{"id":7491,"date":"2026-10-21T10:32:16","date_gmt":"2026-10-21T03:32:16","guid":{"rendered":"https:\/\/audithink.com\/?p=7491"},"modified":"2026-10-21T13:13:16","modified_gmt":"2026-10-21T06:13:16","slug":"grc-in-universities","status":"publish","type":"post","link":"https:\/\/audithink.com\/en\/blog\/grc-perguruan-tinggi\/","title":{"rendered":"GRC in Universities: Connecting Governance, Risk, and Compliance"},"content":{"rendered":"
\"GRC<\/figure>\n\n\n\n

Photo by Vitaly Gariev on Unsplash<\/p>\n\n\n\n

On a campus, governance lives in the statute and organ meetings, risk lives in the register of the risk management unit, compliance sits with quality assurance and the legal bureau, and oversight sits with the SPI. Each works with its own reports, schedules, and terms. As a result, leadership struggles to see the whole picture: which risks are not yet controlled, which rules are not yet met, and who is responsible.<\/p>\n\n\n\n

The GRC approach (governance, risk, and compliance<\/em>) is meant to bring the three together. This article covers what GRC means for universities, how its three pillars appear in regulations and campus practice, who holds which role, and how to start. References were checked as of October 21, 2026.<\/p>\n\n\n\n

What Is GRC and Why Is It Relevant for Universities?<\/h2>\n\n\n\n

GRC is an approach that manages governance (governance<\/em>), risk management (risk<\/em>), and compliance (compliance<\/em>) in an integrated way, rather than as three separate matters. Its general definition is discussed in the article what is GRC<\/a>.<\/p>\n\n\n\n

The abbreviation is sometimes read differently. The title of the page for the IIA Indonesia webinar in May 2024 on implementing governance, risk and control in universities<\/a> uses the letter C for control<\/em>. Both readings stress the same thing: governance, risk, and control or compliance need to be seen as one system.<\/p>\n\n\n\n

Note that the term GRC does not appear in Law 12\/2012, Government Regulation 4\/2014, Government Regulation 60\/2008, Ministerial Regulation 39\/2025, or the BAN-PT IAPT 4.1 accreditation instrument referenced in this article. GRC is an approach from professional practice, while its elements exist in those regulations under other terms.<\/p>\n\n\n\n

How Do the Three GRC Pillars Appear in Regulations and Campus Practice?<\/h2>\n\n\n\n
Pillar<\/th>Form on campus<\/th>Reference<\/th><\/tr><\/thead>
Governance<\/td>The statute, organs that check and balance one another, and the principles of accountability and transparency<\/td>Government Regulation 4\/2014 Article 29 paragraph (9); Ministerial Regulation 39\/2025 Article 67 paragraph (2)<\/td><\/tr>
Risks<\/td>Monitoring of potential risks in the oversight and control of education activities, and risk assessment as an element of internal control<\/td>Ministerial Regulation 39\/2025 Article 34 paragraph (2) letter b; Government Regulation 60\/2008 Article 3 paragraph (1) letter b (government agencies)<\/td><\/tr>
Compliance and control<\/td>Compliance with higher education standards through the SPMI cycle, compliance with academic ethics, and handling of complaints about violations<\/td>Ministerial Regulation 39\/2025 Article 34 paragraph (2) letters c and d, Articles 65 to 68<\/td><\/tr>
External assessment<\/td>Accreditation that assesses governance, including good university governance practice and risk management<\/td>BAN-PT IAPT 4.1, Accountability criterion<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Government Regulation 60\/2008 applies to government agencies and names five elements of the internal control system: control environment, risk assessment, control activities, information and communication, and monitoring of internal control. Their implementation is integrated into and forms an integral part of the agency's activities (Article 3). For campuses that are government agencies or BLU, these elements are an entry point for connecting governance, risk, and compliance.<\/p>\n\n\n\n

Each pillar is discussed in the articles good university governance<\/a> and university risk management<\/a>. The relationship between SPMI and the SPI is discussed in the article differences between the SPI and the SPMI<\/a>.<\/p>\n\n\n\n

What Does One Campus Process Look Like Through a GRC Lens?<\/h2>\n\n\n\n

The table below is an illustration, not a standard list. The same process is viewed from three sides at once:<\/p>\n\n\n\n

Seamless and Improved<\/th>Governance<\/th>Risks<\/th>Compliance<\/th><\/tr><\/thead>
Management of research funds<\/td>Clear approval authority and division of duties<\/td>Funds used contrary to the contract, late reports<\/td>Grantor requirements and the financial rules in force<\/td><\/tr>
Procurement of goods and services<\/td>Procurement policy and delegation of authority<\/td>Unreasonable prices, conflicts of interest<\/td>Procurement regulations that apply to the campus<\/td><\/tr>
Academic system and student data<\/td>Data ownership and access policy<\/td>Unauthorized access, altered grades, data leaks<\/td>Personal data protection obligations and academic ethics<\/td><\/tr>
Complaint handling<\/td>Reporting channels and whistleblower protection<\/td>Reports not followed up<\/td>Obligation to process complaints about ethical and regulatory violations (Ministerial Regulation 39\/2025 Article 34 paragraph (2) letter d)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

