This Is GRC
Make GRC relevant.
GRC can do more than prove that a process exists. When we understand the technology, the people and the business, we can help shape better decisions before they turn into findings.
What I meanSee it in action →
A different way to work
We have made GRC too small.
If our job is to chase screenshots and recite frameworks, people will see us as bureaucracy. They are not wrong.
But when we know how a system works, why a team made a trade-off, and what could go wrong next, we become useful in the room where the decision happens. That is the profession I want to build.
What I believe
Curiosity and pragmatism.
Be curious enough to learn the system.
Ask the awkward question. Follow the data path. Get close to how teams actually work, even when the answer does not fit the neat control description.
Be pragmatic enough to change something.
Use a framework, a tool or AI when it helps. Set it aside when it only creates more ceremony. The point is better security and better decisions, not a more impressive process diagram.
See it in action
What could a more useful GRC team do?
It could notice that a vendor relationship changed, that a control claim stopped being true, or that repeated findings point to one broken process. I have built public demos around those moments.
Explore the demos
Start somewhere useful
Try a small change in your own work.
Stop the evidence chase.
Turn an audit request into a clear claim before anyone starts collecting files.
Try the audit exercise →Look past the questionnaire.
Ask what this vendor will actually do with your data and for whom.
Try the vendor exercise →Follow one risk signal.
See whether a changed assumption should change the decision.
Try the risk exercise →In practice
What does this look like inside a growing company?
At Coveo, GRC had to make sense to engineers and business leaders as the company scaled. Ayoub Fandi and I talked through the work behind that in his deep dive on the program.
Read the Coveo feature ↗More about me →