Whenever I tell people that I work in Governance, Risk and Compliance (GRC), the reaction is usually the same. “So, you spend your day writing policies?” It’s a fair question because, from the outside, that’s exactly what GRC looks like. Before I started working in this field, I probably would have said the same thing. The reality is very different.
I recently posed what I believe is one of the most important unanswered questions in governance on LinkedIn: Who is auditing the governance framework? The responses confirmed two things. First, many practitioners instinctively recognize the gap. Second, there is still remarkably little agreement on who should be responsible for assessing governance effectiveness or even what "effective governance" actually means. That conversation reinforced why I have been asking this question for decades.
Government rarely moves first on anything, which is what makes the current change at FedRAMP worth attention. The Federal Risk and Authorization Management Program is the seal that lets cloud providers sell to federal agencies, and for years it has been synonymous with a particular way of proving security: a very large stack of documents, assessed once, and revisited on an annual cadence.
I have argued for years that risk is no longer a color. Red, amber, and green may make a report easier to scan, but they do not necessarily make risk easier to understand. The heatmap can tell an executive that something has been placed in a red box. It generally cannot explain how frequently the event might occur, what range of financial consequences the organization faces, whether a proposed control is worth its cost, or how one uncertain choice compares with another.
In a recent piece on my site, I wrote about Captain Batel's digital twin, and about what I am calling GRC 7.0 — GRC Orchestrate. I made the case that the future of risk management is not another dashboard bolted onto yesterday's process, but a living model of the enterprise that senses, simulates, and orchestrates response. That piece generated more conversation than almost anything I have written this year, and one question kept surfacing in different forms, from different people, in different words. If the digital twin can model the scenario, simulate the intervention, and recommend the path . . . what is left for the human being standing on the bridge?
Banks have spent centuries refining a single business model. They borrow trust, transform it into financial activity, and spend every day trying not to lose it. That is what makes a recent reflection from Bank of Ireland more interesting than it first appears. On its surface, it reads like another executive essay about artificial intelligence, full of familiar references to fraud detection, customer service, compliance monitoring, and operational efficiency. Those examples are almost expected now. Every large financial institution has a similar catalogue of use cases.
Every risk discipline carries a habit that outlives its usefulness. In third-party risk management, that habit is the self-attested questionnaire. It is the artifact the whole practice is organized around. A relationship begins, a security questionnaire goes out, the vendor returns a few hundred answers, an analyst reviews them, and the file is closed until next year's cycle. The ritual is so established that it is easy to forget it was built for a smaller, slower, more stable world than the one we operate in now