Governance, Risk, and Compliance exists in two forms in Australian organisations. The first is a living framework — actively maintained, externally validated, genuinely embedded in how decisions are made and how risk is managed. The second is a document. A policy written two years ago, a framework diagram on an intranet page, a checklist completed at audit time and filed until next year. Most Australian organisations have the second. Most believe they have the first.
The gap between those two things is where incidents happen. It is where regulators find their cases. It is where insurers decline claims. And it is almost always invisible to the organisation until something forces it into the open.
The Distinction That Matters
- GRC as a document provides the appearance of compliance. GRC as a posture provides actual protection.
- The OAIC, ACSC, and ASIC have all increased enforcement activity against organisations whose GRC frameworks existed on paper but not in practice
- Cyber insurers are declining claims at higher rates where organisations cannot demonstrate that documented controls were actually implemented
- Self-assessed GRC maturity consistently overstates actual maturity when independently tested — the gap is typically one to two maturity levels
- The 2024 Privacy Act amendments and the Essential Eight 2023 updates have created new obligations that most existing GRC frameworks do not address
Why Tick-Box GRC Fails When It Matters Most
The appeal of tick-box GRC is understandable. Compliance frameworks are complex, the language is technical, and the practical demands on smaller teams are significant. A checklist that can be completed once a year and filed satisfies the immediate pressure of an audit or a client questionnaire. The problem is that it satisfies nothing else.
When a breach occurs, the questions asked are not "did you have a policy?" They are "was the policy current?", "was it implemented?", "was it tested?", and "who was responsible for it?" An organisation that can answer yes to the first question and no to the remaining three is in a significantly worse position than one that had no policy at all — because the existence of the policy demonstrates awareness of the obligation. The inability to demonstrate implementation demonstrates that the awareness was not acted on.
The Australian Signals Directorate's research on the Essential Eight consistently finds that organisations self-assessing at Maturity Level 2 are independently assessed at Maturity Level 0 or 1 at rates that would surprise most Boards. Source: ASD Essential Eight Maturity Model, 2023 update. The same pattern applies to privacy compliance, incident response readiness, and access control. Intention and implementation are not the same thing, and the gap between them is typically wider than leadership believes.
The 10-Question GRC Reality Check
The assessment below is not a comprehensive GRC audit. It is a structured set of questions designed to surface the specific gaps that most commonly exist between documented GRC and actual GRC. Answer honestly. The result will tell you more about your real exposure than most annual compliance reviews.
What Genuine GRC Looks Like in Practice
Genuine GRC has three characteristics that distinguish it from the tick-box version. First, it is current. Every policy, every framework, every documented control reflects what the organisation is actually doing right now — not what it was doing when the document was written. Second, it is evidenced. For every claimed control, there is documentation, testing records, or observable implementation that can be shown to a regulator, an insurer, or a procurement team. Third, it is externally validated. Someone outside the team responsible for implementation has confirmed that the controls work as described.
Most Australian organisations have none of these three characteristics across their full GRC framework. Many have one. Few have all three. The organisations that do are in a fundamentally different position when scrutiny arrives — and in the current Australian regulatory environment, scrutiny is arriving more frequently and with more consequence than it has at any previous point.
The Internal Cyber Team Problem
Having an internal cyber security function is a genuine asset. It creates ongoing operational security capability, faster incident response, and day-to-day risk management that external advisors cannot replicate. What an internal team cannot do is provide an independent external view of the organisation's own posture. Internal teams assess from the inside out. They know what was built, know what was intended, and are subject to the same blind spots as the rest of the organisation. An external passive assessment of what the organisation looks like from the outside — what a threat actor, a regulator, or a competitor can see — is a different exercise entirely, and one that internal teams are structurally unable to perform on themselves.
This is not a criticism of internal cyber capability. It is a structural reality. The most sophisticated internal security functions in Australian enterprise still commission external assessments, because the value of an external perspective is not in question. For smaller organisations without enterprise-level internal capability, the case is even stronger.