Governance, risk and compliance (GRC) is the joined-up way an organisation directs and oversees itself (governance), identifies and manages the risks to its objectives (risk) and meets its legal and regulatory obligations (compliance). In the UK, two recent changes have made GRC a board-level priority well beyond financial services. Since 1 September 2025, large organisations can be prosecuted for failing to prevent fraud committed for their benefit by employees, agents or other associates, unless they had reasonable prevention procedures. And for financial years beginning on or after 1 January 2026, Provision 29 of the UK Corporate Governance Code asks listed company boards to declare whether their material internal controls are effective.
The three parts and why they belong together
- Governance. Who decides what, and how the board holds management to account. This covers board composition, committees, delegated authorities, policies and reporting lines;
- Risk. How the organisation identifies, assesses and responds to the risks that could stop it meeting its objectives. This includes setting a risk appetite and keeping a risk register;
- Compliance. How it knows which laws, regulations and contractual obligations apply, and how it shows it meets them.
Run separately, the three generate duplicate work and gaps. The compliance team keeps a list of regulations, the risk team keeps a list of risks, internal audit tests a third list of controls, and nobody can say which control addresses which obligation. The point of integrating them is that one set of controls, mapped once, can answer the board's question: what could go wrong, and how do we know it won't?
The UK rules that drive GRC
| Requirement | Who it applies to | What it asks for |
|---|---|---|
| UK Corporate Governance Code 2024 | Companies in the commercial companies or closed-ended investment funds listing categories | Comply or explain against the Provisions; the 2024 Code applies to financial years beginning on or after 1 January 2025 |
| Provision 29 | Companies applying the Code | A board declaration on the effectiveness of material internal controls, for financial years beginning on or after 1 January 2026 |
| Wates Principles | Large private companies within the Companies (Miscellaneous Reporting) Regulations 2018 | A way to meet the duty to disclose corporate governance arrangements |
| Failure to prevent fraud (ECCTA 2023, s199) | Large organisations | A defence only if reasonable fraud prevention procedures were in place; the penalty on conviction on indictment is a fine |
| Failure to prevent bribery (Bribery Act 2010, s7) | Commercial organisations | A defence only if adequate procedures were in place to prevent bribery |
| UK GDPR | Any organisation processing personal data | Accountability: the controller must be able to demonstrate compliance |
Regulated firms add sector rules on top, such as the FCA's systems and controls and operational resilience requirements.
Is your organisation "large" for the fraud offence?
A body is a large organisation if it met two or more of the following in the financial year before the fraud:
- Turnover. More than £36 million;
- Balance sheet total. More than £18 million;
- Employees. More than 250.
For a parent undertaking, the test is applied to the group as a whole under section 202.
Home Office guidance says reasonable procedures should follow six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication (including training), and monitoring and review. These are, in effect, a GRC framework applied to fraud.
Building a proportionate GRC framework
- Set the governance. Agree which committee owns risk and which owns audit, what is delegated to management, and how often the board sees risk and compliance reporting;
- Define the risk appetite. Set out, in a few sentences per principal risk, how much risk the board will accept in pursuit of its strategy;
- Build an obligations register. List the laws, regulations and key contracts that apply, each with an owner;
- Keep a focused risk register. Record principal risks with named owners, inherent and residual ratings, and the controls relied on;
- Map controls to risks and obligations. Identify the material controls, the ones whose failure would matter to the board, and record how each is evidenced;
- Assign assurance. Use the three lines model. Management operates the controls, risk and compliance oversee them, and internal audit gives independent assurance;
- Report and review. Report exceptions, incidents and overdue actions to the board, and review the framework at least annually.
Software can help once this structure exists, but it does not replace it.
Worked example: a growing private company
A privately owned distribution business has turnover of £48 million, a balance sheet total of £15 million and 280 employees. It meets two of the three tests, turnover and employees, so it is a large organisation for the failure to prevent fraud offence. It is not listed, so the Corporate Governance Code and Provision 29 do not apply to it.
Because the offence bites where an employee or agent commits fraud intending to benefit the organisation, its practical GRC agenda starts with a fraud risk assessment. That might cover sales staff or agents misrepresenting products to win orders, or misleading information given to lenders. That is followed by proportionate controls, training and a documented annual review that the board signs off. Its existing anti-bribery procedures, GDPR records and health and safety compliance can sit in the same obligations register and control map, so the board gets one view of risk rather than four.
The primary sources are the FRC's UK Corporate Governance Code page, sections 199 and 201 of the Economic Crime and Corporate Transparency Act 2023, the Home Office's failure to prevent fraud guidance and section 7 of the Bribery Act 2010. For related reading, see our guides to the three lines of defence model, Provision 29 and choosing a GRC solution.
Acumon's corporate governance and risk management teams can help design a proportionate GRC framework, run a fraud risk assessment or give independent assurance over material controls.