09:24:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-19T09:35:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/grc-001.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1149\" \/>\n\t<meta property=\"og:image:height\" content=\"533\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Bastien Decerfou\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Bastien Decerfou\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/\",\"url\":\"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/\",\"name\":\"GRC : gouvernance, risques et conformit\u00e9 | ARCAD\",\"isPartOf\":{\"@id\":\"https:\/\/arcad.lu\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/grc-001.png\",\"datePublished\":\"2026-08-19T09:24:40+00:00\",\"dateModified\":\"2026-08-19T09:35:04+00:00\",\"author\":{\"@id\":\"https:\/\/arcad.lu\/#\/schema\/person\/a087acd8a15d5a534096ac1bf3efc524\"},\"description\":\"Comprendre ce que recouvre r\u00e9ellement le GRC, ses trois dimensions et son r\u00f4le dans l'orchestration de la gouvernance, des risques et de la conformit\u00e9.\",\"breadcrumb\":{\"@id\":\"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#primaryimage\",\"url\":\"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/grc-001.png\",\"contentUrl\":\"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/grc-001.png\",\"width\":1149,\"height\":533},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/arcad.lu\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"GRC : ce que recouvre vraiment le sigle\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/arcad.lu\/#website\",\"url\":\"https:\/\/arcad.lu\/\",\"name\":\"ARCAD\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/arcad.lu\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/arcad.lu\/#\/schema\/person\/a087acd8a15d5a534096ac1bf3efc524\",\"name\":\"Bastien Decerfou\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/arcad.lu\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2a433ec2c9f0bf45bb4133ffe92fc6404b0bb82145096ad97e743c259599c627?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2a433ec2c9f0bf45bb4133ffe92fc6404b0bb82145096ad97e743c259599c627?s=96&d=mm&r=g\",\"caption\":\"Bastien Decerfou\"},\"url\":\"https:\/\/arcad.lu\/en\/author\/bdecerf\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GRC: governance, risk and compliance | ARCAD","description":"Understand what GRC actually covers, its three dimensions and its role in orchestrating governance, risk and compliance.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/arcad.lu\/en\/grc-gouvernance-risques-conformite\/","og_locale":"en_GB","og_type":"article","og_title":"GRC : gouvernance, risques et conformit\u00e9 | ARCAD","og_description":"Comprendre ce que recouvre r\u00e9ellement le GRC, ses trois dimensions et son r\u00f4le dans l'orchestration de la gouvernance, des risques et de la conformit\u00e9.","og_url":"https:\/\/arcad.lu\/en\/grc-gouvernance-risques-conformite\/","og_site_name":"ARCAD","article_published_time":"2026-08-19T09:24:40+00:00","article_modified_time":"2026-08-19T09:35:04+00:00","og_image":[{"width":1149,"height":533,"url":"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/grc-001.png","type":"image\/png"}],"author":"Bastien Decerfou","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Bastien Decerfou","Estimated reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/","url":"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/","name":"GRC: governance, risk and compliance | ARCAD","isPartOf":{"@id":"https:\/\/arcad.lu\/#website"},"primaryImageOfPage":{"@id":"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#primaryimage"},"image":{"@id":"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#primaryimage"},"thumbnailUrl":"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/grc-001.png","datePublished":"2026-08-19T09:24:40+00:00","dateModified":"2026-08-19T09:35:04+00:00","author":{"@id":"https:\/\/arcad.lu\/#\/schema\/person\/a087acd8a15d5a534096ac1bf3efc524"},"description":"Understand what GRC actually covers, its three dimensions and its role in orchestrating governance, risk and compliance.","breadcrumb":{"@id":"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#primaryimage","url":"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/grc-001.png","contentUrl":"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/grc-001.png","width":1149,"height":533},{"@type":"BreadcrumbList","@id":"https:\/\/arcad.lu\/grc-gouvernance-risques-conformite\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/arcad.lu\/"},{"@type":"ListItem","position":2,"name":"GRC : ce que recouvre vraiment le sigle"}]},{"@type":"WebSite","@id":"https:\/\/arcad.lu\/#website","url":"https:\/\/arcad.lu\/","name":"ARCAD","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/arcad.lu\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/arcad.lu\/#\/schema\/person\/a087acd8a15d5a534096ac1bf3efc524","name":"Bastien Decerfou","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/arcad.lu\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2a433ec2c9f0bf45bb4133ffe92fc6404b0bb82145096ad97e743c259599c627?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2a433ec2c9f0bf45bb4133ffe92fc6404b0bb82145096ad97e743c259599c627?s=96&d=mm&r=g","caption":"Bastien Decerfou"},"url":"https:\/\/arcad.lu\/en\/author\/bdecerf\/"}]}},"_links":{"self":[{"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/posts\/7559","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/comments?post=7559"}],"version-history":[{"count":7,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/posts\/7559\/revisions"}],"predecessor-version":[{"id":7568,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/posts\/7559\/revisions\/7568"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/media\/7570"}],"wp:attachment":[{"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/media?parent=7559"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/categories?post=7559"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/tags?post=7559"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}