The days of simple business operations are long behind us. Today’s organizations face rapid growth, evolving risks, shifting regulations, globalization, and a flood of technology and data. For a GRC board, keeping strategy, performance, and risk aligned amid all this complexity is no small feat.

The board's role in GRC has never been more critical — helping executives and management teams navigate uncertainty and stay in sync with constant change.

GRC (governance, risk management and compliance)

 by definition starts with the G for governance. Because of the board's role in corporate governance, one would think that GRC is a 

 and initiative. However, the opposite is most often the case. It is the R for risk management and C for compliance that drive most GRC initiatives — and fail to engage senior executives and the board who ultimately have fiduciary obligations for all aspects of GRC.

This article explores how boards can lead effective GRC strategies by covering:

What the board's role in GRC encompasses and why board leadership matters

How governance, risk management and compliance interconnect at the board level

The shortcomings of siloed, department-led GRC approaches

The benefits of board-driven, integrated GRC strategies

How boards enable organization-wide GRC excellence

How AI-powered platforms transform board-level GRC oversight

 role in GRC encompasses setting strategic direction, approving risk appetite, ensuring adequate resources and holding management accountable for GRC performance across the enterprise.

Boards hold ultimate accountability for governance, risk management and compliance — a responsibility that cannot be delegated despite operational execution residing with management.

This accountability has intensified as regulatory scrutiny increases and stakeholders demand greater transparency. According to 

 conducted by Corporate Board Member, FTI Consulting and Diligent Institute, strategy has emerged as the most challenging issue for directors to oversee at 42%, surpassing cybersecurity for the first time in years.

Additionally, 24% of directors identify enterprise risk management as a significant oversight challenge, reflecting the complexity boards face in connecting GRC activities to strategic objectives.

The board's role now extends beyond reviewing periodic reports to actively shaping how organizations approach governance, risk and compliance as interconnected disciplines.

 establish clear expectations for the information they need, create accountability structures that ensure management execution, and continuously evaluate whether GRC investments deliver value in proportion to the resources consumed.

Setting strategic direction for GRC programs

 that shapes how organizations make decisions, allocate resources and hold leadership accountable. This includes:

Approving risk appetite statements that clarify acceptable risk-taking parameters

Establishing governance structures that align with business strategy

Ensuring compliance programs reflect organizational values and stakeholder commitments

Strategic direction requires boards to understand how GRC activities support business objectives rather than viewing governance, risk and compliance as separate compliance exercises.

, drives principled performance. It represents an organization's capability to reliably achieve objectives (

), while addressing uncertainty (risk management) and acting with integrity (compliance). The flow starts with governance, which provides context for risk management and compliance.

This is the governance function of GRC — to set, direct and govern the reliable achievement of objectives. Objectives can be overall entity-level objectives, but also can be divisional, departmental, project, process or even asset-level objectives.

Governance involves directing and steering the organization to reliably achieve objectives.

 defines risk as "the effect of uncertainty on objectives." Good risk management is done in the context of achieving objectives — to optimize risk-taking to ensure that the organization creates value.

This is the compliance function of GRC. It extends beyond regulatory compliance to encompass the organization's adherence and integrity in meeting its commitments and obligations.

These commitments and obligations can stem from regulations, but also can be found in ethical statements, values, codes of conduct, ESG commitments and contracts.

As you can see, GRC by definition and concept flows from governance into risk management and compliance. However, most organizations implement GRC strategies that start with risk and compliance and fail to connect or even consider governance. Boards have both the responsibility and authority to correct this fundamental misalignment.

The shortcomings of a siloed approach to GRC

"There needs to be collaboration between risk and the business, vertically up and down, but then also horizontally across the organization. It is absolutely essential — collaboration across risk departments. The problem is that there are silos. Risk and audit are interconnected and interdependent. Collaboration helps provide audit's perspective, their insight across company policies and procedures that help improve risk's function," says Michael Rasmussen, CEO of GRC Report.

