It's planning season for many risk management and internal audit functions. CROs and CAEs are deciding where to spend their limited resources, what work to prioritize and what they hope to accomplish in the coming year. I have a question for them. Do you see yourselves in the decision and performance support business?
Let’s be clear. Putting agentic AI into GRC platforms is not a feature upgrade. It changes the wiring of your control environment. If AI is summarizing reports, fine. The moment it starts scoring risk, closing issues, or triggering workflows, it is inside fiduciary processes. And testing keeps showing the same thing. Under load or clever manipulation, models wobble. That is manageable in marketing copy. It is not manageable in systems that support SOX, audit, and board reporting. Governance systems exist to reduce variance. Probabilistic systems introduce variance. That tension does not go away because the demo looks good.
For more than two decades, organizations have evaluated governance, risk, and compliance (GRC) technology largely by examining what a platform can do. Risk assessments, policy management, regulatory compliance, third-party risk, internal audit, dashboards, reporting, and workflow automation have become familiar requirements in the procurement process.
We have all done it. You are at an airport waiting for a flight. Your train journey is going to take another two hours. You have just checked into a hotel, or perhaps you are sitting in a café trying to get some work done. Your mobile signal isn't great, so you look at the available networks and see exactly what you need: free Wi-Fi.
GRC Report is partnering with Corlytics to bring structured regulatory intelligence directly to readers, integrating the regulatory technology company’s data feeds into our coverage of enforcement actions, supervisory activity and regulatory developments around the world.
Sustainability reporting used to be a document. At many large companies, it is now an institution, with its own staff, calendar, controls, and internal audit trail. The 2026 edition of the State of Play study from the IFAC, AICPA, and CIMA found that 97 percent of the world's largest companies disclosed some form of sustainability information in 2024, and 75 percent obtained some level of third-party assurance over it, up from 73 percent the year before and just 51 percent in 2019, the first year the study ran.
Most organizations know what they would do if a critical system went down. There are incident response plans, disaster recovery arrangements and business continuity procedures designed for exactly that scenario. But there is another question we don't ask nearly as often: What happens if the technology hasn't failed, but your organization can no longer use it?
Access Login