From risk avoidance to risk intelligence: GRC's value creation moment

Eighty-five percent of organizations have integrated AI into their core operations or deployed it across multiple functions. Yet only 25% report comprehensive visibility into employee AI use.

That gap is not a technology problem. It is a governance problem. And it sits squarely in GRC's territory.

The same tools generating the most significant organizational opportunities also generate the most significant blind spots. The traditional, defensive posture of risk management is not equipped to address either. In this article, I will draw on my years of experience leading internal audit functions globally to make the case for a fundamental shift: from focusing primarily on value protection to also enabling value creation. What that shift requires, what it looks like in practice, and why the GRC leaders who make it now will be the ones shaping AI strategies, rather than responding to the fallout.

AI oversight: Why the defensive GRC posture is no longer fit for purpose

The 2020s produced overlapping, non-resolving crises that exposed the limits of traditional risk models built for stable environments. Annual risk reviews, static assessments, and historical assurance are insufficient when risk is always "on" and crises compound rather than resolve. As I've argued elsewhere, a traditional approach to risk management no longer works — the siloed model that served the profession for decades cannot keep pace with today's environment.

Why AI is making the blocker dynamic unsustainable

Digital transformation and AI adoption cannot succeed if GRC acts only as a checkpoint. Boards increasingly ask risk leaders how risk affects strategy and opportunity, not just what to avoid. The same forces generating the biggest risks — AI, geopolitical instability, supply chain disruption — are also generating the biggest opportunities. GRC functions that only see the downside will be an impediment to resilient and dynamic organizations that emerge from chaos.

The dual mandate: protect and create

Tomorrow's high-performing GRC teams will operate with two simultaneous obligations: protect value through controls, compliance, and resilience; and create value by providing insight and foresight that improves strategy, innovation, and decision-making. This is not a trade-off. It is the new baseline.

• Internal audit: An internal audit function that moves beyond control testing to map emerging AI risks across the business is both assuring the present and shaping the risk conversation before the board knows to ask. The cost of falling short is well documented — over £1 billion in FCA fines across five years, tied directly to internal control failures.
• Risk: A risk team that integrates opportunity-based assessments alongside traditional downside analysis gives leadership a fuller picture — and a genuine basis for informed, faster decisions.
• Compliance: Compliance functions that track regulatory change as it happens allow the business to anticipate requirements and build them into product development, rather than retrofitting them after the fact.

From systems of record to systems of action, AI is the enabler

AI allows GRC teams to move from retrospective analysis to forward-looking insight, identifying emerging risks and strategic opportunities earlier than previously possible. But the more profound shift is structural: moving from systems of record (platforms flush with business and risk data) to systems of action (orchestrated responses to risk in real time). Insight that doesn't close the loop between knowing and doing has limited value. GRC leaders who invest in this capability shift — analytics, automation, continuous monitoring — are the ones who will earn a seat at the strategy table.

What GRC leaders should do now

• Conduct opportunity-oriented risk assessments (not just downside exposure)
• Strengthen real-time risk intelligence capabilities
• Reposition the function as a strategic advisor rather than an oversight body
• Build AI literacy within risk teams
• Establish governance for AI risk itself

The GRC leaders who will define the next decade are not the ones who helped their organizations avoid the most risk. They are the ones who used risk intelligence to help their organizations move faster, decide better, and compete smarter. That role is available to every GRC function willing to claim it.