TL;DR: As GRC expands across cybersecurity, third-party risk, and fragmented internal systems, OneTrust argues that manual evidence collection and disconnected controls are no longer sustainable, with its article pointing to a projected $134.86 billion market by 2030 and a 60% reduction in compliance cost from automation. The real issue is not more compliance activity, but connected governance that can keep pace with scale.
At a glance
What this is: OneTrust says fragmented GRC controls, siloed data, and manual evidence collection are making audit work harder as compliance scope expands across cybersecurity and third-party risk.
Why it matters: Compliance and security teams need connected control evidence, because disconnected systems create duplicate controls, slower audits, and weaker visibility across third-party and internal risk.
By the numbers:
- The total GRC software market is projected to reach $134.86 billion by 2030.
Context
GRC now sits at the intersection of cybersecurity, third-party risk, regulatory change, and internal control evidence. As organisations add more systems, more suppliers, and more compliance obligations, fragmented control ownership makes it harder to prove what is working, where gaps exist, and whether evidence is current.
For identity and access programmes, the GRC problem is not just policy volume. It is the inability to reconcile access, control attestations, and risk decisions across separate systems, which becomes more visible when NHI governance, third-party access, and audit evidence all need to line up at once.
Key questions
Q: How should compliance teams reduce audit risk when GRC data is fragmented across systems?
A: Start by identifying every control that depends on multiple tools, owners, or evidence sources. Then consolidate the evidence path into one governed workflow so auditors can trace each obligation from requirement to proof without manual reconciliation. The goal is not just efficiency. It is a control model that preserves lineage and makes exceptions visible before they become audit findings.
Q: Why do fragmented controls create more audit risk in third-party and internal compliance programmes?
A: Fragmented controls create audit risk because they produce duplicate policies, inconsistent evidence, and unclear ownership. When the same obligation is tracked in multiple places, teams spend time reconciling records instead of proving control effectiveness. That weakens assurance across vendor risk, identity governance, and internal security programmes, especially when access decisions change faster than the audit cycle.
Q: What are the signs that a GRC programme is becoming too manual?
A: Common signs include repeated spreadsheet exports, manual cleanup before imports, long searches for evidence, and reviewers asking for context that should already be in the system. When those patterns become normal, the programme is compensating for workflow gaps rather than operating cleanly. That usually means the platform is not preserving state well enough for daily governance.
Q: Should organisations prioritise automation or control redesign first in GRC modernisation?
A: Control redesign should come first when ownership is unclear or duplicate controls exist, because automation will only scale the confusion. Automation becomes most valuable once the control model is stable and evidence sources are mapped. In practice, the best programmes do both in sequence: simplify the control structure, then automate the evidence and monitoring flows.
Technical breakdown
Why fragmented GRC control mapping creates audit drag
When control data lives in separate tools and business units, teams often build duplicate controls around the same obligation and then spend audit cycles reconciling the differences. That fragmentation also breaks traceability, because evidence, control owners, and remediation status are no longer tied to one governed record. In practice, audit delays are less about the number of controls than about the inability to show a consistent lineage from requirement to control to evidence. In identity-heavy environments, that problem extends to user access, service accounts, and third-party access reviews.
Practical implication: Centralise control ownership and evidence lineage so audit testing can trace each obligation to one authoritative record.
How integrated GRC architecture changes the control model
An interconnected GRC architecture treats risks, controls, and evidence as related objects rather than separate reporting tasks. That matters because modern enterprises move data, workloads, and dependencies across cloud, SaaS, and third-party services, which means control mapping has to adapt continuously instead of being rebuilt for every audit. The technical shift is from static compliance packets to dynamic control relationships that can be updated as systems change. That is especially relevant where identity controls, vendor access, and workload permissions are managed in different platforms.
Practical implication: Design control mappings to update with system and access changes instead of waiting for audit season.
Why automation matters more than more manual review
Manual compliance processes scale poorly because they depend on repeated evidence gathering, ad hoc coordination, and human memory across multiple teams. Automation does not remove the need for judgement, but it does change where effort is spent, moving teams away from chasing screenshots and spreadsheets toward monitoring exceptions, control drift, and missing evidence. For IAM and NHI programmes, that shift is important because access records and attestations age quickly, especially when service accounts, vendors, and application owners change frequently.
Practical implication: Automate evidence collection and exception monitoring so teams spend time on control failures, not document chasing.
NHI Mgmt Group analysis
Fragmented control ownership is now a governance risk, not just an operating inconvenience. Once evidence, remediation, and approval paths are split across tools, organisations stop being able to show a single version of control truth. That weakens audit readiness and also obscures identity-related risk where access decisions, third-party oversight, and NHI governance should be reconciled together. Practitioners should treat control fragmentation as a structural governance defect.