Rasmussen identifies the fundamental challenge facing most organizations: GRC functions operate in isolation when they should work as an integrated system. When risk management, audit and compliance teams maintain separate processes and reporting structures, organizations lose the critical connections between these disciplines.

A compliance issue may signal broader risk exposures, while an audit finding may reveal governance gaps that affect strategic decision-making. These relationships remain invisible when teams work in departmental silos.

This interconnectedness and demand for contextual awareness apply to the world of business. Organizations need contextual awareness of GRC to understand the intricate relationships among objectives, risks and integrity across the enterprise.

Without this integrated view, boards cannot effectively oversee how governance decisions impact risk exposure, how compliance obligations constrain strategic options or how risk-taking aligns with approved objectives.

The core issue is that in GRC, the ‘G’ often goes silent. Too frequently, organizations approach GRC from a compliance, audit or risk perspective, leaving governance buried deep within departments instead of driving a top-down, board-led strategy.

True GRC should be an integrated discipline that connects governance with performance and decision-making at the highest level.

Organizations need to understand how to monitor risk-taking in the context of governance and objectives, measure whether associated risks taken are the right risks to achieve objectives, and review whether risks are effectively managed.

The benefits of a board-driven, integrated approach to GRC

Organizations that take a board-driven approach to GRC led from the top realize significant advantages in organizational performance, risk management effectiveness and compliance maturity.

These benefits extend beyond avoiding regulatory penalties to creating competitive advantages through superior governance infrastructure.

When boards actively lead GRC strategies, organizations become:

 Leaders have a finger on the pulse of the business and watch for changes in internal and external environments that introduce risk to objectives. Key to this is the ability to turn data into information that can be analyzed and shared in every relevant direction.

Boards need synthesized intelligence that highlights significant exposures, emerging threats and risk appetite alignment — not raw data dumps from operational departments.

 They align performance, risk management and compliance to support and inform business objectives. This requires continuously aligning objectives and operations of the 

 capability to those of the entity, and giving strategic consideration to information from GRC management capabilities to effect appropriate change.

The What Directors Think 2025 report reveals that only 30% of directors rate their board's ability to understand the company's long-term strategy as "excellent," evidencing the challenge with maintaining this alignment.

 Organizations cannot react to something they do not sense. Mature GRC management focuses on gaining greater awareness and understanding of information that drives decisions and actions, improves transparency, and quickly cuts through the morass of data to uncover what an organization needs to know to make the right decisions.

 and the board require the organization to be more than fast — they need it to be nimble. Being fast isn't helpful if the organization is headed in the wrong direction. GRC enables decisions and actions that are quick, coordinated and well thought-out.

Agility allows an entity to use GRC to its advantage, grasp strategic opportunities and be confident in its ability to stay on course.

 The best-laid plans fail. Organizations need to be able to bounce back quickly from changes in context and risks with limited business impact. They need sufficient tolerances to allow for some missteps and have the confidence necessary to adapt and respond to opportunities rapidly.

"Resilience is key," says Lisa Bougie, speaker at Diligent Institute's Elevate Leadership Summit. "To build resilience, an organization needs to both acknowledge known risks and appreciate the reality of uncertainty. Scenario planning can help to ensure an organization is as prepared as possible when the unexpected hits."

 They build business muscle and trim unnecessary expense from duplication, redundancy and misallocation of resources — making the organization leaner overall with enhanced GRC capability and related decisions about resource application.

Discover how modern platforms unify governance, risk and compliance oversight for board-level decision making.

Enhance your GRC integration

How boards can enable organization-wide GRC excellence

Beyond setting strategic direction, boards must create organizational conditions that enable effective GRC execution.

This requires establishing governance structures, allocating resources appropriately, ensuring management accountability and continuously evaluating program effectiveness.

