The Road Ahead: Key GRC Trends Shaping 2025

Introduction

2024 was marked by escalating risks on multiple fronts, rapidly evolving regulations, and increasing cost of cyber-attacks. There was a 75% increase in cyber attacks by the 3rd quarter of 2024 with the average cost of data breach reaching USD 4.5 million.

Risks were not limited to just cybersecurity threats and bad actors. Geopolitical tensions and wars around the world led to disruptions like the Houthi attacks on critical shipping routes, impacting supply chains and global trade. And the escalating climate crisis added to the risks facing the world with insured losses from natural disasters exceeding USD 135 billon this year, which also went down as the hottest year in recorded history. AI proved to be a double-edged sword – powering new strategies and unlocking business transformation on one hand and introducing new risks and empowering bad actors to launch increasingly sophisticated attacks on the other. Amidst this, regulators continued to introduce new rules and modify existing ones to meet emerging challenges. This added to organizations’ governance, risk and compliance (GRC) challenges.

As we step into 2025, it is important to understand the trends shaping the risk landscape, so that you can craft your risk and compliance agenda to effectively mitigate the risks and cash in on the opportunities.

Key Trends Shaping GRC in 2025

Resilience in the Spotlight: Operational resilience has been a key focus area for regulators and organizations alike. But 2024 saw heightened scrutiny and attention on cyber and operational resilience as the risk landscape grew in severity. Extreme climate events, geopolitical tensions and IT outages caused serious disruption across sectors and geographies and as a result, regulators and organizations want to ensure resilience against such incidents and aid quick recovery.

Most recent regulations focused strongly on resilience – 

• EU's Digital Operational Resilience Act (DORA)
• EU’s Cyber Resilience Act (CRA)
• UK's operational resilience policies issued by the Bank of England, Financial Conduct Authority and Prudential Regulation Authority
• The US SEC cybersecurity rules stressed on greater accountability and transparency around cyber incidents 
• The interagency paper on ‘Sound Practices to Strengthen Operational Resilience’ by the Federal Reserve Board (FRB), the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC)
• Singapore’s operational resilience guidelines
• Hong Kong’s Supervisory Policy Manual on Operational Resilience
• Canada’s Guideline E-21 on operational risk and resilience

In 2025, organizations will need to increase their focus on robust operational as well as cyber resilience approaches.

The AI Era Takes Shape: AI came of age in 2024 with most organizations benefitting from the productivity and efficiency gains the technology offered-

• 34 percent of organizations reported significant improvements in productivity and efficiency by leveraging AI
• 67 percent said they would increase investments in AI because of the value delivered. AI also holds tremendous promise for improving GRC processes.

AI is transforming the pace and face of business operations, enabling real-time data analysis, automating repetitive tasks, and driving predictive insights that enhance decision-making. However, this rapid advancement also introduces new risks like data breaches, algorithmic bias, and regulatory non-compliance. Robust governance and compliance frameworks are essential to mitigate these threats, ensuring businesses harness AI's potential responsibly while staying resilient in an evolving landscape. Security protocols must be revised for the AI era. Regulations like the EU’s AI Act aim to provide a foundation for ethical and risk aware use of AI and the coming years will see more regulatory action on this front. Organizations must establish robust AI governance processes to ethically and securely use AI for business transformation even as they comply with emerging regulations.

Third-Party Risks on the Rise – Some of the largest data breaches and disruptions over the last year were caused by vulnerabilities within third-party systems

• The major breaches at American Express and Fidelity Investments were the result of attacks on third party systems.
• A faulty software update at CrowdStrike disrupted flights, shutdown stock markets and banks, and even impacted healthcare systems.

Most modern organizations work within a large ecosystem of vendors and partners. And it is now abundantly clear that a vulnerability anywhere within this ecosystem can have far reading impact and consequences. New regulations emphasizing third-party risk management, include EU’s DORA, the updated Network and Information Security Directive (NIS2) and US SEC’s Regulation S-P.

But given the complexity of corporate ecosystems this may be easier said than done. Organizations will now need to consider integrated and automated approaches to third-party risk management with diverse teams across the organization collaborating on risk monitoring and reporting. They will also need to work out mechanisms for monitoring and ensuring third party compliance as any compliance lapses at any part of the supply chain can impact the organization as well.

Regulatory Change Gains Momentum- 2024 saw strong continued regulatory momentum with regulators focusing on resilience, AI, cyber risk and security, third party risks and ESG. This trend is likely to continue in 2025 with regulations around key areas such as Trusted AI and Systems, Cybersecurity/Information Protection, Financial and Operational Resiliency, Financial Crime, Markets and Competition and Risk Governance and Controls. In addition to DORA, CRA, the EU AI Act, organizations will have to be prepared for several new regulations including the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), several US state laws on data privacy, the EU Cyber Solidarity Act, the revised EU Product Liability Directive, the Corporate Sustainability Reporting Directive (CSRD), and the EU Deforestation Regulation.

Keeping pace with this complex landscape is incredibly challenging and non-compliance will only result in heavy penalties and significant damage to reputation. Organizations will need AI powered, automated regulatory change management and compliance solutions to ensure error free compliance with evolving regulations.

Integrated GRC in Demand – Traditionally, GRC operated in silos with varied risk taxonomies, libraries and even disjointed solutions across the organization. This approach can no longer work today given the complex and interconnected risk landscape that modern organizations operate within. Most organizations are now moving to automated and integrated GRC strategies. This involves:

• Standardized and common taxonomies
• Streamlined workflows
• Clear visibility across all processes and controls across the organization
• Data integrated into a single source of truth allowing stakeholders to gain a comprehensive understanding of risks, interdependencies across the organization

With integrated GRC solutions in place, teams are better equipped to analyze and prioritize risks, evaluate business impact and mitigate them more efficiently. The move to integrated GRC solutions will continue to accelerate over the next year.

Stay Ahead in 2025 with MetricStream Connected GRC

MetricStream’s ConnectedGRC including our BusinessGRC, CyberGRC, and ESGRC product lines offer a comprehensive scalable solution for streamlining and automating GRC programs. Organizations can integrate insights from risk, compliance, audit, and third-party management functions into a single pane of glass to facilitate quicker and better decision-making, helping your organization:

• Build an agile and adaptable GRC strategy using a collaborative and intuitive platform.
• Leverage AI-powered workflows for predictive, data-driven decision-making.
• Efficiently identify, assess, monitor, and mitigate enterprise and operational risks.
• Safeguard your organization against IT and cyber threats with industry-recognized practices and frameworks. 
• Enhance operational resilience to prevent, respond to, and recover from business disruptions more effectively.
• Simplify multi-regulatory compliance with a cohesive and integrated approach.
• Detect regulatory changes in real-time and streamline the management of compliance updates.
• Boost GRC performance with MetricStream AiSPIRE, offering cognitive insights to enhance existing programs through actionable data.

Want to learn more? Request a personalized demo now.