Connected GRC will increasingly be the operating model for identity-adjacent risk. As third-party access, workload permissions, and application controls converge, disconnected compliance workflows become too slow to support real oversight. The article reflects a broader market shift toward continuous evidence and shared control mapping, which aligns with how modern IAM and NHI programmes already need to operate. Practitioners should expect audit evidence to move closer to runtime control data.
Duplicate controls hide gaps as often as they reduce them. When teams build overlapping policies to satisfy different frameworks, they can create the appearance of maturity while leaving ownership unclear. That is especially dangerous in extended enterprise environments where supplier access, internal approvals, and machine identities are governed in separate places. Practitioners should look for control overlaps that do not share the same evidence source.
OneTrust's figures reinforce that scale is forcing governance re-architecture. The projected $134.86 billion market and the emphasis on automation point to a simple reality: GRC programmes are being asked to do continuous coordination across broader risk surfaces. That expands the importance of identity-linked evidence, because access and control decisions now span people, vendors, workloads, and automated processes. Practitioners should align compliance architecture with how risk is actually distributed, not how teams are organised.
From our research library:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Security Platform Buyer's Guide
What this signals
Connected evidence is becoming the practical test of GRC maturity. The article's message is not that teams need more controls, but that controls need to be mapped, shared, and monitored across systems that now change too quickly for manual stitching. That is a direct signal for IAM, NHI, and third-party access owners: evidence has to follow the control, not the org chart.
Identity governance becomes harder when compliance stays siloed. Access decisions, vendor approvals, and machine identity oversight all create evidence that can be lost if GRC tooling cannot absorb it into one workflow. The next generation of compliance programmes will be judged on whether they can prove control effectiveness across people, workloads, and suppliers without rebuilding the record each time.
AI governance is already shifting toward the teams closest to infrastructure, with 52% of respondents seeing decision-making power move away from the executive suite. That pattern matters here because governance pressure is moving toward operational owners who can actually connect controls, evidence, and runtime data. Practitioners should expect compliance work to sit closer to platform and identity teams, where the evidence really lives.
For practitioners
- Map control ownership to a single system of record Assign each control, owner, and evidence source to one authoritative workflow so audits do not depend on manual reconciliation across departments.
- Unify vendor risk and internal control evidence Connect third-party assessments, internal policy evidence, and remediation tracking so supplier issues do not sit outside the main GRC process.
- Automate evidence collection from live systems Pull access, configuration, and exception evidence directly from operational tools instead of rebuilding compliance packs by hand.
- Track control overlaps and duplicate policies Review frameworks and internal policies for duplicated controls that create conflicting ownership or redundant reporting.
Key takeaways
- Fragmented control ownership makes audits harder because evidence, approval, and remediation paths no longer line up cleanly.
- The article points to a large and still-expanding GRC market, which reflects how compliance scope is broadening across internal and third-party risk.
- Compliance teams should simplify the control model first, then automate evidence collection and monitoring so governance scales without more manual work.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organisational Context | The article is about governance scope, control ownership, and compliance operating models. |
| GV.RM-01 — Risk Management Strategy | The post stresses programme-wide risk decisions across fragmented controls and third parties. | |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity and access evidence is part of the compliance problem when controls are fragmented. | |
| Recommendation — Use GV.OC-01 to align GRC scope, control ownership, and evidence collection to business context. Use GV.RM-01 to set a risk strategy that links control evidence to enterprise priorities. Use PR.AA-05 to keep access entitlements and audit evidence under one governed control path. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account governance and evidence collection are central to audit readiness in this article. |
| Recommendation — Apply CIS-5 to standardise account ownership, review cadence, and evidence retention. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The article focuses on evidence collection, audit progress, and control visibility. |
| Recommendation — Use AU-6 to review audit evidence centrally and detect gaps before assessments begin. | ||
Key terms
- Grc Architecture: The structure that connects governance, risk, control, evidence, and reporting across an organisation. In practice, it determines whether compliance is assembled manually from isolated systems or maintained as a continuously traceable operating model.
- Shared Evidence Model: A common structure for collecting and reusing control evidence across multiple governance functions. It reduces duplicate testing, improves traceability, and helps privacy, security, and compliance teams assess the same control performance from a single authoritative source.
- Control Mapping: Control mapping is the process of linking internal policies and technical controls to external requirements such as NIST or ISO 27001. For identity programmes, it turns access reviews, rotation, and offboarding into evidence that can be tested, reported, and audited.
- Third Party Risk: Third party risk is the chance that an outside organization, supplier, contractor, or service provider will create harm for your business. It includes security, privacy, operational, legal, and compliance exposure caused by access to data, systems, or processes. In identity terms, it often arises from shared credentials, integrations, and delegated trust.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps practitioners connect identity controls to the wider governance and compliance programmes they already run.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org