What is the primary objective of GRC in IT operations?

• A. Integrates governance, risk management, and compliance to align IT with business goals
• B. Focuses only on cost reduction
• C. Ignores regulatory requirements
• D. Replaces IT governance

Answer: (A)

GRC in IT operations aims to stitch together governance, risk management, and compliance so IT activities are directed, controlled, and monitored in a way that supports business objectives. Governance sets who makes decisions and how those decisions are enforced. Risk management identifies threats and vulnerabilities, evaluates their potential impact, and puts controls in place to reduce those risks. Compliance ensures IT processes meet applicable laws, regulations, and standards. When these elements are integrated, IT aligns with business goals, operates more reliably, and remains within regulatory boundaries. Focusing only on cost reduction misses governance and risk considerations, ignoring regulatory requirements defeats the purpose of compliance, and GRC does not replace IT governance but strengthens it by providing an integrated framework.