GRC Sounds Boring. Here's Why It Isn't.
Governance. Risk. Compliance.
Nothing makes you sit up straight like compliance, right? Even saying it out loud is enough to clear a room. And yet, GRC — governance, risk, and compliance — is the framework that sits underneath every ISO 27001 audit, every SOC 2 report, every Cyber Essentials certification. It's not optional. It's the scaffolding.
So let's break it down. Because once you understand what each word actually means, it gets a lot more interesting. The fun one is risk. Let's start there.
Risk: The One That Bites You
Risk is not a vague sense of unease. It's a calculation.
Risk = Probability × Impact
That's it. Two numbers multiplied together. But the insight is in how that equation plays out in practice — because people tend to fixate on probability and ignore impact.
Here's an example. Imagine API keys committed to a codebase early in a project's life, buried dozens of commits back, in a repo that's been private for years. The probability of someone finding them? Low. Maybe very low. But if those keys do get discovered — by a bad actor, by an automated scanner, by someone who bought access to a data breach — the impact is potentially catastrophic. Business-ending, in some cases. No revenue, no trust, no company.
That's the trap with low-probability, high-impact risk: it feels safe until it isn't.
Now flip it. Something like a phishing email hitting your inbox is statistically almost certain — it happens constantly. But if your people are trained, if they know what to look for, the impact is low. That's a manageable risk.
Risk tolerance also varies by company size. An early-stage startup fighting for survival accepts risks that an enterprise wouldn't touch. They may not have company-issued devices. They may not have a formal asset register. And that's not necessarily negligence — it's a pragmatic prioritisation of limited resources. The calculus looks different when your biggest existential threat is running out of runway, not a ransomware attack.
That said, in today's environment, certain things are simply table stakes. MFA. Keeping secrets out of the codebase. These are not hard. They are free or close to it. And the risk of skipping them is real even for a five-person startup.
Compliance: Talking the Talk vs. Walking the Walk
Compliance is the checkbox piece. And I mean that literally — it's the part where you demonstrate that you've got the right documents, the right policies, the right controls in place. Think of it like applying for a visa. You gather your documents. You tick the boxes. You submit them and hope the auditor agrees you've met the standard.
That's part one: talking the talk. Can you demonstrate that your organisation has a password policy, an acceptable use policy, a process for onboarding and offboarding? Yes? Good. You pass that part.
But part two is harder: walking the walk. Do your people actually behave securely? Is security something leadership talks about, genuinely, not just in a slide deck at the all-hands? Does it cascade down from management to individual contributors? Are there real consequences when someone ignores the training, or leaves their screen unlocked, or clicks the wrong link?
This is where most companies fail after achieving technical compliance. The certificate is on the wall. The policies are on the intranet. And then... nothing changes.
Culture doesn't come from documents. It comes from behaviour. And behaviour is contagious.
Governance: The Part That Makes It Stick
Governance is how you make sure risk and compliance don't just exist on paper. It's the structure: who owns what, who's accountable, how decisions get made, how you know things are actually working.
In small companies, governance can feel like overkill. But even informally, it matters. Someone has to own security. Someone has to review the controls. Someone has to notice when the API keys haven't been cycled in eighteen months.
Governance is what turns a one-time compliance project into a continuous security posture. Without it, certifications decay. Policies go stale. New joiners never get trained. The original person who knew where everything was leaves.
The Elf on the Shelf
This is my favourite security story.
At a company I worked with, we had a physical clear desk policy — and a small travelling elf. If you left your screen unlocked when you walked away from your desk, someone would put the elf on your keyboard. You'd come back, see the elf, and know what you'd done.
We called it the Director of Elf and Safety.
It sounds ridiculous. But it worked. The elf moved around the office constantly for weeks. People laughed. People paid attention. And over time, locking your screen became muscle memory. Not because of a policy document. Not because of a mandatory e-learning module. Because of a small, stupid joke that made the abstract — information security — into something tangible and human.
That's the point of GRC done well. It's not about the framework. It's not about the audit. It's about building a culture where people actually give a damn — where security is a habit, not a hurdle.
Why This Matters for Your Certification
If you're pursuing ISO 27001, SOC 2, or Cyber Essentials, you need all three components working together:
- Risk tells you what to protect and how hard
- Compliance tells you what an auditor needs to see
- Governance makes sure both of those things are still true in six months
And none of it works if your people aren't onboard.
That's the gap most companies hit: the technical controls are in place, but the human layer is missing. Someone clicks a phishing link. Someone shares a password over Slack. Someone commits a secret to the repo.
Training doesn't have to be painful. It doesn't have to be a two-hour video nobody finishes. It has to be relevant, targeted, and — where possible — a little bit fun.
That's what we built FwdCheck to do.
FwdCheck is adaptive security awareness training for UK companies pursuing ISO 27001, SOC 2, and Cyber Essentials certification. We assess your people first, then train where the gaps actually are.