Boards should define explicit accountability for governance, risk management and 

 activities across the organization. This includes clarifying:

Which executives own specific GRC domains

What escalation paths exist for significant issues

How information flows from operational activities to board oversight

Effective governance structures also address committee responsibilities. Many boards are reevaluating committee structures to ensure they don't overburden audit committees with expanding GRC responsibilities.

Diligent’s 2025 Risk and Opportunity Outlook report

 emphasizes that "the winners will be the companies that recognize that risk and opportunities need to be standing discussion topics on the board agenda. Think about changing your committee structure to reflect this — and make sure that you aren't throwing everything under the Audit Committee's purview."

Ensure adequate capabilities and technology

 that provide boards with real-time visibility into risk exposure and compliance status.

The What Directors Think 2025 survey reveals that 37% of directors believe implementing new tools and technology at the board level would help modern boards function better, ranking third among all potential improvements.

"Tell the board what they need to know, not what you know," says David Platt, Chief Strategic Development Officer at Moody's.

This principle recognizes that boards need synthesized intelligence delivered through technology platforms that aggregate data from across the enterprise and present actionable insights rather than overwhelming detail about departmental activities.

Create feedback loops for continuous improvement

Board-driven GRC requires mechanisms for learning from incidents, near-misses and changing conditions.

Organizations should establish processes for capturing lessons learned, updating risk assessments based on new information, and adjusting governance structures as business strategy evolves.

"2025 is the year we put the 'G' back in ESG," notes Pav Gill, CEO of Confide. "The strongest defense against emerging risks lies in sound, well-structured governance systems."

The takeaway? Governance infrastructure creates the foundation for effective risk management and compliance — not the reverse.

Effective GRC requires partnership between boards and management rather than adversarial oversight relationships. Boards should create environments where management feels comfortable escalating emerging risks, admitting uncertainties and requesting resources for capability development.

The What Directors Think survey reveals shifting board information needs. Beyond the CEO and CFO, 35% of directors want to hear more from the Chief Human Resources Officer, 31% from the Chief Marketing Officer, and 24% from the Chief Technology Officer.

This diversification of board-management dialogue reflects the expanding scope of GRC oversight beyond traditional financial and legal domains.

For boards navigating today's complex GRC landscape, AI-powered governance platforms provide the integrated visibility and intelligence needed to fulfill oversight responsibilities effectively.

These solutions address the fundamental challenge where most organizations maintain siloed GRC and finance systems, preventing comprehensive risk visibility.

Unified GRC visibility for strategic oversight

 delivers comprehensive GRC capabilities that integrate board management, enterprise risk management, compliance tracking and audit activities in a single unified interface.

This consolidation enables boards to see how governance decisions impact risk exposure, how compliance obligations constrain strategic options and how risk-taking aligns with approved objectives.

The platform's board-ready reporting templates synthesize data from across the enterprise into actionable intelligence.

AI-powered analytics identify significant patterns, emerging threats and risk appetite deviations that require board attention, rather than overwhelming directors with operational detail.

AI-enhanced board meeting preparation and decision support

 transforms board engagement with GRC oversight through AI-powered preparation capabilities. Smart Risk Scanner automatically identifies risky language and legal red flags in board materials before meetings, while Smart Prep Insights generates pointed questions by topic with supporting citations.

Additionally, Smart Builder reduces board preparation time, eliminating manual compilation burden and enabling boards to focus meeting time on substantive GRC discussions.

The board's role in leading and enabling GRC

 program, a chief risk officer (CRO) is critical. They oversee the organization's risk management processes and understand what risks need to be identified and mitigated. But if compliance risks aren't properly assessed, the CRO may not see them until a regulatory enforcement action occurs.

A CRO is just that — focused on enterprise risks generally. They need the assistance of a chief compliance officer (CCO) and internal auditors — specialists — to get a real view of the compliance and control risks to the organization. The same principle applies to enterprise risk and compliance.

There's currently a debate about whether compliance should be subsumed into a singular risk function. The market is moving toward integrated ERM-compliance models where compliance maintains independence while its risk assessment process works in seamless coordination with enterprise risk management.

