As a governance, threat, and compliance (GRC) software program market analysis analyst at G2, I’ve a front-row seat to the evolving GRC software program trade.
From operational threat administration to IT safety compliance to anti-money laundering (AML) software program, GRC software program is geared toward making certain organizations have the best processes to scale back dangers to their enterprise.
However what’s GRC? The which means of every of those particular person phrases is fairly intuitive. Governance is the method by which finest practices and requirements are decided and controlled. Danger means figuring out, managing, and remediating threats. Compliance is a course of to evaluate whether or not organizations and programs align with finest practices and steps for correcting misalignment. All of those work collectively to assist organizations guarantee their processes are aligned with inner insurance policies and exterior frameworks and supply help for mediating dangers and correcting noncompliance.
Does this sound summary and nebulous to you? It does to me. What does all of this imply in follow? And the way did we get right here? What’s coming subsequent? Let’s begin by exploring the historical past of GRC, then take inventory of the GRC software program market right now, and think about the following evolutions on this dynamic market.
Previous: the foundations of GRC
It could be shocking to study, however the historical past of GRC began not so way back. Whereas GRC has existed in follow for many years, requirements and laws usually are not that new; the late Nineties and early 2000s are largely considered the beginning of the GRC that we consider right now.
A lot of the present discipline got here out of a handful of high-profile company scandals and the delivery of some particularly impactful regulatory occasions.
Arguably, probably the most well-known company scandal of this period is the Enron scandal. The Enron Company, based mostly in Houston, United States, was discovered to be misrepresenting earnings and hiding the corporate’s true monetary standing. The dearth of correct oversight and corrective actions resulted in Enron submitting for chapter in late 2001. Workers and shareholders collectively misplaced billions of {dollars}, a few of which was recovered via ensuing lawsuits. A number of Enron executives have been prosecuted for varied monetary crimes.
Shortly after, the WorldCom scandal emerged in 2002, additionally within the US. Like Enron, WorldCom was discovered to have fabricated accounting spreadsheets and artificially inflated the corporate’s monetary efficiency to mislead traders. Once more, some executives have been prosecuted for monetary crimes, and shareholders and bondholders later obtained some compensation.
One of the crucial impactful laws on this period is the Sarbanes-Oxley Act of 2002, often known as SOX, in the US. SOX establishes the Public Firm Accounting Oversight Board (Board) to: (1) oversee the audit of public firms which are topic to the securities legal guidelines; (2) set up audit report requirements and guidelines; (3) examine, examine, and implement compliance on the a part of registered public accounting companies, their related individuals, and authorized public accountants.
This will look like only a historical past of GRC in the US. Nonetheless, as a big economic system with huge world affect, the US has been, for higher or for worse, a development setter on this trade.
I’d be negligent if I didn’t point out a minimum of one non-US regulation that has formed the trade. Inside Management: Steerage for Administrators on the Mixed Code, often known as the Turnbull Report, first revealed in 1999, predated all of the occasions above. The report directed organizations to set agency inner controls and frequently audit to catch fraud and dangerous monetary standing.
Since then, extra regulatory efforts have emerged, particularly round knowledge privateness. I’ve detailed among the most essential in a earlier weblog on navigating regulatory modifications. In knowledge privateness, particularly, we’ve began to see an emergence within the modern discipline of GRC attributable to elevated internet-based actions. The 2010s noticed an explosion of software program marketed to help organizations of their GRC efforts. Whereas lots of the laws that emerged within the early 2000s addressed monetary governance, threat, and compliance, knowledge privateness considerations additionally emerged, and alongside them, a need for regulation.
The web additionally supplied a possibility to highlight organizations that have been discovered to be conducting enterprise in unpopular methods. Involved with organizational fame, firms additionally expanded their GRC efforts to deal with extra dangers and compliance round points like human rights and environmentalism, which can or might not be regulated based mostly on location however are essential to shoppers and stakeholders.
All of those points, nonetheless, can really feel disconnected and confused. Even because the software program market advanced to assist organizations meet these challenges, instruments weren’t essentially complete or well-integrated with different programs and enterprise processes.
Current: GRC as a strategic enterprise operate
Because the scope of what falls underneath GRC broadens, one may count on an explosion within the kinds of software program developed to help increasing dangers and laws. Nonetheless, knowledge on G2 suggests in any other case.
Progress of GRC product varieties is constant however average
From 2018, when G2 broke out the GRC “mum or dad” class, to 2024, the variety of GRC software program classes grew from 10 to 18.
Whereas this illustrates a rise within the kinds of software program within the GRC market, the expansion is modest. I don’t view this as an absence of innovation; it’s clear there are some new markets. Reasonably, this progress displays the GRC software program market’s dedication to creating options that may be tailored to altering laws and requirements. There’s no must invent a brand new answer to each threat or compliance downside when markets evolve to accommodate altering situations.
