The Governance, Risk, and Compliance (GRC) landscape has undergone a radical transformation, moving far beyond its traditional focus on purely financial risk. Mitratech’s Henry Umney noted that in recent years, the priority has shifted squarely to non-financial and operational risk, a change driven by regulatory mandates like DORA and NIS2.
Failures in regulatory reporting, IT risk management, and overall operational stability have proven to be more materially damaging than pure financial ones. This requires organisations to move away from reactive, point-in-time compliance toward continuous monitoring. The goal is to aggregate data from fragmented systems to achieve a holistic view of risk, which is critical for maintaining stability in a marketplace defined by digital transformation and complex regulatory requirements.
This evolution is reflected in the proliferation of terms like Cyber GRC and Dev GRC Ops, signaling a deeper, essential integration of risk practices directly into digital and operational workflows. This integration is vital because, with organisations relying heavily on third parties for infrastructure (rather than internal server rooms), direct visibility has been lost.
The modern GRC leader must embrace tech-savvy practices to leverage continuous information from internal systems and, crucially, from third, fourth, and fifth parties to measure true resilience. Looking ahead, the main priorities for GRC leaders are controlling the risks associated with the pervasive and accelerated adoption of AI, managing escalating geopolitical risks, and gaining full visibility into their extended third-party ecosystem.
Ultimately, the successful GRC leader must prove their value to the organisation by aligning the risk program with the core business values and growth drivers. This requires breaking down departmental silos and fostering cross-collaboration.
Henry Umney’s core piece of advice
GRC should not be viewed as a “speed bump” or “hand brake” that restricts the business. Instead, GRC leaders should define clear “guardrails” agreed-upon risk tolerances, that allow the organisation to move as fast as possible within a safe, defined boundary. This strategic alignment turns the GRC function into an enabler of speed, performance, and future profitability.
No comments yet