What is a GRC assessment?

A GRC assessment is a structured evaluation of an organisation's governance, risk management, and compliance (GRC) practices against internationally recognised standards such as COSO, ISO 27001, and SOC 2. It produces a benchmarked GRC Score identifying strengths, control gaps, and priority improvement actions.

What is the GRC Index?

The GRC Index is an independent, nonprofit platform where UK and European organisations can assess, score, and publicly demonstrate their governance, risk, and compliance performance. Organisations that pass expert review receive a GRC Score and a public profile in the Index.

How does the GRC Index assessment work?

The process has three stages: (1) complete a standards-based questionnaire and submit supporting evidence; (2) undergo expert review and algorithmic scoring across five GRC domains; (3) receive a GRC Score, public Index listing, and prioritised improvement recommendations upon approval.

Is the GRC Index assessment free?

Yes. The initial GRC assessment at GRC Index is free to complete. After submitting your questionnaire and evidence, your responses are reviewed by GRC experts. Organisations meeting the benchmark standard receive a GRC Score and Index listing at no charge.

Who should complete a GRC assessment?

Any UK or European organisation wishing to demonstrate governance, risk, and compliance maturity to customers, regulators, or investors should complete a GRC assessment. It is particularly relevant for financial services, technology, professional services, and regulated industries.

How can my organisation improve its GRC score?

GRC Index provides personalised recommendations based on your assessment results covering governance, risk, compliance, resilience, and data security. For structured training, Securance offers CPD-certified courses in GRC Essentials, SOC 2, ISAE 3402, ISO 27001, and ISAE 3000.

What standards does GRC Index use to assess organisations?

GRC Index assessments are aligned to five internationally recognised frameworks: COSO (internal controls and ERM), ISO 27001 (information security management), SOC 2 AICPA Trust Services Criteria, ISAE 3402 (service organisation controls), and ISAE 3000 (assurance engagements).

GRCI — Know exactly where your GRC stands

GOVERNANCE, RISK AND COMPLIANCE

Know exactly where your GRC stands

Understand how governance, risk and compliance work together. Start with self-assessment, then explore the evidence behind organisational maturity.

Start your self-assessment See the index

1,100+

organisations
indexed

frameworks
covered

9 min

to first
score

Sources
Gartner Digital Markets Global Software Buying Trends Report 2025
ISO Survey 2024 — 96,709 valid ISO/IEC 27001 certificates worldwide

★GRC Index /Trust Maturity

From your starting score
to verified GRC trust

Verify your company data, then add points for certifications, qualified staff and training. Reach 95–100 through verified yearly training.

Starting GRC Score

95+ requires yearly training

Starting score Evidence-based scoring

STARTING SCORE

SCORE

How scoring works

10 to start. 45–55 after review. The verified score replaces the starting score.

+5 for additional certification types · +10 for qualified staff · +25 for completed training.

95–100 requires verified yearly training and the preceding requirements. It is a final score band, not an extra bonus. Other scores are capped at 94.

Benchmark your organisation →

Know exactly where your GRC stands

From your starting score
to verified GRC trust

Quick Links

Legal

sites

sites

Contact Us

Know exactly where your GRC stands

From your starting scoreto verified GRC trust

Quick Links

Legal

sites

sites

Contact Us

From your starting score
to verified GRC trust