However, the execution gap remains significant — while 59% of organizations report improved coordination benefits per 

, only 16% have successfully integrated data systems, according to a 

This comprehensive guide explains the critical balance between compliance independence and risk integration, covering:

The relationship between enterprise risk and compliance teams?

Why compliance risk requires specialized expertise and separate governance

10 best practices for enterprise risk and compliance coordination

How AI-powered governance, risk and compliance (GRC) platforms transform enterprise risk and compliance management

What is the relationship between enterprise risk and compliance teams?

Enterprise risk and compliance teams operate as coordinated but independent functions. Enterprise risk aggregates and reports on all organizational risks to support 

, while compliance independently manages regulatory and legal risk through specialized expertise and direct board oversight. They share data and align on risk priorities but maintain separate accountability structures.

Think of enterprise risk as the orchestra conductor and compliance as the lead violinist. The conductor needs the violinist's expertise and the violinist benefits from the conductor's broader perspective, but the violinist must maintain independent judgment about their performance.

Strategic context connecting compliance risks to business objectives

Risk appetite frameworks that guide compliance control decisions

Coordination mechanisms between compliance, audit and operational risk functions

Specialized expertise in regulatory requirements and legal obligations

Direct board access for material compliance matters

Authority to challenge business decisions based on regulatory considerations

1. Shared visibility, separate accountability:

 Both teams need access to the same risk information, but they use it differently. Enterprise risk synthesizes compliance data into strategic risk reporting for the C-suite, while compliance maintains detailed regulatory risk registers that require specialized interpretation.

 Compliance coordinates with enterprise risk without reporting through it. This distinction matters because regulators evaluate whether compliance has sufficient independence to challenge business decisions and escalate concerns directly to the board. A compliance function that reports exclusively through enterprise risk fails this independence test.

3. Integration of systems, not organizations:

 The teams should share technology platforms, risk taxonomies and reporting calendars. This integration enables efficient collaboration. However, organizational integration — making compliance a division within enterprise risk — compromises the independence that regulatory guidance requires and effective compliance programs demand.

Corporate compliance departments manage a critical subset of enterprise risk. These include bribery, antitrust, trade compliance, data privacy, modern slavery, conflict minerals and 

. The laws governing these areas carry severe consequences — fines in the billions and the imposition of corporate monitors for several years when companies act unethically.

This regulatory landscape has intensified. Beyond traditional compliance domains, organizations now face complex requirements around ESG disclosure (

Corporate Sustainability Reporting Directive

 in the EU), AI governance and supply chain due diligence (

EU Corporate Sustainability Due Diligence Directive

These emerging areas demand specialized expertise that extends beyond general risk management capabilities.

Enterprise risk management can work effectively with the compliance function to ensure compliance risk is understood and appropriately addressed. Here are ten best practices to ensure smooth sailing.

, C-suite, enterprise risk management lead and chief compliance officer need alignment on risk appetite before implementing any controls. Risk appetite defines the organization's tolerance for risk — some companies embrace a "move fast" mentality while established enterprises maintain conservative approaches.

Defining risk appetite is critical for ensuring enterprise risk and compliance work with the same expectations. Strict compliance controls can slow business processes. For instance, comprehensive due diligence on high-risk third parties may delay important contracts. The board and C-suite must articulate the company's risk appetite, enabling enterprise risk and compliance functions to determine appropriate control stringency.

2. Compliance completes separate risk assessments

Globally, regulators expect companies to have compliance-specific risk assessments from which compliance programs are built. The

 instructs prosecutors to evaluate the effectiveness of the company's risk assessment and how the compliance program has been tailored based on that assessment. 

 requires bribery-related risk assessments to defend against strict liability offenses.

The compliance risk assessment should be separate from enterprise risk to conform to regulatory expectations. At a high level, compliance risks should appear on the enterprise-wide risk register. However, compliance should maintain a detailed risk register that feeds into the enterprise-wide one but includes specific details about risk and mitigation plans that require specialized compliance expertise to interpret and manage effectively.

