Governance, Risk, and Compliance: Navigating the Challenges

Governance, Risk, and Compliance (GRC) represent foundational pillars for corporate integrity. However, achieving excellent GRC has proven elusive for many organizations. McKinsey’s 2025 Global GRC Benchmarking Survey underscores this sentiment, revealing that for a significant number of companies, robust GRC remains a continually evolving goal.

Identifying Common Challenges in GRC

Despite efforts to enhance GRC frameworks, many businesses report persistent deficiencies. Key issues identified across various industries include:

• Limited technology enablement
• Insufficient resourcing for oversight functions
• The fluidity of regulatory requirements

Survey Insights: Approaches to Governance

In our survey of 193 corporate leaders, a diverse range of governance frameworks was observed. Notably:

• 50% of leaders adopt a strategic board archetype.
• 72% incorporate multiple subcommittees to strengthen governance.
• 55% emphasize board diversity, drawing expertise from various sectors.

Typically, the board and CEO retain ultimate approval authority, shaping strategies, financial matters, and risk management policies. Yet, reliance on broader management for risk management responsibilities—which 38% of respondents reported—can dilute GRC maturity.

Risk Management Across Industries: A Comparative Analysis

Our study indicates that executives view risk management capabilities as generally insufficient, with an average self-assessed capability score of 2.6 out of 4.0. However, the insurance industry stands out, reporting a maturity score of 3.2. This suggests that financial services have advanced more swiftly in response to regulatory pressures stemming from past crises.

For instance, 67% of leaders in the life sciences sector acknowledged the absence or inadequacy of a well-defined risk appetite, while 54% in the travel, logistics, and infrastructure sectors echoed similar concerns regarding the implementation of stress testing methodologies.

Compliance Challenges: A Moving Target

Overall compliance management remains in need of enhancement, revealing an average maturity score of 2.9. Industries such as travel, logistics, and advanced manufacturing notably lag behind, while insurance firms report higher confidence, scoring 3.4.

Crucial areas for improvement within compliance management include:

• Documentation of compliance controls
• Systematic monitoring
• Effective sanctions management

Common Pitfalls in GRC Implementation

Despite recognizing the importance of effective GRC systems, many companies fail to fully leverage available technology. According to our survey:

• 42% of respondents indicated that their utilization of IT and GRC systems requires enhancement.
• 66% of risk management teams comprise 20 or fewer full-time employees.
• 62% of compliance teams are similarly constrained by their small size.

Five Imperatives for Achieving GRC Excellence

To evolve towards GRC excellence, organizations can implement several fundamental strategies:

1. Establish a Strong Tone at the Top

Effective governance often begins with senior management involvement. The absence of C-suite roles focused on risk and compliance tends to correlate with lower levels of maturity. Companies should ensure executive representation in these areas to bolster GRC performance.

2. Adopt a Strategic Perspective in Risk Management

A balanced approach that integrates day-to-day operations with strategic oversight is vital. Organizations should cultivate a top-down perspective on risk management, employing techniques like scenario planning and stress testing to enhance their foresight.

3. Address Fundamental Gaps

Companies must clarify their performance metrics and persistently measure GRC contributions to value creation. Implementing a structured roadmap for improvement, rather than waiting for crises to prompt change, is essential.

4. Leverage Technology Effectively

Innovation in technology is crucial. Organizations should leverage AI and other smart tools to maximize the potential of GRC systems, enhancing efficiency and compliance capabilities.

5. Align Incentives with Compliance and Risk Objectives

Embedding risk and compliance targets within leadership compensation structures encourages a stronger GRC culture. This method fosters transparency and ensures that decision-makers prioritize compliance and risk management in strategic planning.

Conclusion

The findings from McKinsey’s GRC survey illustrate a mixed landscape: while progress is evident, many organizations still have significant challenges to address. By adopting a strategic approach that pairs sound governance with robust risk management and compliance practices, firms can navigate the complexities of an unpredictable environment more effectively.