Edition 1 · Published 16 September 2026
Global Risk Culture Standard
The open standard that turns risk management into culture, across organisations, supply chains and the machines now inside the decision.
Measure what your organisation does, not what it says
Most risk culture assessments measure how an organisation would like to think. GRCS measures how it actually behaves. How long warning takes to travel, whether a decision has a named owner, whether an override was correct, whether a supplier disclosed early, and whether anything changed after the last failure.
It is assessed on evidence, not opinion. Every level of every pillar names the artefact or observed behaviour that demonstrates it. If a level cannot be evidenced, it cannot be claimed.
Why “Global”
Risk no longer stays inside the organisation that creates it. It travels through suppliers, platforms, logistics partners and data services, and it travels faster than it is absorbed. An organisation can have a genuinely mature internal risk culture and still be wholly exposed through the culture of others. GRCS assesses your organisation, including your capability in relation to your suppliers and your machines. It does not assess or certify them.
Why now
Artificial intelligence has moved from changing how work is done to changing who, or what, is deciding. The characteristic failure is not model error. It is unchallenged reliance on a plausible machine output that nobody in the room fully understood. At the same time, risk culture has become an examinable regulatory object in multiple jurisdictions, and boards are now being asked to evidence cultural claims they previously only asserted.
Where GRCS fits
GRCS sits alongside ISO 31000, COSO ERM and quantitative models such as FAIR, not in place of them. Those frameworks handle quantification, control effectiveness and capital allocation. GRCS addresses the human and organisational layer that decides whether any of that apparatus works in practice.
Contracts secure compensation after a disruption. Culture determines whether you get the phone call three weeks before it.
Boards and governing bodies
Risk, assurance and compliance leaders
Executives and operational leaders
HR, people and organisational development professionals
Seven pillars score capability. Three decide whether it can be trusted.
GRCS keeps the ten-pillar design and five-level maturity ladder of its predecessor, but restructures what the pillars do. Seven core pillars are scored from Level 1 (Ad Hoc) to Level 5 (Sustainably High-Performing). Three conditioning pillars are rated Strong, Adequate or Weak and applied as a discount on the whole result, because ethics, transparency and sustained capability determine whether the other seven readings can be believed.
Core Pillars
Leadership, Governance and Decision Authority
Where authority actually sits, so accountability can be located before it matters.
Risk Intelligence and Early Detection
Reading changing conditions early enough for the reading to be useful.
Decision Quality and Evidence Use
Setting the standard of evidence a decision must meet, and holding it under pressure.
Risk Appetite Translation and Enforcement.
Turning appetite from a statement into a constraint that can decline a decision.
Human–Machine Decision Integrity
Keeping accountability, verification and competence intact as decisions are delegated to machines.
Extended Enterprise and Supply Chain Culture
Whether your own conduct invites or suppresses warning from the network you depend on.
Adaptive Elasticity and Presilience®
The capacity to operate degraded, adapt at the edge, and emerge better positioned.
Conditioning pillars
Ethics, Incentives and Legitimacy
Whether concealment is the rational individual choice.
Transparency, Escalation and Psychological Safety
Whether information travels intact. A Weak rating here caps the reported score.
Capability, Learning and Change
Sustaining the whole system and closing the loop from outcome back to practice.
Score well everywhere else but fail on transparency, and GRCS tells you the truth: nothing else in your profile can be trusted. That’s not a harsher assessment. It’s an honest one.
How to use the standard
Four documents. One assessment method.
GRCS is an open standard, free to download, use, adapt and cite with attribution. Edition 1 is published as a suite:
The Standard. The full benchmarks for all ten pillars, with Characteristics, Consequences and Evidence at every level, the scoring method, governance intent and regulatory alignment, and the assessment methodology.
User Guide. How to run an assessment in seven steps, in the order you’ll actually need them: who does what, the evidence pack, choosing your assessment mode, and the five mistakes that defeat an assessment.
Representing Maturity. How an assessment becomes a number, what that number can and cannot carry, and how to present it to a board without misleading anyone.
Transition Checklist. Every change from ORCS v8 to GRCS Edition 1, what it means, and what to do if you hold an ORCS baseline.
The assessment in brief
Record the board’s statement of governance intent. Declare the assessment mode: self, facilitated or independent. Assemble evidence against each pillar. Run the five behavioural and documentary instruments, starting with warning-time reconstruction. Rate each pillar, apply the structural rules, and report all four figures with the evidence relied on. Then decide what you’ll do differently, which is the only reason to have done any of it.
Resources · User Guide
How to run an assessment, in the order you’ll actually need it
The Standard tells you what good looks like. The User Guide tells you how to find out where you stand.
It is short on purpose. It walks through an assessment in seven steps, from the board recording what it intends its risk culture to be, through to deciding what you’ll do differently once you have the result. Along the way it covers who does what, the evidence you’ll need to gather, and how to choose between a self, facilitated or independent assessment. That choice matters, because it decides what you can say about the result in public.
It also names the five mistakes that most often defeat an assessment, starting with the most tempting one: running a survey.
Most organisations discover in their first cycle that they have plenty of policy and very little proof. The guide treats that as a finding, not a failure.
Read the Standard for the benchmarks. Read the User Guide for the process.
Releases 3 November 2026
Resources · Representing Maturity
A board can’t act on a number. It can act on a finding.
Every assessment ends in figures. This note is about what those figures can honestly say, and what they can’t.
A GRCS result is not a verdict on whether your culture is good. It is a structured summary of how well your risk behaviours are evidenced. Representing Maturity explains how that summary becomes a number, why the number is deliberately discounted when evidence is weak or transparency is poor, and why a single headline score on its own almost always hides the real story.
It sets out four simple ways to show a result: one for where the weak spot is, one for where the score was lost, one for what to do about it, and one for whether anything is actually improving. It also lists the presentation habits that mislead boards, such as traffic lights without evidence, league tables and false precision.
“Our contracts are discouraging suppliers from telling us early” is something a board can fix. “2.85” is not.
Releases 17 November 2026
Resources · Transition Checklist
Moving from ORCS to GRCS, without misreading the change
If your organisation has used the Organisational Risk Culture Standard, this checklist is where to start.
GRCS is a rebuild, not a rename. Some pillars have been split, some merged, one is entirely new, and the way the result is calculated has changed. That means your new result can’t be compared directly with an old ORCS one.
The checklist sets out every change between ORCS v8 and GRCS Edition 1 in plain terms: what moved, why it moved, and what you need to do about it. It includes a step-by-step list for anyone holding an ORCS baseline, the new requirements that didn’t exist before, and a record of the corrections made to the v8 text. Those corrections are listed for transparency, in the same spirit the Standard asks of everyone else.
A different number after transition usually reflects a more honest measurement, not a worse culture.
Releases 1 December 2026
Complete GRCS Resource Suite
Want all four documents?
Once the full suite is available, you’ll be able to request the Standard, User Guide, Representing Maturity and Transition Checklist in one submission.
Supporting Organisations
The following organisations endorse and support the Global Risk Culture Standard, Edition 1:
Peer review panel — GRCS Edition 1, Round 1
With thanks to the reviewers who provided independent, critical review of Edition 1 during Round 1 (August to September 2026).
Lineage: ORCS v8 endorsement and peer review
The organisations and reviewers below endorsed and reviewed ORCS version 8 (2025), the predecessor to this Edition. They are acknowledged here for provenance; this should not be read as endorsement of GRCS Edition 1 or of any change introduced in it.
Peer review panel — ORCS v8
What reviewers said about ORCS v8
These testimonials were given for ORCS version 8, the predecessor Standard, and are shown for lineage.
Dr. Jennifer L. Schneider, CIH
Todd Tucker
Chief Randy R. Bruegman
Jessica Minion
Our Risk Culture Experts
The Global Risk Culture Standard, Edition 1, is authored by Dr Gavriel Schneider, with Dr Paul Johnston, Christopher Stitt and Jack Jones as supporting authors, reflecting their contribution to the Edition 1 architecture and to what is new in it.
Dr Gav Schneider
Jack Jones
Dr Paul Johnston
Christopher Stitt
GRCS references and builds upon the Organisational Risk Culture Standard, version 8 (2025), authored by Dr Gavriel Schneider, Dr Paul Johnston, Christopher Stitt, Jack Jones and Amanda Barber, which remains separately available on this site.
Citation
How to cite: Schneider, G., with Johnston, P., Stitt, C., & Jones, J. (2026). Global Risk Culture Standard, Edition 1. riskculture.org.
Be part of the conversation
ORCS | A Global Community for Risk Culture
Our LinkedIn group is where practitioners discuss how the Standard is being understood, applied, tested and debated in real organisations. It’s also the formal channel for practice-based comment on GRCS: contributions are considered by the GRCS Technical Committee at each review.
Join to share how you’re applying GRCS, compare notes on the transition from ORCS, and work through the hard parts, from evidencing Pillar 6 to assessing machine-informed decisions.
Practical writing on risk culture, evidence and the changing risk landscape.
Read through some of the writings that our experts have recently published and equip yourself further with practical knowledge on risk culture.
This article was written for ORCS v8, the predecessor to GRCS Edition 1.
Upcoming events
GRCS Edition 1 briefings and practitioner sessions will be listed here. Join the LinkedIn group to hear first.