By Kim McDonald
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
In the vast ocean of Governance, Risk, and Compliance (GRC), it’s amusing that while large enterprises cruise with navigational charts, smaller organizations are left to navigate with little more than a compass and a prayer. After all, who needs robust frameworks when optimism is all you really need?
In today’s digital-first world, we’re all sailing the same seas – but we’re not all in the same boat. Governance, Risk, and Compliance (GRC) frameworks are often designed for the ocean liners: large enterprises with full crews, radar systems, and navigational charts for every possibility. Meanwhile, small fishing boats and kayaks – SMEs, community organisations, start-ups – are navigating the same waters in the same storms, but with nothing more than a compass and the hope the weather holds.
It’s not that smaller operators don’t care about safety, security, or good governance. They do. But the way we talk about GRC often makes it sound like an insiders-only navigation manual – written in a language that’s inaccessible, dense, and disconnected from the day-to-day realities of most businesses. If GRC really should matter to everyone on the water, then we need to start speaking in ways everyone can understand.
When Communication Gaps Become Risk Vectors
At its heart, GRC isn’t just about ticking boxes for regulators – it’s about protecting people, data, and trust. But if smaller operators don’t understand why it matters, they can’t prioritise it. That gap in understanding becomes a risk vector in itself.
In an increasingly interconnected ecosystem, the weakest link doesn’t just sink one boat – it can cause damage across the whole fleet. A data breach at a supplier can cascade into a major enterprise’s network. A governance failure in a local organisation can spill over into reputational damage for partners half a world away.
Trust and Safety teams have shown that clear, human-centred communication changes behaviour and strengthens protection. GRC can and should take the same approach. Because without accessible communication, we risk leaving smaller, resource-strapped operators exposed – and that puts everyone at greater risk.
The Problem with How We Talk About GRC
Let’s be honest: the language of GRC can feel like a closed circuit. Acronyms, regulatory frameworks, and audit jargon dominate, making it sound like compliance is a purely technical discipline rather than a practical, everyday safeguard.
Worse, the way we communicate GRC often frames it as a punitive, top-down requirement, rather than an empowering business advantage. Privacy notices read like legal disclaimers. Mandatory training focuses on passing a quiz rather than building a skill. Risk registers sit in spreadsheets, divorced from the actual decision-making process.
For SMEs and lean teams, this isn’t just unhelpful – it’s alienating. When you’re already stretched thin, facing complex jargon with no clear “what’s in it for me” can make GRC feel like bureaucracy for bureaucracy’s sake.
What GRC Can Learn from Trust and Safety
Trust and Safety teams don’t just write policies – they tell stories. They frame security rules in terms of protecting people, not avoiding penalties. They lead with human impact: “Spot a scam and protect your community,” not “Report suspicious activity per clause 7.3(b).”
They use plain language, relatable metaphors, and cultural context to make complex rules feel relevant. They embed guidance into user flows so that people encounter rules in the moment they need them, not buried in an unread policy document.
GRC could borrow heavily from this playbook. We should aim for a world where governance feels as natural as locking your front door or checking the weather before you sail – simple, sensible actions that are part of everyday life.
Translating GRC into Everyday Language
So, how do we actually translate GRC into something that works across the whole fleet, from ocean liners to kayaks?
Use analogies people already understand: “Data governance is like locking your front door and deciding who gets a spare key – and being able to change the locks if you need to.”
Make it visible: Replace abstract compliance scores with dashboards that explain what each metric means for risk reduction.
Make it relevant: Use case studies that match the reader’s sector, size, and context.
Co-create the language: Test guidance with the people who have to follow it. If they can’t explain it back to you in their own words, it’s not clear enough.
Embed it in culture: Integrate governance into onboarding, leadership messages, and regular team rituals, so it’s seen as part of “how we do things here” rather than an annual fire drill.
Why This Matters Now
The storms aren’t getting smaller – they’re getting stronger. Cyber threats are growing, regulations are tightening, and public expectations for accountability are rising. In an exponentially digital world, the speed at which risk can spread across networks means that everyone – from multinationals to micro-businesses – needs to be fluent in the basics of governance, risk, and compliance.
If we keep speaking a language meant for “supertankers” with full crews and radar systems, we leave the rest of the fleet at risk. And in a connected ocean, that risk soon becomes everyone’s problem.
A Call to Change the Conversation
In a digital-first world, the same storms hit everyone – whether you’re steering a cruise ship or paddling a kayak. If we want GRC to scale trust and resilience across the entire fleet, we must stop speaking at people and start speaking with them.
That means replacing jargon with clarity, fear with empowerment, and designing systems where understanding governance is as intuitive as putting on a life jacket before you set sail. Because the real risk isn’t that people break the rules – it’s that they never understood them in the first place.