As a governance, danger, and compliance (GRC) software program market analysis analyst at G2, I’ve a front-row seat to the evolving GRC software program trade.
From operational danger administration to IT safety compliance to anti-money laundering (AML) software program, GRC software program is geared toward making certain organizations have the suitable processes to scale back dangers to their enterprise.
However what’s GRC? The that means of every of those particular person phrases is fairly intuitive. Governance is the method by which greatest practices and requirements are decided and controlled. Danger means figuring out, managing, and remediating threats. Compliance is a course of to evaluate whether or not organizations and methods align with greatest practices and steps for correcting misalignment. All of those work collectively to assist organizations guarantee their processes are aligned with inner insurance policies and exterior frameworks and supply help for mediating dangers and correcting noncompliance.
Does this sound summary and nebulous to you? It does to me. What does all of this imply in apply? And the way did we get right here? What’s coming subsequent? Let’s begin by exploring the historical past of GRC, then take inventory of the GRC software program market right this moment, and contemplate the following evolutions on this dynamic market.
Previous: the foundations of GRC
It could be shocking to study, however the historical past of GRC began not so way back. Whereas GRC has existed in apply for many years, requirements and rules usually are not that new; the late Nineteen Nineties and early 2000s are largely thought to be the beginning of the GRC that we consider right this moment.
A lot of the present discipline got here out of a handful of high-profile company scandals and the start of some particularly impactful regulatory occasions.
Arguably, essentially the most well-known company scandal of this period is the Enron scandal. The Enron Company, based mostly in Houston, United States, was discovered to be misrepresenting earnings and hiding the corporate’s true monetary standing. The dearth of correct oversight and corrective actions resulted in Enron submitting for chapter in late 2001. Staff and shareholders collectively misplaced billions of {dollars}, a few of which was recovered by means of ensuing lawsuits. A number of Enron executives have been prosecuted for numerous monetary crimes.
Shortly after, the WorldCom scandal emerged in 2002, additionally within the US. Like Enron, WorldCom was discovered to have fabricated accounting spreadsheets and artificially inflated the corporate’s monetary efficiency to mislead traders. Once more, some executives have been prosecuted for monetary crimes, and shareholders and bondholders later obtained some compensation.
Probably the most impactful rules on this period is the Sarbanes-Oxley Act of 2002, generally known as SOX, in the US. SOX establishes the Public Firm Accounting Oversight Board (Board) to: (1) oversee the audit of public corporations which can be topic to the securities legal guidelines; (2) set up audit report requirements and guidelines; (3) examine, examine, and implement compliance on the a part of registered public accounting corporations, their related individuals, and licensed public accountants.
This may increasingly look like only a historical past of GRC in the US. Nevertheless, as a big economic system with huge international affect, the US has been, for higher or for worse, a pattern setter on this trade.
I’d be negligent if I didn’t point out no less than one non-US regulation that has formed the trade. Inside Management: Steerage for Administrators on the Mixed Code, generally known as the Turnbull Report, first revealed in 1999, predated all of the occasions above. The report directed organizations to set agency inner controls and repeatedly audit to catch fraud and dangerous monetary standing.
Since then, extra regulatory efforts have emerged, particularly round information privateness. I’ve detailed a few of the most vital in a earlier weblog on navigating regulatory modifications. In information privateness, particularly, now we have began to see an emergence within the modern discipline of GRC as a consequence of elevated internet-based actions. The 2010s noticed an explosion of software program marketed to help organizations of their GRC efforts. Whereas lots of the rules that emerged within the early 2000s addressed monetary governance, danger, and compliance, information privateness issues additionally emerged, and alongside them, a want for regulation.
The web additionally supplied a possibility to highlight organizations that have been discovered to be conducting enterprise in unpopular methods. Involved with organizational fame, corporations additionally expanded their GRC efforts to deal with extra dangers and compliance round points like human rights and environmentalism, which can or is probably not regulated based mostly on location however are vital to shoppers and stakeholders.
All of those points, nonetheless, can really feel disconnected and confused. Even because the software program market developed to assist organizations meet these challenges, instruments weren’t essentially complete or well-integrated with different methods and enterprise processes.
Current: GRC as a strategic enterprise perform
Because the scope of what falls below GRC broadens, one would possibly anticipate an explosion within the varieties of software program developed to help increasing dangers and rules. Nevertheless, information on G2 suggests in any other case.
Progress of GRC product sorts is constant however average
From 2018, when G2 broke out the GRC “guardian” class, to 2024, the variety of GRC software program classes grew from 10 to 18.
Whereas this illustrates a rise within the varieties of software program within the GRC market, the expansion is modest. I don’t view this as a scarcity of innovation; it’s clear there are some new markets. Reasonably, this development displays the GRC software program market’s dedication to creating options that may be tailored to altering rules and requirements. There’s no must invent a brand new answer to each danger or compliance downside when markets evolve to accommodate altering circumstances.
