As a governance, threat, and compliance (GRC) software program market analysis analyst at G2, I’ve a front-row seat to the evolving GRC software program trade.
From operational threat administration to IT safety compliance to anti-money laundering (AML) software program, GRC software program is aimed toward making certain organizations have the precise processes to cut back dangers to their enterprise.
However what’s GRC? The that means of every of those particular person phrases is fairly intuitive. Governance is the method by which finest practices and requirements are decided and controlled. Danger means figuring out, managing, and remediating threats. Compliance is a course of to evaluate whether or not organizations and techniques align with finest practices and steps for correcting misalignment. All of those work collectively to assist organizations guarantee their processes are aligned with inner insurance policies and exterior frameworks and supply help for mediating dangers and correcting noncompliance.
Does this sound summary and nebulous to you? It does to me. What does all of this imply in observe? And the way did we get right here? What’s coming subsequent? Let’s begin by exploring the historical past of GRC, then take inventory of the GRC software program market immediately, and take into account the subsequent evolutions on this dynamic market.
Previous: the foundations of GRC
It could be stunning to be taught, however the historical past of GRC began not so way back. Whereas GRC has existed in observe for many years, requirements and rules should not that new; the late Nineteen Nineties and early 2000s are largely thought to be the beginning of the GRC that we consider immediately.
A lot of the present area got here out of a handful of high-profile company scandals and the beginning of some particularly impactful regulatory occasions.
Arguably, essentially the most well-known company scandal of this period is the Enron scandal. The Enron Company, primarily based in Houston, United States, was discovered to be misrepresenting earnings and hiding the corporate’s true monetary standing. The dearth of correct oversight and corrective actions resulted in Enron submitting for chapter in late 2001. Workers and shareholders collectively misplaced billions of {dollars}, a few of which was recovered by way of ensuing lawsuits. A number of Enron executives had been prosecuted for varied monetary crimes.
Shortly after, the WorldCom scandal emerged in 2002, additionally within the US. Like Enron, WorldCom was discovered to have fabricated accounting spreadsheets and artificially inflated the corporate’s monetary efficiency to mislead buyers. Once more, some executives had been prosecuted for monetary crimes, and shareholders and bondholders later obtained some compensation.
One of the impactful rules on this period is the Sarbanes-Oxley Act of 2002, referred to as SOX, in the US. SOX establishes the Public Firm Accounting Oversight Board (Board) to: (1) oversee the audit of public firms which can be topic to the securities legal guidelines; (2) set up audit report requirements and guidelines; (3) examine, examine, and implement compliance on the a part of registered public accounting corporations, their related individuals, and authorized public accountants.
This may occasionally seem like only a historical past of GRC in the US. Nevertheless, as a big financial system with monumental international affect, the US has been, for higher or for worse, a development setter on this trade.
I’d be negligent if I didn’t point out at the very least one non-US regulation that has formed the trade. Inner Management: Steering for Administrators on the Mixed Code, referred to as the Turnbull Report, first revealed in 1999, predated all of the occasions above. The report directed organizations to set agency inner controls and usually audit to catch fraud and dangerous monetary standing.
Since then, extra regulatory efforts have emerged, particularly round information privateness. I’ve detailed among the most necessary in a earlier weblog on navigating regulatory modifications. In information privateness, specifically, we have now began to see an emergence within the up to date area of GRC on account of elevated internet-based actions. The 2010s noticed an explosion of software program marketed to help organizations of their GRC efforts. Whereas lots of the rules that emerged within the early 2000s addressed monetary governance, threat, and compliance, information privateness issues additionally emerged, and alongside them, a need for regulation.
The web additionally supplied a chance to highlight organizations that had been discovered to be conducting enterprise in unpopular methods. Involved with organizational popularity, firms additionally expanded their GRC efforts to handle further dangers and compliance round points like human rights and environmentalism, which can or is probably not regulated primarily based on location however are necessary to customers and stakeholders.
All of those points, nevertheless, can really feel disconnected and confused. Even because the software program market advanced to assist organizations meet these challenges, instruments weren’t essentially complete or well-integrated with different techniques and enterprise processes.
Current: GRC as a strategic enterprise perform
Because the scope of what falls beneath GRC broadens, one may anticipate an explosion within the sorts of software program developed to help increasing dangers and rules. Nevertheless, information on G2 suggests in any other case.
Development of GRC product sorts is constant however reasonable
From 2018, when G2 broke out the GRC “dad or mum” class, to 2024, the variety of GRC software program classes grew from 10 to 18.
Whereas this illustrates a rise within the sorts of software program within the GRC market, the expansion is modest. I don’t view this as a scarcity of innovation; it’s clear there are some new markets. Quite, this progress displays the GRC software program market’s dedication to creating options that may be tailored to altering rules and requirements. There’s no have to invent a brand new resolution to each threat or compliance downside when markets evolve to accommodate altering situations.
