GRC: The CS Subject Closest to Real Practice
Governance, Risk and Compliance is one of the most practically relevant subjects in the CS Professional programme — and one of the most dynamic, since the regulatory environment it covers evolves with every corporate governance reform and new SEBI circular. Understanding GRC is not just about passing the CS Professional exam; it is about developing the core competency that defines the Company Secretary's role in modern Indian corporations.
The subject covers three integrated domains: Corporate Governance (how companies should be governed), Risk Management (how companies identify and manage risk), and Compliance Management (how companies ensure adherence to the legal and regulatory framework). These three domains are interlinked — governance frameworks define risk appetite, risk frameworks drive compliance requirements, and compliance reporting validates governance effectiveness.
Syllabus Structure
| Module | Key Content | Weight |
|---|---|---|
| Corporate Governance | Theories (Agency, Stewardship, Stakeholder), governance codes (Clause 49 evolution → LODR), board effectiveness, independent directors, board committees, corporate governance report | 28–32% |
| Board Processes & Effectiveness | Board evaluation frameworks, director onboarding, succession planning, related party transaction oversight, board information systems | 15–18% |
| Risk Management | Risk framework (COSO ERM), risk categories (strategic, operational, financial, compliance), risk register, risk appetite and tolerance, risk response strategies (avoid/transfer/mitigate/accept) | 22–26% |
| Compliance Management | Compliance framework design, compliance calendar, secretarial audit (MR-3), Secretarial Standards, Business Responsibility and Sustainability Reporting (BRSR), compliance officer role | 20–25% |
| Contemporary Issues | ESG (Environmental, Social, Governance) integration, whistleblower policy, vigil mechanism, BRSR framework under SEBI | 8–10% |
Corporate Governance: The Theoretical Foundation
GRC questions often begin with the theoretical context. The three dominant governance theories:
- Agency Theory: Separation of ownership and control creates an agency problem — managers (agents) may pursue their own interests rather than shareholders' (principals'). Governance mechanisms (board oversight, audit committees, independent directors, executive compensation tied to performance) are solutions to the agency problem
- Stewardship Theory: Counter to agency theory — managers are stewards who identify their interests with organisational success. Suggests centralised power (executive chairman) may be appropriate when managers are genuinely steward-oriented
- Stakeholder Theory: The company has obligations to all stakeholders — employees, customers, suppliers, community, environment — not just shareholders. Drives the modern ESG framework and BRSR requirements
COSO ERM Framework: The Risk Management Foundation
The COSO (Committee of Sponsoring Organizations) Enterprise Risk Management framework is the dominant risk management framework referenced in CS Professional GRC. The 2017 updated COSO ERM framework has five components: Governance & Culture, Strategy & Objective-Setting, Performance (identifying and assessing risks), Review & Revision, and Information/Communication/Reporting. The Risk Register — the practical tool implementing the framework — lists each identified risk, its probability, impact, inherent risk rating, controls in place, residual risk, and risk owner.
BRSR: The Newest High-Yield Topic
The Business Responsibility and Sustainability Report (BRSR) was mandated by SEBI for the top 1,000 listed companies (by market cap) from FY 2022-23. It replaces the earlier Business Responsibility Report (BRR) and aligns India's disclosure framework with the UN Sustainable Development Goals and GRI Standards. BRSR has three sections: General Disclosures, Management and Process Disclosures, and Principle-wise Performance Disclosures — covering all nine principles of the National Guidelines on Responsible Business Conduct (NGRBC). This is a near-certain exam topic given its recent introduction and significance for Company Secretaries.
💡 GRC is a subject where staying current matters. SEBI circulars, Companies Act amendments, and new governance requirements are constantly evolving — and they appear in CS Professional exams. The e-mentor test series for CS Professional is updated to include the most recent regulatory developments, ensuring you are tested on what will actually appear in your exam. Stay current at e-mentor.xyz.
Answer Writing for GRC: The Applied Approach
GRC exam questions are almost entirely application-based. A typical question: "XYZ Limited, a listed company, has recently received investor complaints about the independence of its audit committee. As Company Secretary, what governance improvements would you recommend, and what SEBI LODR requirements must the company ensure compliance with?" These questions reward students who can identify the specific regulatory requirements (SEBI LODR audit committee composition — minimum 2/3 independent directors, all financially literate, at least one with financial management expertise), relate them to the company's situation, and provide concrete actionable recommendations. Pure theory answers without regulatory citation and specific recommendations score well below their mark allocation.