Governance, Risk and Compliance (GRC): Integrated Operating Model and Combined Assurance – London, 24 May – 4 Jun 2027

Programme overview

Introduction:

Most organisations run governance, risk management, compliance and internal audit as separate functions, each with its own registers, taxonomies, assessments and board reports. The result is duplicated control testing, conflicting risk ratings, assurance gaps and boards that cannot see the whole picture. This two-week Governance, Risk and Compliance (GRC) programme from Core Concept shows managers how to join these disciplines into one integrated operating model using the OCEG GRC Capability Model, ISO 31000, COSO ERM, ISO 37301 and the Three Lines Model. Participants leave with an Integrated GRC Roadmap and Operating Model Blueprint for their own organisation.

Course Objectives:

• Design an integrated GRC operating model that assigns roles, committees, decision rights and reporting lines across governance, risk, compliance and assurance
• Align enterprise risk management and the compliance management system on one shared risk, control and obligations taxonomy
• Build a combined assurance map that shows coverage, gaps and overlaps across the three lines
• Specify GRC technology and data requirements for integrated registers, workflows and dashboards
• Define key risk and key control indicators and a maturity scoring method to measure GRC performance
• Produce a phased Integrated GRC Roadmap with a business case for executive approval

Target Audience:

• Professionals who lead or coordinate enterprise risk management across business units
• Professionals responsible for compliance programmes, obligations management and compliance monitoring
• Professionals who support boards and committees on governance frameworks, charters and policy architecture
• Professionals who plan internal audit and other assurance activity and rely on second-line work
• Managers accountable for setting up or restructuring a combined GRC function or GRC platform

Course Outline:

Day 1: Integrated GRC Foundations and Principled Performance

• OCEG Definition of GRC and Principled Performance
• Siloed Versus Integrated GRC: Duplication and Blind-Spot Analysis
• GRC Stakeholder Map of Board, Executives, Functions and Assurance Providers
• Common Risk and Control Taxonomy Design Principles
• Baseline GRC Maturity Self-Assessment Questionnaire

Day 2: Core GRC Frameworks and Standards

• OCEG GRC Capability Model 3.5 Structure and Capability Elements
• ISO 31000:2018 Principles, Framework and Process at Enterprise Level
• COSO ERM Integrating with Strategy and Performance: Components and Principles
• ISO 37301:2021 Compliance Management System Structure
• IIA Three Lines Model Roles and Principles

Day 3: Designing the Integrated GRC Operating Model

• GRC Operating Model Canvas for Roles, Committees and Reporting Lines
• Delegation of Authority Matrix and Decision Rights Mapping
• Policy Architecture: Hierarchy, Ownership and Review Cycle
• Compliance Obligations Register Linked to the Enterprise Risk Register
• Joint Risk and Compliance Assessment Workshop Method

Day 4: GRC Technology, Data and Integrated Registers

• GRC Platform Functional Requirements Specification
• Single Data Model for Risks, Controls, Obligations and Issues
• Control Library Rationalisation and Control-to-Risk Mapping
• Issue and Action Tracking Workflow Design
• GRC Dashboard Prototyping With Spreadsheet and BI Tools

Day 5: Week-One Integration Case Study

• Case Brief: Fragmented Risk, Compliance and Audit Units in a Financial Services Group
• Case Analysis: Duplicated Control Testing in a Manufacturing Company
• Case Analysis: Policy and Obligation Gaps After a Healthcare Merger
• Consolidated Findings Matrix and Integration Priorities
• Peer Review of the Draft Operating Model Canvas

Day 6: Integrated Assurance and Control Rationalisation

• Combined Assurance Map Construction Across the Three Lines
• Assurance Coverage Heat Map With Gap and Overlap Analysis
• Reliance Strategy Between Second-Line Functions and Internal Audit
• COSO Internal Control Framework Alignment With Enterprise Risks
• Continuous Control Monitoring Rule Design

Day 7: Board Oversight, Risk Appetite Linkage and Compliance Culture

• Board and Committee Charters for Risk, Audit and Compliance Oversight
• Cascading Risk Appetite Into Integrated Limits and Tolerances
• Compliance Risk Evaluation Aligned With ISO 37301:2021
• Ethics and Integrity Culture Indicators Within the GRC Programme
• Interconnected Risk Scanning With Bow-Tie Analysis

Day 8: Stakeholders, Change and GRC Communication

• GRC Change Impact Assessment and Adoption Plan
• RACI Charts for Integrated GRC Processes
• Board-Level Integrated GRC Reporting Pack Design
• First-Line Risk Ownership and Risk Champion Networks
• Regulator and External Auditor Engagement Protocol

Day 9: GRC Performance Measurement and Continuous Improvement

• Key Risk Indicator and Key Control Indicator Set Design
• GRC Maturity Model Scoring and Peer Benchmarking
• Integrated Assurance Effectiveness Metrics
• Cost of Compliance and GRC Value Measurement
• Plan-Do-Check-Act Improvement Cycle for the GRC Programme

Day 10: Capstone: Integrated GRC Roadmap

• Current-State GRC Assessment Summary for the Participant's Organisation
• Target-State Integrated GRC Operating Model Blueprint
• Phased Implementation Roadmap With Milestones and Owners
• GRC Programme Business Case and Resourcing Plan
• Capstone Presentation and Peer Challenge Panel

Skills You Will Gain:

• Integrated GRC Operating Model Design
• Risk and Control Taxonomy Harmonisation
• Combined Assurance Mapping
• Compliance Obligations Management
• GRC Platform Requirements Definition
• KRI and KCI Design
• GRC Maturity Assessment
• Board GRC Reporting

Why Attend This Course:

• Replace separate risk, compliance and audit registers with one connected view that removes duplicated testing and conflicting ratings
• Work through multi-sector cases that show where integration fails and how to fix it before committing budget
• Go beyond a one-week course with a second week on combined assurance, board oversight, change and measurement
• Return with an Integrated GRC Roadmap and Operating Model Blueprint ready to present to executive management

Conclusion:

Governance, risk management and compliance deliver most value when they share one taxonomy, one data model and one line of sight to the board. Across two weeks, participants move from the principles of integrated GRC to building the operating model, the registers, the combined assurance map and the indicators that make it work in practice. They finish by presenting a phased roadmap for their own organisation, tested against the challenge of peers from other sectors and ready to guide the next stage of their GRC programme.