3. Leverage AI and data analytics for continuous monitoring

Traditional periodic compliance reviews no longer satisfy regulatory expectations or business needs. Leading organizations implement AI-powered continuous monitoring that analyzes 100% of transactional data rather than relying on sampling methodologies.

 enables compliance teams to identify emerging patterns, detect anomalies in real time and respond proactively to potential violations before they escalate. This shift from periodic to continuous oversight represents a fundamental transformation in how enterprises manage compliance risk at scale.

4. Define clear ownership for cross-functional risks

Some risks necessarily span multiple functions. Managing modern slavery and human trafficking risk often involves compliance, 

 and procurement departments. Risks that bleed across departments must have a primary owner assigned. As the saying goes, the fastest way to starve a pet is to give everyone the responsibility to feed it.

Document these ownership arrangements explicitly. Create RACI matrices (Responsible, Accountable, Consulted, Informed) that clarify who owns risk identification, assessment, mitigation and monitoring for each cross-functional compliance domain. Review and update these assignments annually as the organization evolves.

Guidance from regulators is clear: Compliance needs an independent relationship with the board. The DOJ specifically instructs prosecutors to assess whether compliance has direct access to the board of directors or the audit committee.

Allowing enterprise risk to report exclusively on compliance risk creates communication breakdowns. No matter how skilled the enterprise risk manager, the depth of knowledge required to explain compliance risk and risk-based approaches will be missing when filtered through another function.

Compliance should always have access to and be able to report to the board. This is critical in three instances:

When the company's compliance risk profile changes

: If the company expands into new regions or creates new product lines, new compliance risks emerge that require direct board briefing

When major compliance laws come into effect

: The compliance lead should report on new regulations and the implementation plan to address them

When significant investigations or allegations of misconduct occur

: Direct reporting ensures board oversight without delay or filtering

Many organizations now use dual reporting lines where compliance reports operationally to the CEO but functionally to the audit committee. This structure maintains independence for governance oversight while enabling effective operational coordination.

Beyond traditional compliance areas, organizations must now address:

: Implementing policies for responsible AI development, deployment and monitoring

: Managing increasingly complex sustainability reporting requirements across multiple jurisdictions

 compliance with broader enterprise risk frameworks

These emerging domains require the same rigorous risk assessment and independent oversight as traditional compliance areas. Yet many organizations struggle with this integration — particularly around AI governance.

 from Corporate Board Member and Diligent Institute, while 29% of companies report having comprehensive AI governance policies and another 38% are drafting them, 44% acknowledge their policies need refinement and 33% say they're entirely insufficient.

“Organizations leading the way in compliance are leveraging technology and procedural reviews not just to meet regulatory obligations but also to strengthen their overall risk posture,” says Kristy Grant-Hart, Vice President and Head of Advisory Services for Spark Compliance, a Diligent Brand. “When companies prioritize advanced compliance tools and ongoing risk assessments, they're better equipped to anticipate regulatory changes and minimize exposure to emerging risks.”

Organizations should conduct gap assessments to determine whether existing compliance structures adequately address these evolving requirements or whether specialized resources are needed.

7. Coordinate systematically with internal audit

It's impossible to know how the controls work without testing them. Enterprise risk and compliance should work with 

 to ensure perceived risks are explored and control failures are investigated. Compliance should champion and devise risk mitigation strategies while the internal audit team validates their implementation effectiveness.

This coordination requires regular communication and shared planning. Quarterly meetings between compliance, risk and audit leadership should review:

Upcoming compliance assessments and audit plans

Control deficiencies identified in recent audits

Emerging risks requiring new control frameworks

Technology implementations affecting risk and compliance monitoring

Enterprise risk can stay apprised of this progress while allowing compliance to be primarily responsible for such activity.

