What is a GRC tool?

• A. Auditing, reporting, monitoring and assessment
• B. It allows publicly held companies to integrate and manage IT operations that are subject to regulation
• C. It helps bring order to enterprises' crazy quilt of overlapping regulations, redundant audit programs and manual processes.
• D. It provides a cloud-based file storage service.

Answer: (A)

GRC tools centralize Governance, Risk, and Compliance activities, providing capabilities to audit, report, monitor, and assess controls and regulatory requirements. Auditing tracks what was done to verify adherence to policies; reporting communicates findings to stakeholders; monitoring continuously watches control effectiveness and emerging risks; and assessment evaluates overall risk posture and whether controls are adequate. This combination—auditing, reporting, monitoring, and assessment—captures the essential functions of a GRC tool, making it the best fit for defining what such a tool does. The other descriptions describe related ideas or benefits (like IT operations under regulation, broad outcomes of organizing regulations and audits, or an unrelated cloud storage service) rather than the tool’s core functions.