There is a widely spread misconception about the term SAP GRC (or also referred to as GRC, GRC 12, GRC 12.0). SAP’s portfolio consists of four key topics under the broader term of GRC - enterprise risk and compliance, identity and access governance, cybersecurity and data protection and privacy, and international trade management. Often people say “SAP GRC” but they mean “SAP Access Control” as it used to be one of the core applications in the GRC portfolio. However, it is important to understand that GRC is a portfolio of applications, and SAP Access Control as well as SAP IAG are two of many products belonging to the identity and access governance topic.