With one process viewed from three sides, leadership's questions become easier to answer: what is the risk, which rules bind it, and who makes sure both are working. Examples of audits for those processes are in the articles procurement audit<\/a>, research grant fund audit<\/a>, and SIAKAD security audit<\/a>, while the complaint channel is in the article university whistleblowing system<\/a>.<\/p>\n\n\n\t\t

\n\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"cta\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\n\n\n\n

Who Holds the GRC Roles on Campus?<\/h2>\n\n\n\n

The IIA's Three Lines Model helps map roles without having to create new units. It is discussed in full in the article Three Lines Model<\/a>. An example mapping for a campus:<\/p>\n\n\n\n

Roles<\/th>Example role holders<\/th>Link to GRC<\/th><\/tr><\/thead>
Oversight body or board<\/td>Board of trustees, audit committee, or supervisory board, depending on the type of campus<\/td>Sets direction and oversees governance<\/td><\/tr>
First line<\/td>Faculties, bureaus, research managers, procurement units<\/td>Owns risk and carries out day-to-day controls<\/td><\/tr>
Second line<\/td>Risk management units, quality assurance, legal and compliance, information technology security<\/td>Designs the framework, monitors, and challenges the first line<\/td><\/tr>
Third line<\/td>SPI<\/td>Provides independent assurance over governance, risk management, and control<\/td><\/tr>
External assurance providers<\/td>BPK, external auditors, accreditation bodies<\/td>Provides additional assurance from outside the campus<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

As of October 21, 2026, the IIA has not issued GRC or governance guidance specific to universities. The mapping above is an application of the general model, and the final arrangement follows each campus's statute and structure. Coordination among these parties is discussed in the article SPI coordination with the audit committee, board of trustees, inspectorate, and BPK<\/a>.<\/p>\n\n\n\n

What Is the SPI's Role in GRC?<\/h2>\n\n\n\n

The GIAS 2024 states that internal auditing strengthens an organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight. One of the things it enhances is governance, risk management, and control processes. So the SPI does not own GRC, but is the party that assesses whether GRC works.<\/p>\n\n\n\n

Standard 9.1 asks the chief audit executive to understand the organization's governance, risk management, and control processes before developing the audit strategy and plan. For governance, the standard mentions matters such as how the organization sets strategic objectives, oversees risk and control, promotes an ethical culture, and coordinates the board, assurance providers, and management. For risk and control, the standard names compliance with laws and regulations as one of the key risk areas.<\/p>\n\n\n\n

There are limits to keep. If the SPI helps design or run the risk management or compliance function, its objectivity is impaired when examining that function. At a BLU, Article 263 of Minister of Finance Regulation 129\/PMK.05\/2020 prohibits SPI auditors from holding concurrent BLU operational duties, except in the compliance and risk management functions. That exception does not remove the need for independence safeguards, as discussed in the article SPI internal audit charter<\/a>. An overview of the SPI's role in general is in the article University SPI<\/a>.<\/p>\n\n\n\n

How Do You Start Integrated GRC on Campus?<\/h2>\n\n\n\n
    \n
  1. Map who manages what.<\/strong> List the units that hold governance, risk, compliance, and oversight, along with the reports they already produce.<\/li>\n\n\n\n
  2. Choose one or two priority processes.<\/strong> Start with high-risk processes, such as research funds or procurement, not the whole campus at once.<\/li>\n\n\n\n
  3. Bring together the risk and obligation registers.<\/strong> Link each risk to the controls and rules that bind it, so each process has one record.<\/li>\n\n\n\n
  4. Set the division of roles.<\/strong> Write down who owns the risk, who monitors, and who provides independent assurance.<\/li>\n\n\n\n
  5. Align schedules.<\/strong> Combine the calendars of quality audits, SPI audits, and external examinations so units are not examined at the same time. The approach is similar to combined assurance<\/a>.<\/li>\n\n\n\n
  6. Report in an integrated way.<\/strong> Give leadership and the oversight body a picture of risk, compliance, and follow-up in a single report.<\/li>\n\n\n\n
  7. Measure maturity regularly.<\/strong> Assess progress using references such as those in the article GRC maturity levels<\/a>, then improve step by step.<\/li>\n<\/ol>\n\n\n\n

    The challenges of unifying programs and choosing frameworks are discussed further in the articles integrating GRC programs<\/a> and integrated risk management<\/a>.<\/p>\n\n\n\n

    What Are Common Mistakes in Applying GRC on Campus?<\/h2>\n\n\n\n