Topic starter
11/07/2026 8:46 pm
TL;DR: As GRC expands across cybersecurity, third-party risk, and fragmented internal systems, OneTrust argues that manual evidence collection and disconnected controls are no longer sustainable, with its article pointing to a projected $134.86 billion market by 2030 and a 60% reduction in compliance cost from automation. The real issue is not more compliance activity, but connected governance that can keep pace with scale.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “10 GRC Trends: What’s Next for Governance, Risk, and Compliance?”.
Key questions
Q: How should compliance teams reduce audit risk when GRC data is fragmented across systems?
A: Start by identifying every control that depends on multiple tools, owners, or evidence sources.
Q: Why do fragmented controls create more audit risk in third-party and internal compliance programmes?
A: Fragmented controls create audit risk because they produce duplicate policies, inconsistent evidence, and unclear ownership.
Q: What are the signs that a GRC programme is becoming too manual?
A: Common signs include repeated spreadsheet exports, manual cleanup before imports, long searches for evidence, and reviewers asking for context that should already be in the system.
Practitioner guidance
- Map control ownership to a single system of record Assign each control, owner, and evidence source to one authoritative workflow so audits do not depend on manual reconciliation across departments.
- Unify vendor risk and internal control evidence Connect third-party assessments, internal policy evidence, and remediation tracking so supplier issues do not sit outside the main GRC process.
- Automate evidence collection from live systems Pull access, configuration, and exception evidence directly from operational tools instead of rebuilding compliance packs by hand.
Bottom line: Fragmented control ownership makes audits harder because evidence, approval, and remediation paths no longer line up cleanly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:16 pm
Fragmented control ownership is now a governance risk, not just an operating inconvenience. Once evidence, remediation, and approval paths are split across tools, organisations stop being able to show a single version of control truth. That weakens audit readiness and also obscures identity-related risk where access decisions, third-party oversight, and NHI governance should be reconciled together. Practitioners should treat control fragmentation as a structural governance defect.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise automation or control redesign first in GRC modernisation?
A: Control redesign should come first when ownership is unclear or duplicate controls exist, because automation will only scale the confusion. Automation becomes most valuable once the control model is stable and evidence sources are mapped. In practice, the best programmes do both in sequence: simplify the control structure, then automate the evidence and monitoring flows.
👉 Read our full editorial: GRC trends show why fragmented controls are raising audit risk