Governance, Risk & Compliance Platforms

Governance, Risk & Compliance Platforms Overview

What is Governance, Risk & Compliance (GRC) Software?

Governance, Risk & Compliance software is used by publicly traded companies to control the accessibility of data and manage IT operations that are subject to regulation. An organization needs GRC to:

  • Align IT strategy across the company and eliminate silos operating independently

  • Accomplish goals while streamlining risk profile and protecting value

  • Minimize online threats, detect fraud, and catch errors

  • Ensure staff and company compliance to governmental regulations, such as SOX, export and customs laws, data privacy laws, hazardous materials requirements, and more


The core concept behind governance in IT is making sure that organizations align business strategy with IT strategy. This means that the goal of IT governance is ultimately to ensure that the processes governing evaluation, selection, prioritization, and funding of competing IT investments are driven by the overall business.

There are two distinct phases of governance in IT. The first is determining what the IT organization works on, which is driven by the business. The second is determining how the IT organization supports the business goals of the organization, which is a CIO responsibility.

An IT governance framework puts mechanisms in place to measure how the IT department is functioning overall, what are the key management metrics, and what return IT is giving back to the business from the investment it’s making.

Risk & Compliance

IT governance is usually accompanied by processes to manage risk across the enterprise and to ensure compliance with multiple regulations. Some financial and publicly traded companies are required by federal statute to complete elements of enterprise risk management (ERM). In addition, a company’s ERM score will impact their S&P credit rating.

It can be challenging to determine all the governmental regulations a company must follow, especially if you operate in multiple countries. Compliance software can help navigate the numerous governmental regulations, such as Basel II, SOX, customs and export laws, and additional financial reporting, data privacy, and industry regulations.

Risk & Compliance software modules within GRC platforms improve visibility to company-wide risk, improve employee efficiency by automating controls and streamlining testing, implement necessary paperwork and controls to ensure compliance, and reduce the time to audit.

Governance Risk & Compliance Features and Capabilities

  • Policy management

  • Risk management and mitigation

  • Automated compliance management

  • Document and information management, including version control, audit trail and archiving

  • Training record manager

  • Audits and inspection management

  • Incident management, including root cause analysis and corrective action (CAPA) tools

  • Third party/supplier risk management

  • Access and privilege control

  • Ongoing monitoring of business processes

  • Reporting tools

Governance Risk & Compliance Tool Comparison

There are a range of factors to consider when comparing GRC tools:

  1. Business-wide GRC vs. system-specific: GRC tools vary in their scope of governance and compliance capabilities. Some products offer an all-in-one experience for governing data and facilitating regulatory compliance across the entire business. However, others focus on specific environments or processes, such as Office 365 systems or data integration processes. Buyer should consider what specific areas or processes require GRC support, and what scope best fits their needs.

  2. Compliance focused vs. process-focused: Governance, risk management, and compliance tools usually focus on two business goals- preventing losses of data or resources, and ensuring regulatory compliance. Most GRC tools can serve both goals, but they may be more specialized in one area over the other. For instance, resource control-focused GRC platforms will emphasis Data Loss Prevention or policy management, while compliance-focused tools will prioritize reporting and audit support.

  3. Usability: A key benefit of GRC tools is making governance and compliance easier for InfoSec professionals. The general usability of each product will have a large impact on realizing that benefit. For instance, how well does the platform streamline policy management, compliance reporting, etc.? Pay particular attention to the user interface’s ease of use and how streamlined workflows are. Both features are good metrics to gauge GRC tools’ usability on prior to purchasing.

Start a GRC comparison

Pricing Information

Vendors do not provide prices on their websites as the cost of a solution depends on many different variables, including the number of businesses processes that will be managed, number of modules implemented, number of administrators and users, and if the software is subscription-based or locally installed. However, online users estimate the cost of implementing a GRC solution to be between $10,000 and $600,000.

Governance, Risk & Compliance Products

(1-25 of 101) Sorted by Most Reviews

Forcepoint Data Loss Prevention
42 ratings
25 reviews
Top Rated
Forcepoint DLP promises to address human-centric risk by providing visibility and control everywhere your people work and everywhere your data resides. Security teams apply user-risk scoring to focus on the events that matter most and to accelerate compliance with global data regulations. The vendo…
17 ratings
11 reviews
Many organizations that use Office 365 are exposed to security risks that they are unaware of. As they extend SharePoint to meet their business needs, they build applications using technologies that range from end-user Microsoft Flow to developer-focused SharePoint Framework. Unfortunately, all of t…
RSA Archer
36 ratings
9 reviews
RSA Archer, from the security, governance, and risk division of RSA Security is an integrated risk management / GRC platform.
D&B Credit
10 ratings
7 reviews
D&B Credit is a global, cloud-based risk management solution fueled by Dun & Bradstreet’s industry-leading data and analytics. With powerful portfolio segmentation tools, configurable alert monitoring, and easy-to-read digital credit reports, finance and credit professionals can work more ef…
Mitratech PolicyHub
8 ratings
5 reviews
Mitratech PolicyHub is a policy management solution designed to create, update, approve and communicate policies to automated knowledge assessments, audit and reporting,
13 ratings
4 reviews
Wdesk from Workiva is a cloud platform designed to provide collaboration, data integration, and an audit trail. Wdesk helps mitigate risk, and improves productivity
SEON Sense Platform
5 ratings
3 reviews
SEON Technologies provides a platform designed to help online businesses reduces the costs, time and resources lost to fraud. The vendor says their platform can help global financial companies as well as new startups with modular fraud tools which can adapt to how they do business, and manage risk.A…
17 ratings
3 reviews
MEGA International headquartered in France offers enterprise architecture management and modeling software, and a governance, risk management, and compliance (GRC) platform.
6 ratings
2 reviews
BWise is an Governance, Risk Management, and Compliance (GRC) platform formerly owned and supported by Nasdaq, acquired by SAI Global in April 2019.
ServiceNow Governance, Risk, and Compliance
26 ratings
2 reviews
ServiceNow Governance, Risk, and Compliance provides the tools businesses use to proactively manage risk by measuring, testing and auditing internal processes. This solution helps business users ensure compliance to regulations, policies, standards and frameworks.
Qualys Policy Compliance (PC)
6 ratings
2 reviews
Qualys Policy Compliance (PC) from Qualys in Redwood City, California is a Governance, Risk Management, and Compliance (GRC) Platform.
Cura GRC
2 ratings
1 reviews
Cura GRC is a governance, risk management, and compliance platform from Cura Software in Singapore.
Symantec Control Compliance Suite
1 ratings
1 reviews
The Symantec Control Compliance Suite is a Governance, Risk Management, and Compliance (GRC) Platform.
1 ratings
1 reviews
Riskonnect is an Integrated Risk Management platform. Riskonnect products are all connected, allowing users to navigate to review, analyze, and report from a single interface.
KnowBe4 KCM GRC Platform
1 ratings
1 reviews
KnowBe4 headquartered in Clearwater offers their governance, risk, compliance platform, the KCM GRC Platform.
Thomson Reuters Accelus
3 ratings
1 reviews
The Accelus Suite from Thomson Reuters is a governance, risk management, and compliance (GRC) platform.
BusinessObjects GRC
15 ratings
1 reviews
SAP's BusinessObjects GRC is a governance, risk management, and compliance platform.
Crownpeak Universal Consent Platform
2 ratings
1 reviews
Crownpeak, headquartered in Denver, offers their Consent suite of products, applications designed to support brands in maintaining compliance with local and global privacy laws (e.g. GDPR). The platform features easy opt-in and opt-out, notice and consent gateways, customizable banners, and more.
MetricStream M7
7 ratings
1 reviews
The MetricStream GRC Platform M7, from MetricStream in Palo Alto, California is a Governance, Risk Management, and Compliance (GRC) platform supplying a technology infrastructure for deploying GRC apps configurable to meet the needs of the enterprise.
HighBond by Galvanize
8 ratings
1 reviews
HighBond is a Governance, Risk Management, and Compliance Platform from Galvanize, the company formed from the merger of Rsam and ACL Services, headquartered in Vancouver.
5 ratings
1 reviews
SAI360 (formerly Compliance 360) is offered as a cloud-first EHS and GRC platform offered by SAI Global headquartered in Sydney, Australia. SAI Global acquired Compliance 360 in 2012.
2 ratings
1 reviews
PolicyManager is a web-based enterprise policy and procedure management platform designed for healthcare. The platform allows hospitals and integrated healthcare delivery networks to streamline, consolidate, standardize and centralize all policies in one electronic repository. According to the vendo…
IBM OpenPages
IBM OpenPages is a governance, risk management, and compliance (GRC) platform.
Pentana Risk
Ideagen's Enterprise Risk Management (ERM) software solution Pentana Risk (formerly Pentana Performance of Covalent Software, acquired in 2016) fully integrates risk management processes, from identifying and assessing risk business-wide, to assigning and monitoring mitigation plans, all the way thr…
OpenText TruComply
TruComply is a Governance, Risk Management, and Compliance (GRC) platform developed by ANX and supported by OpenText since the company acquired ANX in 2016.

Frequently Asked Questions

What do GRC platforms do?

GRC products perform two main functions. First, they provide a framework for aligning IT strategy and processes with business goals and regulatory requirements. Then, they provide metrics for measuring how IT governance performs within that framework, as well as facilitating compliance processes like audits and reporting.

Who uses GRC tools?

GRC platforms are most commonly used by IT professionals, particularly Information Security professionals. They are usually used in large companies or companies that work with sensitive or proprietary data or that are heavily regulated.

Can a company use 2 GRC tools?

It’s possible to use 2 GRC tools in the same company, particularly if each tool is specialized to particular use cases or functions. However, many GRC platforms strive to provide an all-in-one experience, eliminating the need for multiple tools.

Why would I need a GRC tool?

An organization would need a GRC tool if they need to ensure compliance with various regulations, particularly regulations around data collection, use, or storage.

How much do GRC tools cost?

Costs vary dramatically, and are rarely publicly available. However, some online estimates offer price ranges from $10,000-600,000.