GRC benchmarking gives organisations a structured way to measure their governance, risk, and compliance maturity against peers, regulatory expectations, and defined performance levels. For organisations operating in the UK and across the EU, it answers a question that boards and risk functions increasingly need to answer with evidence: not just whether controls exist, but how the programme compares, where the gaps are, and what those gaps mean in a tightening regulatory environment.
This article explains what GRC benchmarking involves, what the data tells us about where most organisations currently stand, and how to use a structured assessment to find your position across the six domains that matter most.
GRC benchmarking is the process of comparing your organisation's governance, risk, and compliance programme against a defined standard. That standard can be a maturity model, a sector norm, a regulatory expectation, or the performance of peer organisations facing similar risks and obligations.
Done well, benchmarking answers questions that internal reviews alone cannot. It tells you not just whether your controls are documented, but whether the level of maturity you have achieved is appropriate for your size, sector, and risk profile. It tells you where your programme is ahead of comparable organisations and where it is behind.
GRC benchmarking is distinct from a GRC audit. An audit tests compliance with a specific standard at a point in time. Benchmarking places your overall programme on a maturity scale across multiple domains and compares it to a reference point. The output is context, not just a pass or fail verdict.
DORA (Digital Operational Resilience Act) is in full enforcement for EU financial entities from January 2025
NIS2 fines are now active across the EU: up to 10 million euros or 2 percent of global turnover
UK Corporate Governance Code Provision 29 requires board declarations on material controls from January 2026
McKinsey 2025: average risk maturity across organisations stands at 2.6 out of 4.0
OCEG 2025: only 37 percent of organisations with a formal GRC strategy conduct regular maturity assessments; just 3 percent of those without one do
SureCloud UK Risk Reckoning 2025: 60 percent of UK organisations still rely on manual GRC workflows
A meaningful GRC benchmark does not treat governance, risk, and compliance as a single metric. It breaks the programme down into the domains that drive overall maturity. The GRC Index assessment measures performance across six domains, each scored independently to give an accurate picture of where the programme is strong and where it needs attention.
This domain covers the structures, accountabilities, and processes through which the board and senior leadership direct, monitor, and report on the organisation's GRC programme. It includes board-level engagement, committee structures, policy frameworks, escalation processes, and the quality of management information provided to decision-makers. Organisations that score well in this domain have clear ownership at the top, regular board-level review of risk and compliance, and a reporting structure that reflects genuine oversight rather than routine sign-off.
This domain assesses the maturity of the organisation's approach to identifying, assessing, treating, and monitoring risks. It covers the risk register, risk appetite framework, risk culture, and the extent to which risk management is embedded in strategic and operational decisions rather than sitting in a separate function. Organisations in the Defined band often have a documented risk framework; those reaching Managed or Optimised have integrated risk into how the business makes decisions day to day.
This domain measures how well the organisation identifies, tracks, and demonstrates compliance with its legal and regulatory obligations. For UK organisations, this includes UK GDPR, the FCA Senior Managers and Certification Regime, the UK Corporate Governance Code, and sector-specific requirements. For EU-based organisations and those with operations across the EU, it includes DORA, NIS2, EU GDPR, and the requirements of national regulators such as BaFin in Germany, the Dutch National Bank (DNB) in the Netherlands, and Finansinspektionen in Sweden.
This domain benchmarks the organisation's controls over information assets, cyber risk management, access management, incident response, and data protection. With NIS2 establishing minimum cyber security obligations across critical sectors throughout the EU, and DORA setting specific requirements for digital operational resilience in financial services, the bar in this domain has risen sharply in 2025 and 2026. Organisations that have not mapped their information security controls against NIS2 and DORA requirements are likely to find gaps in this benchmark.
This domain evaluates the organisation's ability to prevent, adapt to, and recover from disruptions to its critical business services. It covers business continuity planning, disaster recovery, third-party dependencies, and the testing regime applied to resilience scenarios. For financial services organisations in the EU, DORA has made operational resilience a hard regulatory requirement with specific obligations around ICT risk management, incident reporting, digital operational resilience testing, and oversight of critical third-party providers.
This domain measures the maturity of the organisation's approach to identifying, assessing, and managing risk introduced through suppliers, outsourced providers, and other third parties. For many organisations, third-party risk is the weakest domain in the benchmark. Both DORA and NIS2 include explicit provisions on supply chain security and critical third-party oversight, and the FCA's Operational Resilience rules require firms to map dependencies including third parties. A low score in this domain typically signals either insufficient due diligence at onboarding, weak ongoing monitoring, or both.
GRC maturity is measured across five levels, each with a defined score range and characteristic profile. Understanding which level your organisation occupies across each domain is the core output of a GRC benchmark.
Level 1 Ad Hoc (Score 0 to 24): Controls are reactive and largely undocumented. Risk and compliance activity depends on individuals rather than systems. No consistent monitoring.