New GRC product improvement illustrates market development
In the identical interval, there’s a transparent spike in new GRC merchandise added to G2 in 2022. Whereas a few of that is catching up on merchandise developed earlier however not captured by G2, there’s a transparent divide between earlier than and after 2022.
As an alternative of counting new GRC merchandise by the dozen, we are able to now rely them by the lots of every year. As of March 2025, there are slightly below 2,000 merchandise on G2 listed in GRC software program classes.
With so many new merchandise flooding the market, it could be shocking to replicate once more on the primary chart, the place we see regular however modest development within the varieties of merchandise rising. Once more, this can be a reflection of software program distributors creating merchandise which can be adaptable to altering market circumstances.
The variety of new merchandise in the marketplace displays the rising significance of getting a well-developed GRC program. GRC is a fast-growing trade, which is mirrored within the development of GRC merchandise, not within the scope of the market itself.
Closely regulated industries make the most of GRC merchandise
We will additionally achieve some insights by wanting on the variety of evaluations submitted on G2.com for merchandise within the GRC classes. Reviewers choose “Industries” from a dropdown menu when writing GRC product evaluations on G2.
Unsurprisingly, the highest industries represented are closely regulated industries, like info know-how and providers (assume GDPR and ISO 27001). Or monetary providers, considering again to SOX. Hospital and well being care is regulated by HIPAA.
There are simply over 20,000 evaluations on G2.com for merchandise within the GRC classes. The 5 industries above replicate almost half the whole evaluations for GRC merchandise.
Improve in assessment counts suggests rising GRC adoption
The numbers are much more stark after we evaluate the variety of evaluations submitted in 2018 by reviewers in these similar industries to these submitted in 2024.
This improve within the variety of evaluations submitted in 2018 in comparison with these submitted in 2024 means that extra organizations are recognizing the significance of a well-planned GRC technique and spending cash on software program to assist them obtain their objectives.
However what would possibly that seem like if this development continues in a couple of years?
Future: the place GRC is headed (and the way AI suits in)
After all, the subject on everybody’s thoughts is the emergence of AI. We’ve all learn the headlines highlighting moral and authorized issues surrounding how AI is utilized. From the latest Studio Ghibli fashion AI artwork technology controversy to the issues round coaching AI on materials that, usually unintentionally, generates dangerous content material, the potential for harm with out regulation could be very actual. And the pace with which AI expands and improves capabilities means any impactful rules will wrestle to maintain up.
Nevertheless, the necessity to contemplate AI danger shouldn’t be restricted to regulatory compliance. Suppose again to the beginning of this weblog. Enron is without end tainted for these sufficiently old to recollect the controversy. Authorized penalties apart, organizations danger vital reputational harm for “doing the mistaken factor”. Reputational and different much less tangible dangers shouldn’t be minimized.
This highlights organizations’ want for a complete GRC technique. This isn’t a “good to have”; it’s essential. Organizations that proactively account for danger can mitigate losses if and when occasions happen.
Healthcare organizations, for instance, which have robust enterprise continuity plans perceive their danger profile and have plans to answer an occasion, equivalent to a ransomware assault, that shuts down their enterprise and opens them to fines. On this instance, a healthcare group that may get its enterprise again and working faster and reply in a method that minimizes additional publicity to regulatory violations is in a a lot better enterprise place than one which doesn’t.
Count on to see extra consideration on the govt degree to points surrounding danger and compliance as a enterprise technique.
Together with understanding danger and navigating compliance, anticipate to see extra nimble and customizable GRC platforms in the marketplace. With the issues round AI talked about earlier and the challenges adapting to the pace of technological innovation, danger and compliance managers might be challenged to remain in compliance with always evolving regulatory necessities. I anticipate to see extra regulatory change administration software program in the marketplace, both as some extent answer or as a extra superior perform of bigger GRC platforms.
Lastly, anticipate to see extra danger domains emerge. One subject that’s being mentioned is human danger administration. Anybody working in cybersecurity is aware of that your largest organizational danger is your folks. 79% of organizations that do safety consciousness coaching skilled a human-related information breach over the previous 12 months. Coaching and consciousness usually are not sufficient to guard a corporation. They should proactively handle human danger past schooling.
What’s subsequent?
Solely time will inform what new danger and compliance concerns will emerge. Will there be a 2020s Enron that reshapes the regulatory panorama? Will that come from AI? How will the market reply? How will rising dangers impression enterprise selections and useful resource allocation? All these unknowns spotlight the significance of a complete GRC technique and the necessity for software program options to help altering environments.
GRC is not the one factor altering. Learn how G2 continues to prioritize innovation within the age of AI and past.
Edited by Supanna Das