About The GRC Journal

The GRC Journal is an independent publication examining governance, risk, compliance, and security: the systems, decisions, incentives, and institutional conditions that shape whether organizations actually manage risk well, or only appear to.

We study people as much as policy. Most failures in governance, risk, and compliance are not failures of technology. They are failures of design, incentive, and behavior, the gap between the rules an organization writes and the way people actually work under pressure. That gap is where this Journal spends most of its attention.

What we publish

Features that make an argument, not just explain a topic. Cases that reconstruct real incidents and governance failures without reducing them to blame. In time, original research and recorded conversations with practitioners and researchers whose reasoning is worth hearing.

What we are not

We are not a vendor press-release feed, a generic cybersecurity news digest, or a content-marketing operation disguised as a publication. Commercial affiliation is disclosed and never substitutes for an argument.

Why this exists

Governance, risk, and compliance are usually treated as purely technical problems: frameworks, controls, checklists. In practice, most failures come down to incentives, institutional pressure, and the way people behave under them. The Journal exists to take that seriously, and to write about it with the same rigor other fields reserve for finance or policy, rather than treating it as a compliance afterthought.

Who writes this

The GRC Journal is edited by Joshua Clarke, whose work sits at the intersection of governance, organizational behavior, cybersecurity, and decision-making.

He is also the founder of Calvyan, where his work examines how organizational conditions shape security risk and the decisions people make around it.

His background in business, organizations, and psychology informs the Journal's central interest: looking beyond policies and controls to understand how governance works in practice.

The Journal also publishes perspectives from practitioners, researchers, and leaders with direct experience of the subjects they examine.

How we work

Every claim is sourced. Each entry in the Tracker links to a primary source (a regulator's filing, a court document, a company's own disclosure) or, where no primary source is public, a named and dated report from an outlet with its own editorial standards.

Corrections are public. When something here is wrong, it's fixed in the open, with a note describing what changed and when, not edited away quietly.

Commercial ties are disclosed. If a person, company, or product mentioned here has a financial relationship with the Journal, it's stated plainly, and it never substitutes for an argument.

Analysis is labeled as analysis. Where a piece argues a position, it's presented as an argument, not dressed up as neutral reporting.