Michael RasmussenGrc Analyst

There is no pause button for the extended enterprise. I occasionally imagine what would happen if we operated a starship the way some organizations manage regulatory change. An asteroid warning arrives. Someone records it in the appropriate system, assigns an owner, updates the asteroid avoidance policy, and circulates a briefing. A committee requests clarification on whether the asteroid falls within the existing taxonomy.

Artificial intelligence has arrived in governance, risk management, and compliance with all the subtlety of a marching band entering a library. Every GRC technology provider now has an AI story. Copilots summarize policies. Large language models draft risk statements. Algorithms classify issues, map controls, review evidence, analyze regulatory change, interrogate documents, and identify patterns across mountains of information that previously required hours of human effort.

Third-party risk management has spent years perfecting the art of assessing vendors. We classify them, tier them, send questionnaires, collect evidence, review findings, assign scores, and place them neatly into red, amber, and green boxes. We then report how many assessments were completed, how many issues remain open, and how many suppliers have been designated high risk. It is an impressive administrative machine. It is also too often disconnected from how third-party risk affects the business.