Integrated GRC Operating Model and Assurance Leadership Training Course

Programme Summary

Integrated GRC operating model and assurance leadership is a five-day training course for senior leaders working at strategic level, culminating in an integrated GRC roadmap for their own organisation. Many organisations run governance, risk, compliance and audit as separate silos, leaving boards with fragmented assurance. The programme joins these disciplines into one operating model with a common language and coordinated assurance. Mars Training Centre UK delivers this programme in integrated GRC leadership.

The Business Case

Duplicated controls testing, overlapping reports and unclear ownership raise the cost of oversight while leaving gaps that surface only after a failure. Leaders who can design an integrated model reduce assurance fatigue, sharpen decisions on risk-taking and give the governing body confidence that its oversight works.

• Cost of Assurance and Control Testing: Falls as overlapping reviews are mapped and coordinated across the three lines.
• Time to Detect and Resolve Compliance Issues: Shortens through a shared obligation register, issue workflow and escalation route.
• Board Confidence in Risk Oversight: Rises when reporting links risk appetite, compliance status and assurance results in one view.

Principles and Evidence Base

• OCEG GRC Capability Model 3.5: Provides the principled performance philosophy used in Sessions 1 and 5 to diagnose and design the GRC system.
• IIA Three Lines Model: Frames the roles of the governing body, management and internal audit used in Session 4 to build an assurance map.
• ISO 31000 Risk Management Guidelines: Supplies the principles and process used in Session 2 to link risk appetite with strategic objectives.
• ISO 37301:2021 Compliance Management Systems: Structures the obligation management and compliance culture work in Session 3.

Intended Participants

• Executives who set or approve the risk appetite and oversight arrangements of their organisation.
• Leaders accountable for the risk, compliance, legal or internal audit function.
• Senior officials responsible for the governance and control environment of public bodies.
• Directors who sit on audit, risk or governance committees.

The programme serves banking and financial services, energy and utilities, government and public sector entities, and listed corporate groups.

Learning Outcomes

1. Participants will be able to diagnose fragmentation between governance, risk, compliance and audit activities in their organisation.
2. Participants will be able to construct a risk appetite framework that links strategic objectives to measurable tolerances.
3. Participants will be able to design an obligation management process aligned to a compliance management system.
4. Participants will be able to build a combined assurance map that clarifies the roles of each of the three lines.
5. Participants will be able to evaluate GRC technology options against data, workflow and reporting needs.
6. Participants will be able to justify a phased integrated GRC roadmap to a board or executive committee.

Programme Structure

Day 1: Integrated GRC and Principled Performance

Why do siloed oversight functions fail, and what does an integrated GRC model look like?

• Principled Performance: Objectives, Uncertainty and Integrity
• OCEG GRC Capability Model Components
• Governance Structures, Charters and Committee Mandates
• Common Risk, Control and Obligation Taxonomy
• GRC Fragmentation Diagnostic for the Participant Organisation

Day 2: Risk Appetite and Strategic Risk Integration

How is risk-taking anchored to strategy and expressed in measurable limits?

• ISO 31000 Principles, Framework and Process
• Risk Appetite Statements and Tolerance Metrics
• Key Risk Indicators and Escalation Thresholds
• Linking Risk Registers to Strategic Objectives
• Emerging Risk and Scenario Horizon Scanning

Day 3: Compliance Management Systems and Obligations

How are regulatory and voluntary obligations identified, owned and monitored?

• ISO 37301:2021 Structure and Requirements
• Obligation Register and Regulatory Change Management
• Compliance Risk Assessment and Control Mapping
• Compliance Culture, Conduct and Speak-Up Channels
• Compliance Monitoring Plans and Breach Handling

Day 4: Three Lines Model and Combined Assurance

How do the three lines coordinate so that assurance is complete without duplication?

• IIA Three Lines Model Roles and Principles
• Combined Assurance Mapping Techniques
• Integrated Control Library and Testing Calendar
• Internal Audit Independence and Reliance on Other Assurers
• Issue Management and Remediation Tracking

Day 5: Applying the Integrated GRC Roadmap

How are the elements combined into a phased programme of change with board reporting?

• GRC Technology Selection, Data Model and Workflow
• Integrated Board Reporting Dashboard Built from Sessions 2 to 4
• GRC Maturity Assessment Using the Session 1 Diagnostic
• Phasing, Ownership and Change Management for Integration
• Integrated GRC Roadmap Presentation to a Mock Board

Methodology

The programme relies on case analysis of financial services, energy and public sector organisations that consolidated their oversight functions. Participants apply diagnostics to their own organisation and test proposals with peers acting as an audit committee.

• Suggested activity: Drafting a risk appetite statement with three tolerance metrics for a case company.
• Suggested activity: Mapping assurance from all three lines over one high-risk process.
• Suggested activity: Comparing two GRC technology options against a shared requirements list.

Capstone Output

Each participant completes an integrated GRC roadmap for their organisation. It contains a fragmentation diagnosis, a risk appetite outline, an obligation management design, a combined assurance map, a board reporting format and a phased implementation plan, ready for an executive committee or board.

Frequently Asked Questions

Is the integrated GRC programme suitable for leaders new to risk and compliance?

It is designed for senior leaders at strategic level. It assumes familiarity with risk registers, compliance obligations or audit reports.

Which standards does the integrated GRC operating model draw on?

It draws on the OCEG GRC Capability Model, the IIA Three Lines Model, ISO 31000 for risk management and ISO 37301:2021 for compliance management systems.

How is the integrated GRC roadmap used back at work?

You can table it at an executive or board meeting as a proposal for phased integration. Its assurance map and reporting format also serve as working tools for the leads who implement it.