8. Implement unified GRC technology platforms

Siloed point solutions for risk, compliance and audit create integration challenges that undermine effective enterprise compliance risk management. Disparate systems lead to duplicative data entry, inconsistent reporting and gaps in oversight where risks fall between functional boundaries.

 platforms enable collaboration through shared data, standardized risk taxonomies and integrated workflows while maintaining functional independence through role-based access controls and distinct reporting structures. This technology architecture supports the organizational principle of integrated data with independent accountability.

Discover how integrated GRC platforms enable coordination between risk, compliance, and audit functions.

Transform your GRC approach

9. Build board-ready reporting capabilities

Effective enterprise compliance risk management requires reporting that provides boards with clear visibility into compliance risk without overwhelming them with operational details. 

Highlight material changes in the compliance risk profile

Visualize risk through heat maps and trend analysis

Demonstrate control effectiveness through key performance indicators

Provide clear action items when board decisions are required

Automated reporting capabilities reduce the time compliance teams spend compiling board materials while improving consistency and quality. Templates and dashboards should be configured to answer the questions boards actually ask rather than providing generic compliance status updates.

10. Develop metrics that demonstrate compliance program effectiveness

: How quickly potential violations are detected and remediated

: Not just attendance, but actual knowledge transfer

: Percentage of high-risk vendors subject to appropriate due diligence

: Trends in control effectiveness across compliance domains

: Reports received and how they're investigated

These metrics should inform continuous improvement efforts rather than serving solely as reporting statistics. Quarterly reviews of compliance metrics should drive discussions about resource allocation, program enhancements and emerging risk priorities.

How AI-powered GRC platforms transform enterprise risk and compliance management

For organizations managing complex regulatory requirements across global operations, integrated governance technology addresses the coordination and independence challenges documented throughout this guide.

 provides enterprise-grade risk management with AI-powered risk identification that benchmarks against 180,000+ real-world risks from SEC filings and 

The platform enables comprehensive risk orchestration across business units and geographies while maintaining clear accountability structures. FedRAMP authorization and DoD IL5 certification support organizations with stringent security and compliance requirements.

 through Diligent combines AI-powered compliance assistance with Regology's continuously updated regulation library. The AI compliance assistant analyzes regulatory changes, identifies key requirements and suggests mitigating controls — addressing the regulatory monitoring burden that enterprise compliance teams face across multiple jurisdictions.

 unifies these capabilities into a single GRC ecosystem, eliminating the integration challenges created by disparate point solutions. Board-ready reporting templates deliver consolidated views of risk and compliance to directors while maintaining the detailed audit trails that regulators expect.

Enterprise risk and compliance: 10 best practices to optimize the relationship

Ten insights shaping boards in the year ahead

Boards entered 2025 facing rising risk, economic volatility, and an urgent mandate to modernize oversight. At Diligent, we recently hosted the Elevate Leadership Summit, a by‑invitation gathering of corporate directors and executives alongside a curated set of experts, for confidential, Chatham House Rule-style discussions to dissect these issues and look to the future of corporate governance.

Across sessions, a clear through‑line emerged: the most effective boards are shifting from moving from passive oversight to active, data‑driven governance with disciplined processes and human judgment at the center. Here’s what our expert speakers and experienced director attendees had to say about the trends to watch out for in 2026:

1) From passive to active GRC—augmented by AI

Active GRC is replacing passive oversight as directors confront increasing risk and low confidence in near‑term conditions. Speakers suggested augmenting teams with AI agents to handle foundational tasks and “ask the next question,” freeing leaders to focus on strategy amid resource constraints.

2) AI governance: Measure what people actually do 

The biggest AI risk isn’t only technical, it’s invisible usage. AI governance should incorporate real usage metrics, not just periodic sentiment surveys, and pair cultural encouragement (safe experimentation and knowledge‑sharing) with “lighthouse” projects that prove measurable value to employees and shareholders.

Diligent

Blog

The board's role in leading and enabling GRC

Enterprise risk and compliance: 10 best practices to optimize the relationship

Your Data Matters