This Is GRC · Pierre-Paul Ferland
GRC should help people make better decisions about the systems they build, the vendors they use and the risks they take. That means understanding the work well enough to show up before a problem becomes an audit finding.
AI can finally help us keep up with what is happening across a company. It can read and connect information at a scale we cannot. The opportunity is to spend less time collecting evidence and more time advising the people who can act.
What we believe in ↓Explore the demos →
Pierre-Paul Ferland · GRC practitioner, builder and educatorThe case for relevant GRC
A good GRC team gives more to the business than it asks from it.
Too often, we send another questionnaire, collect another screenshot and return a framework reference. Meanwhile, the company changes. Data moves, permissions grow, vendors take on new work and teams make decisions without us.
I want GRC close enough to the technology and the people to notice those changes early. Then we can ask a useful question, explain the risk in the company's own context and help someone choose what to do. That is proactive, advisory work.
What we believe in
Build GRC around decisions people need to make, not forms they need to fill.
AI can compare a new vendor permission, a contract change and a security finding, then work out which combination matters for how this company actually uses that vendor. It can bring the few relevant findings to a practitioner with the reason behind each one. That gives us time to advise, instead of spending the week gathering and sorting information.
See the GRC demos →Framework parrots and checkmark collectors belong to the past.
If customer data starts flowing to a new system, a control number will not tell you whether that is safe. You need to understand the data flow, ask engineers what changed and know the people who can help fix it. Technical fluency, curiosity and relationships matter more than another perfect spreadsheet.
Read GRC is Technical →We should expect more from this profession, and make the case for it in public.
I write, teach and speak about GRC that understands technology, uses AI with judgment and gives people something useful back. I want more practitioners to see what this job can become, and more organizations to ask for it.
See talks and webinars → · Read the writing →