Core Idea
GRC as plumbing treats assurance as infrastructure that should quietly move signals, ownership, evidence, and decisions through the organisation. Good plumbing is not admired every day. It is noticed when pressure drops, water leaks, pipes cross incorrectly, or waste flows backwards. GRC has similar failure modes: blocked evidence, stale owners, duplicated requests, and invisible leaks in accountability.
A concrete example is evidence moving from identity, ticketing, and cloud systems into assurance views without asking engineers to refill spreadsheets. The learner should look for blocked pipes, duplicate pipes, and pressure changes before adding decorative dashboards. during a review session.
Use In Teaching
Invoke this card when learners are designing behind-the-scenes workflows, data flows, intake, escalations, or control monitoring. It helps them value boring reliability over performative dashboards.
Use it to teach the value of quiet reliability. The learner should map how assurance material moves through the organisation and look for leaks, blockages, duplicate pipes, and manual buckets. The best outcome is often a boring flow that nobody notices because it works.
A reviewer should check that GRC as Plumbing transfers structure, not decoration. The learner should be able to map the metaphor back to a real GRC artefact, owner, signal, or decision, then name where the analogy stops being useful.
Contrast
This is not saying GRC should be invisible to the business. It pushes back against ornamental GRC. Plumbing is valuable because it makes the visible rooms usable.
Practice Prompt
Where is your GRC plumbing leaking: source data, ownership, routing, evidence, escalation, or review?