A GRC audit is an assessment of an organisation’s GRC program, however, it is not a formal audit. Internal audits can be carried out on a regular basis to review and improve GRC. An external annual audit by a third-party auditor assesses reports generated from security and compliance systems that support GRC.