Level 2 Reactive (Score 25 to 49): Issues are addressed after they arise rather than prevented. Some documentation exists but is not consistently applied. Limited board visibility.
Level 3 Defined (Score 50 to 69): Processes and controls are documented and understood. Inconsistent application across the organisation. Most organisations assessed fall in this band.
Level 4 Managed (Score 70 to 84): Controls are consistently applied and performance is tracked. Board receives structured GRC reporting. Evidence chain is maintained for key controls.
Level 5 Optimised (Score 85 to 100): Continuous improvement is embedded. GRC is integrated into strategic decisions. Control effectiveness is monitored in real time across all domains.
The McKinsey 2025 global GRC survey found average risk maturity at 2.6 out of 4.0 and compliance maturity at 2.9 out of 4.0 across respondents. Translating this to the five-level model, most organisations globally sit between Level 2 and Level 3, with compliance practice slightly ahead of risk management maturity.
The OCEG 2025 GRC Maturity Survey (856 professionals globally) found that organisations with a formal GRC strategy perform significantly better across all GRC disciplines. Among that group, 37 percent conduct regular GRC maturity assessments. Among organisations without a formal strategy, just 3 percent do. The presence of a strategy is, itself, one of the most reliable predictors of maturity.
The SureCloud Risk Reckoning 2025 UK survey found that 75 percent of UK organisations discuss GRC at board level. That is a meaningful indicator of awareness. However, 60 percent still rely on manual workflows, including spreadsheets and manually built dashboards, for GRC management. Nearly half of UK enterprise organisations report managing five or more major regulatory frameworks simultaneously. For many, that combination of high regulatory load and manual process creates the conditions for missed obligations and fragmented evidence.
Across the EU, the picture is shaped by the pace of regulatory change. DORA reached full enforcement for financial entities in January 2025, with requirements covering ICT risk management, digital resilience testing, incident reporting, and third-party oversight. NIS2 fines became active, with maximum penalties of up to 10 million euros or 2 percent of global turnover for essential and important entities. For organisations operating across multiple EU jurisdictions, managing country-level transposition differences between NIS2 implementations in Germany, the Netherlands, Sweden, and other member states adds further complexity to an already demanding compliance landscape.
Hyperproof's 2025 IT Risk and Compliance Benchmark Report found that organisations using integrated GRC tools were less likely to experience a data breach, with 41 percent of that group reporting a breach compared to higher rates among those relying on disconnected or manual systems. The gap between integrated and manual GRC programmes is not simply administrative. It has measurable consequences for security outcomes.
60% of UK organisations still use manual GRC workflows including spreadsheets (SureCloud, 2025)
49% of UK enterprise organisations manage five or more major regulatory frameworks simultaneously
75% of UK organisations discuss GRC at board level; nearly half do so in two-thirds of meetings
McKinsey 2025: average risk maturity 2.6/4.0 and compliance maturity 2.9/4.0 globally
DORA in full enforcement for EU financial entities from January 2025
NIS2 fines active across EU: up to 10 million euros or 2% of global annual turnover
OCEG 2025: only 3% of organisations without a formal GRC strategy conduct regular maturity assessments
Maturity levels vary significantly by sector, largely driven by regulatory pressure and the length of time a sector has been subject to structured oversight.
The GRC Index assessment measures your organisation's programme across all six domains and produces a single overall score (0 to 100), a maturity level (1 to 5), and a Red/Amber/Green rating for each domain. This structure gives boards and risk functions a precise picture of where the programme stands rather than a generalised view.
The value of the GRC Index score as a benchmarking tool is that it is consistent and domain-specific. It shows not just the overall level but which domains are dragging the score down and which are ahead of the programme's general maturity. For a board preparing its Provision 29 declaration, for example, the Governance and Oversight domain score provides a direct input to the board's assessment of whether its oversight of the control framework is adequate. For an organisation preparing for a DORA ICT audit, the Information Security and Operational Resilience domain scores show precisely where the gaps are.
Organisations that use the GRC Index assessment as an annual benchmark can track year-on-year improvement, demonstrate progress to regulators and auditors, and provide the board with a structured basis for the declarations and disclosures now required under both UK and EU governance codes.
A GRC benchmark is only useful if it is structured, evidence-based, and consistent enough to repeat. The following approach applies whether you are benchmarking for the first time or making benchmarking an annual discipline.
Identify which domains you are assessing and which regulatory frameworks are relevant to your organisation. For UK organisations this will include UK GDPR, the FCA SMCR, and the UK Corporate Governance Code as a minimum. For EU organisations or those with EU operations, add DORA, NIS2, and applicable country-level regulations. This scoping step determines what counts as a gap and what a good benchmark looks like for your context.
Work through each of the six GRC domains and assess your current state against the five maturity levels. Be specific about evidence: a control that exists in policy but is not consistently applied belongs in Level 2 or 3, not Level 4. The discipline of honest self-assessment is what distinguishes a benchmarking exercise from a box-ticking review.
Map each domain to a Red, Amber, or Green status based on the maturity assessment. Red indicates critical gaps requiring immediate action. Amber indicates areas performing below the expected level for your sector or regulatory context. Green indicates domains where the programme meets or exceeds the benchmark. This domain view gives the board a single-page risk picture without requiring it to work through detailed control inventories.
Place your scores in context. A Level 3 score (50 to 69) in Information Security is a different risk position for a bank under DORA than for a manufacturing company not currently in scope for DORA. The benchmark is most useful when it reflects what is expected in your specific regulatory and sector context, not just where the average organisation sits globally.
Use the benchmark output to create a prioritised action plan. P1 actions address Red domains with regulatory consequences or high likelihood of material impact. P2 actions address Amber domains that represent emerging risks or areas where the gap is likely to widen. Assign owners, timelines, and success metrics to each action so the next benchmark cycle can measure progress rather than just reassess the same gaps.
Can you state your organisation's GRC maturity level across each of the six domains?
Do you have a GRC score that is updated at least annually and reported to the board?
Which domain shows the largest gap between your current score and the expected level for your sector?
For financial services: have you mapped your Information Security and Operational Resilience domains against DORA requirements?
For all EU-facing organisations: have you assessed your Regulatory Compliance domain against NIS2 obligations?
If asked today, could you provide the board with a documented, evidence-backed assessment of your GRC programme maturity?
For organisations operating across UK and EU jurisdictions, GRC benchmarking needs to reflect the specific obligations in each market. UK-regulated organisations face Provision 29 of the UK Corporate Governance Code, which requires boards to declare material controls effectiveness from January 2026. EU-regulated organisations and those with significant EU operations face DORA, NIS2, and the ongoing requirements of EU GDPR.
These frameworks are not entirely separate. DORA, NIS2, and EU GDPR share common themes around risk management, incident reporting, third-party oversight, and board accountability. An organisation that has invested in a structured GRC programme across all six domains will find that its benchmark performance maps well to the requirements of multiple frameworks simultaneously, reducing the duplication of effort that comes from managing each regulation in isolation.
For organisations in Germany, the Netherlands, Sweden, and other EU member states, NIS2 transposition means national regulators are implementing their own specific requirements alongside the baseline directive. BaFin in Germany, DNB in the Netherlands, and Finansinspektionen in Sweden each apply their own supervisory expectations. A GRC benchmark that is calibrated to the regulatory context in each jurisdiction gives compliance and risk teams the clearest view of where cross-border gaps exist.
GRC benchmarking is the process of measuring your organisation's governance, risk, and compliance maturity against defined standards, peer organisations, or regulatory expectations. It identifies where your programme is performing well and where improvement is needed, across domains such as governance, risk management, regulatory compliance, information security, operational resilience, and third-party risk.
A GRC score of 70 or above indicates a Managed programme (Level 4), where controls are consistently applied and performance is tracked. Scores between 85 and 100 represent an Optimised programme (Level 5), where continuous improvement is embedded. Most organisations assessed fall in the Defined range (50 to 69), reflecting documented processes that are not yet consistently applied across the business.
A GRC audit tests compliance with a specific standard or set of controls at a point in time. GRC benchmarking compares overall programme maturity against peers, sector norms, or defined maturity levels across multiple domains. Benchmarking gives context: not just whether controls exist, but how the programme compares to organisations facing similar risks and regulatory obligations.
For UK organisations, GRC benchmarking typically covers UK GDPR, the FCA Senior Managers and Certification Regime, the UK Corporate Governance Code (including Provision 29), and sector-specific regulations. For EU organisations, it includes DORA, NIS2, EU GDPR, and the requirements of national regulators such as BaFin in Germany, the Dutch National Bank in the Netherlands, and Finansinspektionen in Sweden.
Most organisations benefit from a formal GRC benchmark at least annually, aligned with the board's annual review cycle and regulatory reporting obligations. Organisations facing significant regulatory change, such as DORA enforcement or Provision 29 preparation, may benefit from benchmarking more frequently to track progress against specific obligations.
GRC maturity spans five levels: Ad Hoc (Level 1, score 0 to 24), where controls are reactive and undocumented; Reactive (Level 2, 25 to 49), where issues are addressed after they occur; Defined (Level 3, 50 to 69), where processes are documented but inconsistently applied; Managed (Level 4, 70 to 84), where controls are consistently applied and tracked; and Optimised (Level 5, 85 to 100), where continuous improvement is embedded across all GRC domains.
© 2025 GRC Index. All rights reserved.