GRC
GRC (governance, risk and compliance) keeps the business's registers: statutory calendar, risks, controls testing, compliance, audits, third-party risk, policies, training, legal, incidents, whistle-blower, business continuity, ESG and governance.
Why and when you use it
As a business grows, missed filings, unchecked risks and lost legal notices cost money and reputation. GRC puts these registers in one place with owners and dates, so the owner and auditors can see what is in order. The owner, accountant or compliance officer uses it; auditors read it.
Before you start
- GRC module active (Enterprise plan)
- List of your filings and licences
- Named owners for each area
Step by step
- Build the Statutory CalendarAdd every recurring filing and renewal - GSTR-1, GSTR-3B, TDS returns, licence renewals - with who is responsible. The Dashboard then shows what is due.
- List your risksIn Risks, write down what could hurt the business, how likely and how serious it is, and who handles it.
- Test your controlsUse Controls Testing to check that the checks you rely on, such as approval before payment, actually work.
- Track compliance and auditsUse Compliance for legal requirements you must meet and Audits for internal and external audits and their findings.
- Check suppliers and partnersUse Third-party Risk to review key suppliers and service providers.
- Policies, training and legalStore rules in Policies, record staff acknowledgement in Training & Attestations, and track notices and cases in Legal.
- Record incidents and concernsLog events such as theft or data loss in Incidents. Whistle-blower takes concerns raised by staff.
- Plan for the bad day and reportUse Business Continuity for plans to keep working after a disruption, ESG for environmental and social records, and Governance for board and owner-level matters.
- Check Registers Overview, Accounts and My PlanThe last tabs are shared by the industry modules. Registers Overview gives one summary of the registers in GRC, Accounts shows the money side of the module and how it reaches your books, and My Plan confirms the module is active - it reads "GRC Enterprise (Enterprise plan)".
Worked example
Sharma Traders, an FMCG distributor in Jaipur with 25 staff, wants fewer surprises after it paid a late fee for a GST return last year and lost goods in a godown leak.
- Statutory Calendar: adds GSTR-1 and GSTR-3B monthly (owner: accountant), TDS returns quarterly, and FSSAI licence renewal.
- Risks: "Gupta Kirana Store owes ₹3,40,000, above its limit" - owner Ravi; "Single supplier Hindustan Foods for 60% of stock" - owner Mr. Sharma.
- Third-party Risk: reviews Hindustan Foods Pvt Ltd as a key supplier.
- Incidents: records the godown leak of 12 Nov 2026 with ₹18,000 goods damaged.
- Business Continuity: notes a backup godown in Sanganer.
- Controls Testing: checks that payments above ₹50,000 had owner approval in October.
Result: The Dashboard shows due filings in one view, each risk has an owner, and the godown incident and its fix are on record for the insurer and auditors.
💡 Tips
- Start with the Statutory Calendar - it gives quick wins and avoids late fees.
- Give every risk and filing one named owner.
- Review the Dashboard in a monthly meeting.
⚠️ Common mistakes
- Filling every register on day one and never updating them. Start with three and keep them current.
- Logging risks without actions or owners.
🎬 Video walkthrough (script — recording coming soon)
- Scene 1: GRC Dashboard for Sharma Traders.
- Scene 2: Statutory Calendar with GST and TDS filings.
- Scene 3: Risks with owners Ravi and Mr. Sharma.
- Scene 4: Incident record for the godown leak.
- Scene 5: Business Continuity and Controls Testing.
- Scene 6: Registers Overview and My Plan.