1 Foundations of Governance, Risk, Compliance, and Change

How the practices work together

Organizations pursue objectives while meeting obligations, responding to uncertainty, and adapting to change. Governance, risk management, compliance, and change management are connected practices that clarify who decides, what could affect results, which requirements apply, and how changes can be implemented responsibly.

Governance establishes direction, decision rights, oversight, and accountability. A governing body sets expectations and monitors whether management is pursuing objectives responsibly. Management translates that direction into plans and operations. Effective governance also supports reliable reporting and appropriate attention to stakeholder interests.

Risk management considers uncertainty that could affect objectives, including threats and opportunities. It should inform strategy and day-to-day decisions rather than operate only as a separate reporting exercise. Compliance translates applicable obligations into practical responsibilities and safeguards. A compliance management system helps identify obligations, assign responsibilities, communicate expectations, monitor performance, address problems, and improve.

Change management guides the transition from current ways of working to intended future ones. It covers both the design and control of change and support for the people affected. Change may be driven by internal priorities or external forces, including customers, markets, and technology.

These practices reinforce one another: governance sets objectives and oversight; risk assessment identifies uncertainty affecting those objectives; compliance translates obligations into practical safeguards; and change management helps implement adjustments while keeping responsibilities and controls effective.

Accountability and assurance

Accountability works best when responsibilities are explicit. The roles below are complementary, should coordinate, and do not remove the need for individual accountability. Their precise arrangement depends on the organization.

1. Governing body: Sets or approves direction, oversees significant risks and compliance, and holds management accountable.

2. Management and operational teams: Carry out the work, manage risks in daily operations, and operate relevant controls.

3. Risk, compliance, and other specialist functions: Provide expertise, support, monitoring, and constructive challenge to operational teams.

4. Internal audit: Where present, provides independent, objective assurance and advice about governance, risk management, and controls. It should not take over management’s responsibility for running the organization.

The Three Lines Model emphasizes collaboration and clear accountability while preserving internal audit’s objectivity. The roles are not isolated departments, nor are they a substitute for individual accountability.

External factors and organizational change

Conditions beyond an organization’s control can change both its opportunities and its obligations. Relevant external factors may include new or changing laws, economic conditions, customer expectations, competitors, technologies, suppliers, social expectations, and environmental conditions.

Assessing these factors helps leaders update objectives, risk assessments, compliance processes, and plans for change. Board oversight should remain appropriate as the organization’s markets, strategy, size, and regulatory requirements change.

A disciplined change process

A disciplined change process commonly moves through these steps:

1. Define the objective and rationale. Identify what the organization seeks to improve and how success will be measured.

2. Assess impacts and risks. Consider affected processes, people, systems, suppliers, customers, information, controls, and compliance obligations.

3. Approve and assign ownership. Set decision authority, responsibilities, resources, safeguards, and escalation routes in proportion to the change.

4. Implement and support adoption. Communicate what is changing and why, and provide training, guidance, and support so people can work effectively under the new arrangements.

5. Monitor and improve. Check whether the change achieved its objectives, whether controls and compliance remain effective, and whether further action is needed.

Applying the practices to a payroll change

Suppose an organization plans to move payroll to a cloud-based provider because of cost, service quality, or technology. Governance determines who can approve the change and what outcomes matter. Risk assessment considers service disruption, access to employee information, vendor dependence, and data security.

Compliance specialists identify applicable privacy, employment, tax, and recordkeeping obligations for the organization’s jurisdictions. Management evaluates the vendor, assigns owners, tests the new process, and arranges training. After launch, responsible teams monitor payroll accuracy and access controls; internal audit may independently assess whether governance and controls are working as intended.

The example illustrates why these practices need to be linked: a technically successful implementation can still fail if it breaches obligations, interrupts operations, or leaves employees unable to use the new process.

Putting the practices into action

Governance provides direction and accountability. Risk management helps decision-makers understand uncertainty in relation to objectives. Compliance turns applicable obligations into responsibilities and controls. Change management helps the organization adapt while maintaining effective oversight and operations.

When these practices share information, clearly assign ownership, and respond to external conditions, they support more reliable decisions and organizational performance.