GRCLibrary.ai

Procedure

GRC Programme Management and Annual Review Procedure

This procedure governs the annual GRC programme management cycle. It defines how the GRC library is reviewed, updated, version-controlled, reported on, and presented to the Enterprise Risk Committee (ERC). It establishes the cadence and accountability framework for annual governance reviews, quarterly reporting, policy owner attestation, control testing scheduling, risk treatment status updates, and ERC reporting.

Type
Procedure
Version
1.2.0
Date
2026-10-26
Owner
GRC Programme Manager
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Core Governance
Review frequency
Annual and upon material change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Roles and responsibilities
  • 4. Annual review cycle
  • 5. Triggered (out-of-cycle) reviews
  • 6. Document version control
  • 7. Policy owner attestation
  • 8. Control testing schedule
  • 9. Quarterly GRC metrics reporting
  • 10. Risk treatment status updates
  • 11. ERC governance reporting
  • 12. Document retirement and archival
  • 13. Framework alignment

Frameworks it maps to

Related documents