Michael Rasmussen

In my recent article, GRC Alchemy: Imagination, Knowledge, and the Future of GRC, I argued that many organizations have become trapped in the mechanics of governance, risk, and compliance while losing sight of the larger architectural and strategic purpose behind it all. The challenge is no longer simply collecting more data, automating more workflows, or building more dashboards. Most organizations already have more information than they know what to do with.

The response to my session at Icon 2026 reminded me of something I have seen many times in this field. Organizations are not struggling to agree with the argument for supplier risk management. They are struggling to act on it. In the latest piece on my website, We Are Measuring the Value of TPRM Wrong, I argued that the business case for supplier risk management has been framed too narrowly and too focused on workflow, controls, and compliance, and not nearly enough on avoided disruption, avoided loss, and the confidence to move through uncertainty.

In my most recent article on my site, I raised a concern that should not be easy to dismiss. The term “agentic AI” is being used far too loosely across the GRC market, often applied to capabilities that, while useful, fall well short of anything resembling true autonomy or orchestration.

There is a moment that repeats itself across countless science-fiction stories. A ship’s sensors detect something unusual. Signals arrive that do not quite align with expectations. Perhaps it is a gravitational anomaly, a sudden communications blackout, or an unexpected hostile vessel appearing where none should exist. The bridge crew does not simply stare at the blinking lights. They interpret them. The captain asks the science officer what the signals mean, the engineer considers how the ship might respond, and the tactical officer evaluates defensive posture. Information becomes interpretation, interpretation becomes decision, and decision becomes action . . . capability.

In one of the latest articles on my website, I argued that GRC platforms must re-architect around digital twins, knowledge models, and agentic intelligence if they intend to survive the coming decade. But there is a deeper implication that deserves equal attention.

In my earlier piece, Risk Management Is Not a SOX Coloring Book: A Call for Risk Management as a Strategic Discipline, I argued that decades of Sarbanes-Oxley gravity have quietly reshaped how organizations understand risk—narrowing it into a compliance exercise defined by documentation, evidence trails, and audit satisfaction. That article challenged the idea that shaded boxes and completed control matrices equate to managing uncertainty. This follow-up goes a step further. It explores what risk management looks like once we finally put the coloring book down.

A week after publishing my first reflections on the World Economic Forum’s Global Risks Report 2026, I find myself returning to the same unease that prompted that first piece—not because the report needs more explanation, but because the initial reaction to it already feels familiar.