By Barbara Boccia
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
In the brave new world of GRC, it’s not just about sticking to the beat of yesterday’s rules. No, it’s about finding harmony amid the automation symphony, where GRC professionals must adapt faster than a cat video goes viral.
The future of Governance, Risk and Compliance (GRC) isn’t about keeping tempo with yesterday’s rules. It’s about orchestrating harmony across an organization in a world where automation and artificial intelligence (AI) are rewriting the score at lightning speed.
For years, GRC professionals have been the sheet music experts that know every regulatory note, add-in control measures and produce the rhythm of oversight at a financial institution (FI). They are the experts relied upon to identify, assess and respond to regulatory change, emerging risks and recurring issues through their steady foundation of checklists, frameworks and established procedures.
Often operating in silos, each pillar meets occasionally, shares notes, and then goes off into their own private jams. Within a three lines of defense framework, they each work separately with the lines of business (first line of defense) with varying degrees of success. Executive teams and the Board of Directors rely upon the GRC second line of defense to stay informed, helping the FI course-correct to mitigate consumer harm and stay in the good graces of the regulators. Occasionally audit, the third line of defense, swoops in to conduct an independent assurance of risk.
Going forward, AI, robotics, and digital ecosystems are reshaping the fundamentals of how businesses compete, and governance, compliance and risk management professionals will need to adjust as well. The second line of defense cannot stay one step ahead of emerging risks if they are lagging two steps behind the pace of change within the lines of business.
The AI and Automation Imperative
AI has already begun transforming GRC. Here are just a few use cases quickly moving from concept to realization:
- Anti-Money Laundering (AML) Monitoring: Machine learning models can detect unusual transaction patterns in real time. Supervised models can learn from labeled historical cases to predict the probability that a new transaction is suspicious. Unsupervised or anomaly models can flag deviations from learned norms for discovering new typologies that haven’t been labeled yet. Graph neural networks (GNN) can enable detection of circular flows, layering and networked money laundering behavior that otherwise could be easily missed. And with the evolving acceptance of crypto (such as Stablecoin), AI can help with detecting liquidity and peg risks as these tokens create cross-jurisdictional settlement and consumer-protection issues.
- Complaint Management: Natural language processing (NLP) can gauge the tone and urgency voiced by the customer, route complaints to the appropriate department or escalation channel, and flag regulatory issues (and repeat issues) for root cause analysis and regulatory reporting. NLP can also tailor a response to the consumer in real time with a consistent tone aligned with the financial brand. The manual review and oversight of hundreds or thousands of customer complaints, often in unstructured formats, could be transformative to help FIs spot systemic risks early, manage regulatory exposure, and improve customer satisfaction.
- Vendor Management: NLP could also help with third party vendor management, another data-heavy area that is painstakingly manual. NLP models could process due diligence questionnaires and vendor responses to detect inconsistencies or gaps, scan social media, news, legal filings and complaint data to spot red flags or deficiencies, and produce a report with a risk assessment in about the time it takes to pour a cup of coffee.
Processes, controls, monitoring, assessments and reporting that once required teams of people juggling Excel spreadsheets can now be automated real-time, at scale. The GRC teams that embrace AI and related technology will be able to maintain the speed, insight and adaptability required to govern risks that are evolving faster than traditional methods can manage. The organizations that thrive will be the ones that support the development of GRC in concert with the technological resources provided to the lines of business, to help GRC maintain the central rhythm needed to keep the enterprise in tune.
Why Orchestration Matters
Machines can play notes, but GRC orchestration is about creating harmony across the three lines of defense. Human skills are particularly essential to bring context, coordination and coherence to what would otherwise be a collection of isolated sounds. Here are a few examples of what GRC conductors can bring to the podium:
- Systems Overview: GRC teams can provide a unique perspective on how risks are interconnected and layered across, within and throughout the enterprise. Human judgment is better than machines at integrating a company’s culture, values and core principles into risk management to engender customer trust and bolster reputation.
- Storytelling: While AI can generate dashboards, GRC professionals can interpret them and help the board understand how best to mitigate and manage risk while keeping customers happy. Importantly, GRC can inspire the board to take the harder, ethical path.
- Agility: A great conductor can adjust the tempo when the music shifts and gains momentum. GRC leaders are able to pivot quickly when the landscape begins to change and are unafraid to navigate through unchartered territories.
The Future of GRC
GRC must do more than survive, it must thrive as financial institutions mix in more technology, AI and crypto into the course of doing business. Governance, risk and compliance functions should move in concert with the fast pace of the enterprise, and blend precision with perspective. By contributing balance and harmony, GRC can strengthen institutional resilience and help their FI achieve a competitive edge.