Beyond the System of Record: The Case for GRC Intelligence

Every board should be asking its management team one question: if an AI system inside this company caused a problem tomorrow, how long would it take to prove which controls were supposed to catch it, and which one worked?

Most can’t answer it quickly. In fact, in a survey we commissioned of more than 800 GRC and IT leaders, over two-thirds lacked full confidence in their organizations' ability to respond decisively to a fast-moving AI security incident.

The same survey shows why. Eighty-five percent of organizations have put AI into core operations or multiple functions, but only a quarter have comprehensive visibility into how their own employees use it. Just 34 percent keep a formal inventory of their AI models. That’s a real problem. Controls can’t test what an organization can’t see.

A risk function that can answer a hard question in an afternoon is treated differently from one that needs three weeks. What separates them isn’t effort or headcount. It’s whether the function was built to look backward or to operate continuously.

For decades, governance, risk, and compliance teams were judged on what they could show after the fact. Spreadsheets tracked controls. Testing ran on fixed annual or quarterly cycles. Boards received periodic summaries. That was a system of record, built for a slower world, and it did what it was designed to do: make the past defensible.

Of course, the record still matters. Nothing gets proven without it. But what GRC needs next is a system of action built on that foundation—one that continuously reads the record, tests against it, surfaces failures, and helps teams respond while the issue still matters. I call it GRC Intelligence.

A rising bar demands a system of action

This seismic shift is happening as expectations around evidence, audit quality, and accountability are also increasing. New PCAOB standards and heightened SEC scrutiny are putting greater pressure on auditors to demonstrate how conclusions were reached and how evidence was evaluated. That pressure inevitably reaches the companies producing the underlying evidence.

The challenge is that these expectations are rising at the same time the environment being controlled is becoming more dynamic. Working the old calendar harder will not solve that problem. In a system-of-action model, risk is surfaced earlier, control testing runs continuously, and control owners, auditors, and the audit committee can work from the same picture at the same time.

Autonomous testing can absorb much of the operational burden. Agents can collect evidence, test samples, and draft narratives that once consumed large portions of an audit cycle.

But speed is not the most important part. Trust is. For autonomous testing to be useful, every step has to be traceable, cited to its source, reviewable by a person, and tied to an accountable owner. An organization should be able to explain not only what an agent concluded, but how it got there.

That obligation runs both ways. A risk function that deploys agents in its own work but can’t account for the agents operating across the business has solved only half the problem.

From silos to a single view

None of this works if every team maintains its own version of the risk picture.

Our research found that responsibility for AI governance remains highly fragmented: no single function owns more than a quarter of it. That fragmentation creates gaps between audit, risk, compliance, security, and IT precisely when AI is cutting across all of them. Those teams need to work from the same risks, controls, assets, and evidence.

As a CEO of public and private companies, I’ve watched organizations repeatedly hit the same wall: they could produce the evidence, but not fast enough. I’ve seen teams that make this shift shorten audit cycles, respond faster to examiners, and spend far less time reconstructing evidence that already exists.

That is the larger change. A system of action is not about doing the same GRC work faster. It changes when assurance happens. Instead of reconstructing the control environment after the fact, organizations can understand what is changing while it is changing and respond before the next audit cycle begins.

Which brings the question back to the board.

If an AI system causes a problem tomorrow, the standard should not be whether the organization can eventually explain what happened. It should be whether it can answer, quickly and with evidence, which controls were supposed to catch it, whether they worked, and what needs to happen next.