Governance, risk, and compliance is a team sport — in a league where no two teams look alike. This diversity in team structures, responsibilities, and program resources makes GRC benchmarking across organizations and industries challenging — and objectively evaluating your program strategy even more difficult.

To better enable GRC leaders with a clear understanding of what “good” GRC looks like, we surveyed 350 risk, cybersecurity, and compliance leaders worldwide about their program objectives, team structures, processes, and technology investments — and aligned responses to a maturity model to gauge their GRC program maturity and success. 

Key findings:

• GRC is a collaborative undertaking across multiple teams.
• All organizations have work to do to improve their GRC program maturity.
• Organizations spend an average of 1% of annual revenue on their GRC program.
• People and talent expenses represent 46% of the GRC budget.
• Budgets are staying the same or increasing for 80% of organizations.
• Using a single GRC software tool best helps with proactively managing risk. 

For details on how to get yourself a copy, please check out our portfolio.