New GRC product growth illustrates market progress
In the identical interval, there’s a transparent spike in new GRC merchandise added to G2 in 2022. Whereas a few of that is catching up on merchandise developed earlier however not captured by G2, there’s a transparent divide between earlier than and after 2022.
As an alternative of counting new GRC merchandise by the dozen, we will now depend them by the lots of annually. As of March 2025, there are just below 2,000 merchandise on G2 listed in GRC software program classes.
With so many new merchandise flooding the market, it might be stunning to replicate once more on the primary chart, the place we see regular however modest progress within the sorts of merchandise rising. Once more, this can be a reflection of software program distributors creating merchandise which can be adaptable to altering market situations.
The variety of new merchandise in the marketplace displays the rising significance of getting a well-developed GRC program. GRC is a fast-growing trade, which is mirrored within the progress of GRC merchandise, not within the scope of the market itself.
Closely regulated industries make the most of GRC merchandise
We are able to additionally achieve some insights by trying on the variety of opinions submitted on G2.com for merchandise within the GRC classes. Reviewers choose “Industries” from a dropdown menu when writing GRC product opinions on G2.
Unsurprisingly, the highest industries represented are closely regulated industries, like info expertise and companies (assume GDPR and ISO 27001). Or monetary companies, pondering again to SOX. Hospital and well being care is regulated by HIPAA.
There are simply over 20,000 opinions on G2.com for merchandise within the GRC classes. The 5 industries above replicate practically half the whole opinions for GRC merchandise.
Improve in evaluate counts suggests rising GRC adoption
The numbers are much more stark once we evaluate the variety of opinions submitted in 2018 by reviewers in these similar industries to these submitted in 2024.
This enhance within the variety of opinions submitted in 2018 in comparison with these submitted in 2024 means that extra organizations are recognizing the significance of a well-planned GRC technique and spending cash on software program to assist them obtain their objectives.
However what may that appear to be if this progress continues in a number of years?
Future: the place GRC is headed (and the way AI matches in)
In fact, the subject on everybody’s thoughts is the emergence of AI. We’ve all learn the headlines highlighting moral and authorized issues surrounding how AI is utilized. From the latest Studio Ghibli type AI artwork technology controversy to the issues round coaching AI on materials that, usually unintentionally, generates dangerous content material, the potential for injury with out regulation could be very actual. And the velocity with which AI expands and improves capabilities means any impactful rules will wrestle to maintain up.
Nevertheless, the necessity to take into account AI threat shouldn’t be restricted to regulatory compliance. Suppose again to the beginning of this weblog. Enron is without end tainted for these sufficiently old to recollect the controversy. Authorized penalties apart, organizations threat vital reputational injury for “doing the flawed factor”. Reputational and different much less tangible dangers shouldn’t be minimized.
This highlights organizations’ want for a complete GRC technique. This isn’t a “good to have”; it’s a must have. Organizations that proactively account for threat can mitigate losses if and when occasions happen.
Healthcare organizations, for instance, which have sturdy enterprise continuity plans perceive their threat profile and have plans to reply to an occasion, similar to a ransomware assault, that shuts down their enterprise and opens them to fines. On this instance, a healthcare group that may get its enterprise again and working faster and reply in a means that minimizes additional publicity to regulatory violations is in a a lot better enterprise place than one which doesn’t.
Anticipate to see extra consideration on the govt stage to points surrounding threat and compliance as a enterprise technique.
Together with understanding threat and navigating compliance, anticipate to see extra nimble and customizable GRC platforms in the marketplace. With the issues round AI talked about earlier and the challenges adapting to the velocity of technological innovation, threat and compliance managers will probably be challenged to remain in compliance with consistently evolving regulatory necessities. I anticipate to see extra regulatory change administration software program in the marketplace, both as some extent resolution or as a extra superior perform of bigger GRC platforms.
Lastly, anticipate to see extra threat domains emerge. One subject that’s being mentioned is human threat administration. Anybody working in cybersecurity is aware of that your greatest organizational threat is your individuals. 79% of organizations that do safety consciousness coaching skilled a human-related information breach over the previous 12 months. Coaching and consciousness should not sufficient to guard a company. They should proactively handle human threat past schooling.
What’s subsequent?
Solely time will inform what new threat and compliance issues will emerge. Will there be a 2020s Enron that reshapes the regulatory panorama? Will that come from AI? How will the market reply? How will rising dangers impression enterprise selections and useful resource allocation? All these unknowns spotlight the significance of a complete GRC technique and the necessity for software program options to help altering environments.
GRC is not the one factor altering. Learn the way G2 continues to prioritize innovation within the age of AI and past.
Edited by Supanna Das
