2020 promises to be a year of significant opportunity and change for organizations, as well as for the governance, risk and compliance (GRC) functions that support them. MetricStream’s Gaurav Kapoor discusses trends and changes to expect this year.
New innovations in artificial intelligence (AI) and other disruptive technologies, coupled with a growing focus on culture, integrity, risk-awareness and real-time decision-making will open up a range of opportunities and challenges for integrated risk/GRC functions to add greater value to their organizations.
With that in mind, we outline our predictions for GRC in 2020 and beyond:
Empowerment of the First Line
New generations of GRC software will be designed not just for the second and third lines of defense, but also for the front lines, empowering them to make decisions in-stream in their activities.
Imagine desk traders being automatically advised on the policy and governance implications of a trade in real time. Imagine traveling to a new country for business and having all of the required local policies and behavioral expectations instantly show up on your mobile app.
These are two examples of how well-integrated GRC will become in mainstream business activities.
Meanwhile, new GRC tools like AI chatbots will enable the front line to report issues and risks in an easier, more intuitive manner than ever before. For example, through a simple conversation with users, the bot will record front-line observations on risks and route them to the second line for further investigations. As more users begin to participate in this kind of reporting, richer risk-related insights will flow up to the management team, enabling them to more proactively mitigate risk.
Well-Harnessed Data: The New Gold
Having already amassed a treasure trove of information, organizations will increasingly leverage the power of analytics and AI to generate forward-looking insights that can catalyze business performance and growth.
New advancements in AI will enable decision-makers to predict risks and opportunities before they occur.
Natural language processing (NLP) tools will help decision-makers to harness the power of semantic analysis to connect the dots between thousands of issues and identify the best remediation actions.
The opportunities to add value through data will be truly immense. But as data lakes grow, so also will security-related risks. Adding to the challenge are new regulations, like GDPR, which impose stringent restrictions on data retention time and processing. To truly optimize the value of data in today’s environment, organizations will need to have strong data governance controls and policies in place.
GRC for AI: Governing the Bots
Data-driven technologies will open up a new world of opportunities, but they will also amplify critical risks, particularly around ethics, biases and integrity.
As organizations strive to manage these risks, GRC functions will be called in to audit AI algorithms, build accountability and transparency into AI applications, establish appropriate controls and policies and integrate AI risk management into broader enterprise risk management (ERM) programs.
No longer can one assume that technology is neutral. Ethical choices will need to be consciously embedded into AI applications right from the start. And it will have to be a collaborative effort involving risk, compliance and legal functions, as well as software engineering.
For further reading: Ethical AI is Built on Transparency, Accountability and Trust
Complex Global Business Ecosystems Give Rise to Complex Risks
The modern enterprise ecosystem is evolving into a highly intricate and interdependent global network of suppliers, partners, vendors, stakeholders, regulators and customers — all working together to ensure the smooth movement of goods, data and services.
In this profoundly interconnected ecosystem, almost everything we do has some level of third-party involvement, whether we know it or not. And with every third-party relationship comes new risks.
In fact, a leading global payments giant has a system in place to monitor the risks of not just thousands of third parties, but also numerous fourth parties, including processors, data storage entities and digital wallet operators. It’s an enormous challenge, but absolutely critical at a time when some of the biggest security breaches are being caused by third-party vulnerabilities.
The more effectively organizations can understand and manage these risks, the better their resilience will be.
Bringing It All Together: Understanding the Interconnectedness of Risk
Traditional siloed risk programs are simply no longer effective in a dynamic risk environment; organizations now need to understand risks not in isolation, but in relationship to each other.
Heading further into 2020, the focus will be on building an overarching integrative layer in risk programs that can map the relationships between different types of risks while also tying them back to business objectives. This integrated approach will demand that audit, risk management, and compliance teams work together more closely. It will also require an integrated risk management software infrastructure that can act as a “general ledger” (i.e., a single, transparent system of record for risks, incidents and responses across the enterprise).
If implemented effectively, this approach will enable organizations to predict risks with greater accuracy while simultaneously capitalizing on the opportunities that truly matter.
Read MetricStream’s whitepaper, “The Future of Integrated Risk Management”
A New Stage of Warfare Begins
If the recent escalating tensions between various nation states are any indicator, we seem to be entering a new phase in warfare where battles will be fought not on land or sea, but in cyberspace.
For sovereign nations, cyberwarfare is a way to demonstrate power without bloodshed. Yet, for companies caught in the crossfire, it represents a whole new level of risk.
Cyberweapons can infiltrate and shut down entire networks and infrastructures, leaving organizations in the lurch. These weapons are affordable and within reach of not just nation-state actors, but also cybercriminals eager to take advantage of poor cyber hygiene.
Given the ramifications of these issues and the scale at which they can impact companies, organizations will need to step up their cyber resilience efforts.
Gaurav Kapoor is Chief Operating Officer at 
