Which management is core to governance and compliance?

Risk management is fundamental to both governance and compliance. According to ISO 31000, risk management is an integral part of governance and leadership, as it provides a structured approach for decision-making in the face of uncertainty. Effective governance relies on understanding and managing risks to achieve organizational objectives. Similarly, compliance involves adhering to legal, regulatory, and internal obligations. Managing the risk of non-compliance is a critical component of any compliance program. Therefore, risk management serves as the core discipline that enables and integrates effective governance and compliance frameworks within an organization.

B. Crisis: Crisis management is a reactive discipline focused on responding to major disruptive events, not the proactive, ongoing process that underpins all governance.

C. Quality: Quality management is a specific domain focused on meeting product or service standards, whereas risk management applies broadly to all organizational objectives.

D. Fillet: This term is not a recognized management discipline in the context of governance or compliance and is an irrelevant distractor.

1. ISO 31000:2018, Risk management — Guidelines.

Clause 4, Principles, (a) Integrated: "Risk management is part of governance and leadership, and is fundamental to how the organization is managed at all levels. It contributes to the integration of management systems." This directly states that risk management is a core part of governance.

2. Racz, N., Weippl, E., & Seufert, A. (2010). A frame of reference for research of integrated governance, risk & compliance (GRC). In Proceedings of the 43rd Hawaii International Conference on System Sciences.

Page 1: The paper explicitly states, "Risk management is the central element of GRC [Governance, Risk & Compliance] and connects the more business-driven 'governance' component and the more technically-oriented 'compliance' component." (DOI: 10.1109/HICSS.2010.353)

3. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal, 30(6), 881-886.

Page 882: The article emphasizes that a key message of ISO 31000 is that "risk management should be integrated into an organization’s governance system" and is not a stand-alone activity, reinforcing its core role. (DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x)