Mapping the Evidence on Integrated Governance, Risk, and Compliance (GRC) Frameworks in Infrastructure Development Organizations: A Scoping Review (2015–2025)

Abstract

Background. Infrastructure is uniquely consequential: its assets are capital-intensive, long-lived, safety-critical, and publicly accountable, so failures of governance, risk management, or compliance in the organizations that deliver it are borne by whole societies through megaproject overruns, corruption scandals, regulatory breaches, and unmet sustainability commitments. Yet these three functions are usually run separately, under separate standards. Their integration is widely advocated, invoked under many inconsistent labels, and has never been mapped for this sector.

Objective. To map the extent, nature, and distribution of the evidence on integrated governance, risk, and compliance (GRC) frameworks in infrastructure development organizations over 2015–2025, and to identify how integration is conceptualised, which frameworks and standards are used, what enables or obstructs implementation, and what gaps remain.

Methods. The review followed established scoping review methodology and is reported against the PRISMA extension for scoping reviews. Eligibility used a Population–Concept–Context frame with integrated GRC as an umbrella construct. Scopus was searched on 25 October 2026; records were screened in two stages and charted on setting, sector, design, GRC dimensions, framework or standard, and the locus of integration.

Results. Thirty-nine of 215 records met eligibility, spanning fourteen countries. The evidence is dominated by construction firms (22 studies) and by enterprise risk management, with a marked rise after 2022. Integration attaches to five distinct loci: the enterprise risk process, the project lifecycle, the conduct of organizational actors, the management-control and information architecture, and institutional oversight. Only five studies addressed governance, risk, and compliance together, and none evaluated an integrated framework empirically. Apparent disagreement over whether regulation enables or impedes integration dissolves once the commitment to adopt is separated from the capacity to implement.

Conclusions. Integrated GRC is a recognised but under-specified aspiration in infrastructure organizations, and the evidence is contractor-centred, cross-sectional, and almost devoid of outcome evaluation. Theoretically, the review links its findings to institutional, legitimacy, resource-based, and dynamic-capabilities perspectives and proposes that integrated GRC is best understood not as a compliance function but as a dynamic governance capability that strengthens organizational resilience and infrastructure delivery performance.