After more than two decades of advances in GRC (governance, risk & compliance) programmes, approaches, and supporting technologies, every organization has been charting its course differently. In many cases, there is a significant delta between a GRC team’s perception of their organization’s maturity versus the actual reality when various requirements, priorities, and outcomes are considered, explains Matt Hillary, CISO of Drata.
Navigating the complex waters of GRC requires a structured, yet pragmatic, approach with a clear heading and roadmap. The GRC maturity model can be viewed as having four distinct stages: Start, Establish, Manage, and Optimise. These stages provide a simplified, yet comprehensive, framework to help organizations move from ad-hoc, reactionary, and potentially freestyle approaches to a proactive, systematic GRC programme with automation and AI-backed technologies driving its success.
That’s not to say that there is a one-size-fits-all approach: each organization will follow its own unique path, shaped by its size, resources, internal support, and industry requirements.
The GRC maturity model
Start: Charting your course and creating baselines and foundations for a systematic approach to compliance.
At the outset, organizations should focus on laying the groundwork for a systematic compliance approach. This includes developing initial frameworks, establishing baseline policies, and preparing for their first internal or external audit. The approach shifts from reactive to proactive, emphasising the creation of key processes and standards to support future expansion.
Establish: Defining a structured approach to risk management and compliance with repeatable processes for audit readiness.
At this point, organizations should shift from isolated compliance initiatives to creating structured processes for risk management. They should begin to automate some key processes, establishing repeatable methods and outlining a robust framework for future compliance operations. The objective is to change focus from unblocking deals to unlocking new markets and burning down risk.
Manage: Shifting from a reactive to proactive GRC programme backed with a strong GRC platform, AI technologies, and automation.
With the foundations in place, organizations can start scaling their GRC projects. This involves improving visibility into compliance postures, clarifying ownership of duties and using reporting capabilities to manage risk more efficiently. During this stage, many organizations decentralise control and risk ownership outside of the GRC team to various parts of the company This also means aligning GRC strategy more closely with overall corporate goals, ensuring the initiative’s scalability.
It is worth looking more closely at AI in terms of accelerating the velocity and depth of due diligence analysis; automating data gathering for controls assessment; classifying documents; and report creation. It can also continuously monitor regulatory changes and refine processes accordingly. Furthermore, AI-backed technologies equip organizations with the ability to quickly analyse contracts, security questionnaires, third party risk management artifacts, gaps in policies, gaps in control coverage against industry requirements, and other legal documents to surface important clauses, risks, and compliance issues.
While AI’s most common applications lie in operational tasks, it can also enhance strategic planning and decision-making. By leveraging its ability to generate predictive insights and perform scenario modelling across vast and diverse data sets, AI offers significant value in these areas. Through analysing historical trends and integrating real-time data from numerous sources, AI-backed technologies help GRC leaders identify and potentially predict future risks or gaps in programmes based on the current landscape. This approach provides a more comprehensive data foundation for decision-making, making risk assessments less subjective and more data driven.
Ultimately, although AI promises automation and simplification, there is a risk of becoming over dependent on it, leading to complacency. Thus, companies should treat AI as an augmentation mechanism as opposed to a stand-in for human judgement. It should inform decisions rather than making them.
Optimise: A fully automated repeatable, provable and predictable framework for growth and scalability with decentralised ownership of controls and risk.
At the zenith of the maturity model, companies successfully reach a state of optimised, scalable, operational, and tailor-fit GRC programmes. These projects are automated, repeatable and offer predictably positive results. Organizations at this stage are prepared for any compliance challenge with GRC fully integrated into the broader corporate strategy.
Checking the difference between perception and reality
The delta between a GRC team’s current perception of maturity versus the reality can be stark. Research by Drata showed that 64% of respondents to a survey thought they had achieved optimisation, while, in reality, they reported gaps in their programmes, missing tools, and experienced business outages as a result of processes that weren’t scalable or functional. That’s probably because people tend to focus on team size, budget, and processes. Instead, they should be looking at the following as key indicators of maturity:
- Repeatability: Creating repeatable processes is critical for GRC maturity. Companies that integrate structure and repeatability into their compliance initiatives are better equipped to handle risk and scale up effortlessly.
- Unblocking process debt: Big companies regularly must deal with complex and sometimes insurmountable process and technology debt, where manual processes limit the ability to optimise. Smaller companies, on the other hand, manage audits more efficiently despite their limited resources.
- Scale efficiently: As companies expand, GRC must scale with them via automated processes and clear ownership of responsibilities.
- Two steps forward, one step back: This journey is never a straight line forward – entering new markets, adopting a new framework, complying with a new regulation, or acquiring another organization may cause you to shift back and forth between these phases – making this journey unpredictable at times, but allows for grace in the process toward Optimise.
Steering a confident path through GRC involves a structured approach and a well-defined roadmap. This maturity model provides a simple but broad framework to assist businesses in evaluating their current state, identifying growth opportunities and plotting a course towards mature and optimised GRC.
By understanding an organization’s current status and having a vision of where it needs to be, GRC teams can navigate towards compliance excellence, enabling longer term resilience, while improving their firm’s competitive edge.
The author
Matt Hillary is CISO of Drata.