New GRC product growth illustrates market progress
In the identical interval, there’s a transparent spike in new GRC merchandise added to G2 in 2022. Whereas a few of that is catching up on merchandise developed earlier however not captured by G2, there’s a transparent divide between earlier than and after 2022.
As an alternative of counting new GRC merchandise by the dozen, we will now depend them by the tons of annually. As of March 2025, there are slightly below 2,000 merchandise on G2 listed in GRC software program classes.
With so many new merchandise flooding the market, it might be shocking to mirror once more on the primary chart, the place we see regular however modest progress within the kinds of merchandise rising. Once more, this can be a reflection of software program distributors creating merchandise which are adaptable to altering market situations.
The variety of new merchandise available on the market displays the rising significance of getting a well-developed GRC program. GRC is a fast-growing trade, which is mirrored within the progress of GRC merchandise, not within the scope of the market itself.
Closely regulated industries make the most of GRC merchandise
We will additionally acquire some insights by trying on the variety of critiques submitted on G2.com for merchandise within the GRC classes. Reviewers choose “Industries” from a dropdown menu when writing GRC product critiques on G2.
Unsurprisingly, the highest industries represented are closely regulated industries, like info expertise and providers (assume GDPR and ISO 27001). Or monetary providers, considering again to SOX. Hospital and well being care is regulated by HIPAA.
There are simply over 20,000 critiques on G2.com for merchandise within the GRC classes. The 5 industries above mirror practically half the entire critiques for GRC merchandise.
Improve in overview counts suggests rising GRC adoption
The numbers are much more stark after we evaluate the variety of critiques submitted in 2018 by reviewers in these similar industries to these submitted in 2024.
This enhance within the variety of critiques submitted in 2018 in comparison with these submitted in 2024 means that extra organizations are recognizing the significance of a well-planned GRC technique and spending cash on software program to assist them obtain their targets.
However what may that seem like if this progress continues in a number of years?
Future: the place GRC is headed (and the way AI matches in)
After all, the subject on everybody’s thoughts is the emergence of AI. We’ve all learn the headlines highlighting moral and authorized considerations surrounding how AI is utilized. From the latest Studio Ghibli model AI artwork technology controversy to the considerations round coaching AI on materials that, usually unintentionally, generates dangerous content material, the potential for harm with out regulation could be very actual. And the pace with which AI expands and improves capabilities means any impactful laws will battle to maintain up.
Nonetheless, the necessity to think about AI threat shouldn’t be restricted to regulatory compliance. Suppose again to the beginning of this weblog. Enron is ceaselessly tainted for these sufficiently old to recollect the controversy. Authorized penalties apart, organizations threat important reputational harm for “doing the unsuitable factor”. Reputational and different much less tangible dangers shouldn’t be minimized.
This highlights organizations’ want for a complete GRC technique. This isn’t a “good to have”; it’s vital. Organizations that proactively account for threat can mitigate losses if and when occasions happen.
Healthcare organizations, for instance, which have sturdy enterprise continuity plans perceive their threat profile and have plans to reply to an occasion, reminiscent of a ransomware assault, that shuts down their enterprise and opens them to fines. On this instance, a healthcare group that may get its enterprise again and working faster and reply in a approach that minimizes additional publicity to regulatory violations is in a significantly better enterprise place than one which doesn’t.
Anticipate to see extra consideration on the government stage to points surrounding threat and compliance as a enterprise technique.
Together with understanding threat and navigating compliance, count on to see extra nimble and customizable GRC platforms available on the market. With the considerations round AI talked about earlier and the challenges adapting to the pace of technological innovation, threat and compliance managers can be challenged to remain in compliance with always evolving regulatory necessities. I count on to see extra regulatory change administration software program available on the market, both as a degree answer or as a extra superior operate of bigger GRC platforms.
Lastly, count on to see extra threat domains emerge. One subject that’s being mentioned is human threat administration. Anybody working in cybersecurity is aware of that your greatest organizational threat is your individuals. 79% of organizations that do safety consciousness coaching skilled a human-related knowledge breach over the previous 12 months. Coaching and consciousness usually are not sufficient to guard a corporation. They should proactively handle human threat past schooling.
What’s subsequent?
Solely time will inform what new threat and compliance concerns will emerge. Will there be a 2020s Enron that reshapes the regulatory panorama? Will that come from AI? How will the market reply? How will rising dangers affect enterprise selections and useful resource allocation? All these unknowns spotlight the significance of a complete GRC technique and the necessity for software program options to help altering environments.
GRC is not the one factor altering. Learn how G2 continues to prioritize innovation within the age of AI and past.
Edited by Supanna Das
