By Jonas Osman AbdelfourPublished February 4, 2026Last reviewed July 1, 2026
Summary Most GRC failures are structural rather than technical. Frameworks fail when governance, risk and compliance evolve in parallel, each with its own taxonomy, reporting cycle and tooling. This article sets out a design pattern that treats GRC as one operating system for regulated decision-making.
Why fragmentation persists Governance, risk and compliance functions historically developed in response to different pressures: the board's fiduciary duties, prudential supervision, and conduct regulation respectively. Each produced its own artefacts — committee charters, risk taxonomies, obligations registers — and its own second line.
The design pattern The integrated framework rests on four anchors:
- A single risk taxonomy shared across risk, compliance and internal audit
- A risk appetite expressed in metrics that can be breached
- A three-lines model with explicit ownership at process level
- A reporting architecture that starts from decisions the board needs to make
Taxonomy The taxonomy must reconcile prudential risk categories (credit, market, liquidity, operational) with compliance and conduct risk categories, without double-counting.
Appetite Appetite statements should cascade to limits at the level at which they can be operated. A statement the business cannot breach is a slogan.
Three lines Ownership should be assigned at process level. RCSAs and control testing then have a defined counterparty.
Reporting Reporting is redesigned last, starting from decisions rather than from data availability.
Limitations Framework design is only as effective as the data quality that underpins it. Where data lineage is weak, the framework should acknowledge it explicitly and identify remediation.
Practical example A mid-size bank reduced its committee reporting from four disconnected packs to one, structured around appetite breaches, forward indicators and open issues. Committee time shifted from information-gathering to decisions.
Related expertise See [Governance, Risk and Compliance](/expertise/grc) and [Enterprise Risk Management](/expertise/enterprise-risk).
Frequently asked questions
Why fragmentation persists?
Governance, risk and compliance functions historically developed in response to different pressures: the board's fiduciary duties, prudential supervision, and conduct regulation respectively. Each produced its own artefacts — committee charters, risk taxonomies, obligations registers — and its own second line.
What should risk leaders know about the design pattern?
The integrated framework rests on four anchors: