designing business level GRC framework in Jira and Confluence

[Nuala Clamp]

Hello

I am researching the best way to design GRC structures using Jira and confluence. Any pointers to guidance would be appreciated

[Roger Barnes]

Hi Nuala, that's an excellent question, and I'd be happy to help.

In the first instance, I recommend checking out this guidance for a concrete implementation that we've used internally at Atlassian with good success: https://community.atlassian.com/t5/Agile-articles/How-Atlassian-uses-Jira-to-manage-risks-and-compliance/ba-p/896891

That should get you going, however I'd like to extend an additional offer of help. I'm keen to learn more about people's needs and challenges in this space so we can provide better resources, so if you (or anyone reading this with a similar interest) would like to get some more direct guidance, please email me (rbarnes at atlassian com) and we can set up a time for a call.

Cheers,

Roger

[Nuala Clamp]

Thanks @Roger Barnes ... I watched this one on the weekend and agree with the approach to embed GRC directly into the teams, I have applied the same principle across teams out side of a Jira. 

I am working with one of our delivery coaches to try and apply what was suggested in the video, but it’s a bit slow going as he doesn’t have the depth of knowledge in risk and compliance. 

let’s see how I get on this week, if we get lost along the way I will definitely take you up on that offer of direct guidence

[Roger Barnes]

I'd love to hear how you go, either way, @Nuala Clamp All the best with it!

[Roger Barnes]

Hi @Nuala Clamp ! I hope you had some success with this. Would you be willing to share your experience and feedback on a call? If so, you can book a time here: https://calendly.com/s/MHzEU67g

[Ignat Alexeyenko]

Hi @Nuala ClampI know this is from a while back, but as of 2025, more teams are embedding GRC structures into Jira and Confluence to streamline compliance processes.

There are now several apps in the Atlassian Marketplace focused on risk management, compliance tracking, and audit workflows—a quick search for "GRC”, “compliance,” or “risk management” should surface some options.

We’ve also been working on Cat the Compliant, an app designed to help teams track audits, manage compliance frameworks like SOC 2 and ISO 27001, and centralize reporting inside Jira.

Would love to hear more about your experience embedding GRC in Jira - what worked well, and what challenges did you face?

Cheers,
Ignat