Doing nothing feels safe because the cost of outdated GRC software never appears in the budget. Here’s how to measure that cost and build a business case for modernizing your risk management and compliance program that finance will back.
Key takeaways on building a business case for modern GRC
- Doing nothing is a decision. When attackers sabotaged fridges in hundreds of French supermarkets in October 2026, they used weaknesses flagged 17 months earlier. 3 weeks later, a second wave hit stores across Europe.
- GRC business cases stall because the benefits often look soft next to a hard price tag. Anchoring them to business objectives, rather than tools, changes the conversation with finance.
- The cost of inaction has 5 parts: disruption, regulatory exposure, unreliable evidence, manual control effort and missed strategic value.
- AI strengthens the case twice. It creates risks that are hard to govern without connected tools, and it rewards organizations that can adopt it safely.
- A credible plan starts with objectives, baselines what today really costs, prioritizes 2-3 use cases and measures compliance automation ROI in terms a CFO recognizes.
Introduction: why the status quo is the most expensive option in risk management
Overnight on 11 October 2026, attackers pushed refrigeration units in hundreds of French supermarkets into defrost cycles while they were full of food. Intermarché, Carrefour and Monoprix stores were hit. Intermarché’s chief executive, Thierry Cotillard, said the attack would cost “”tens of millions of euros nationwide in a single day.”
The weaknesses were not new. The US Cybersecurity and Infrastructure Security Agency (CISA) had flagged the main flaw in the affected controllers in May 2025. As we reported at the time, “A risk that belongs to everyone tends to be managed by no one.”
The risk hasn’t gone away. On 2 November 2026, refrigeration systems were tampered with overnight at stores in Sweden, Belgium, Ireland, the Netherlands and Estonia, affecting chains including ICA, Coop, Delhaize, Carrefour and SuperValu. In Sweden, Coop said the attack came just before a system upgrade it had planned in response to the French incident. The risk was known and the fix was scheduled. The attackers simply got there first.
Nobody chose to leave those controllers exposed. But nobody chose to fix them either. That is how the cost of doing nothing usually arrives. Not as a line in the budget, but as an incident, a fine or a missed opportunity that nobody had priced.
Most risk and compliance leaders recognize the pattern in their own programs. They know their spreadsheets, disconnected tools and manual controls are holding them back. But, far fewer can win the budget to change them.
Paul Cadwallader, GRC Strategy Director at CoreStream GRC, explains why:
“The automation return on investment is hard to quantify up front. The business case generally rests on avoided risk and freed up time… which both can be contested or discounted by finance versus the platform’s very tangible price tag.”
Paul Cadwallader, GRC Strategy Director, CoreStream GRC
This blog sets out why modernizing your risk and compliance program matters now, how to put a number on the cost of inaction, and how to build a business case for compliance automation that starts with your organization’s objectives rather than a feature list.
Why modernizing your GRC program can’t wait
Modernizing does not mean buying another tool. Most organizations already have several:
- 85% of its assurance clients use more than 1 GRC tool (Gartner), but…
- Only half of enterprise risk management users are satisfied with theirs. (Gartner), while…
- 63% of business leaders and GRC executives say complex, disaggregated data makes compliance harder (PwC).
Modernizing means connecting what you have to what the organization is trying to achieve. It is the move from tick-box compliance, where success is counted in controls tested and reports filed, to integrated risk management, where objectives, risks, controls and evidence are linked and visible in a single place. At CoreStream GRC, we call this value-based GRC.
The second reason is pace. Obligations now change faster than annual review cycles. As Jaypee Soule, VP Compliance and MLRO at PensionBee, puts it,
“All the regulations are coming at a fast pace very, very quickly… the regulators are also rushing and running around trying to catch up. So, they’re dishing out so many things and people in GRC are trying to catch it as quickly as possible.”
Jaypee Soule, VP Compliance and MLRO, PensionBee
For organizations operating across international or state borders, the pace multiplies. Debbie Nemeth, a Deputy Compliance Officer supporting a US healthcare provider serving patients in all 50 US states, describes what keeps compliance leaders awake. It’s the question:
“Do I know about all of these new regulations that have been passed or are coming down the pipeline to be passed? And how can I prepare my business for them?”
The third reason is reach. The EU’s NIS2 directive extends cybersecurity and resilience duties to 18 sectors, including energy, healthcare, transport, manufacturing and digital services. The UK’s “failure to prevent fraud” offence, in force since 1 September 2025, applies to large organizations in every sector. It can reach non-UK companies whose fraud has a UK nexus, such as defrauding UK customers, and carries unlimited fines. And UK-listed companies of every kind must now declare whether their material controls are effective, for financial years beginning on or after 1 January 2026.
The real cost of doing nothing to update your GRC program
Inaction feels free because its costs are spread across other budgets, pushed into the future or never recorded at all. A good business case makes them visible. In our experience, those costs fall into 5 categories.
1. Disruption and lost revenue
Retail and manufacturing have learned this the hard way. Marks & Spencer expected its 2025 cyberattack to cut around £300 million from operating profit. The Cyber Monitoring Centre estimated that the attack on Jaguar Land Rover cost the UK economy £1.9 billion and affected more than 5,000 organizations. When ASOS customers received an unauthorized “ASOS HACKED” alert through the retailer’s own app in October 2026, its shares fell as much as 15% on the first day.
Not every disruption starts with an attacker. In March 2025, a fire at an electricity substation shut Heathrow Airport for about 18 hours. More than 1,300 flights were cancelled and over 270,000 passengers were disrupted. A review by Britain’s National Energy System Operator (NESO) found that the most likely cause was moisture getting into a transformer component. An elevated moisture reading had been recorded at the substation in July 2018, but the component was never replaced.
Not every incident is preventable. But operational resilience and business resilience planning depend on knowing which controls protect which outcomes, and whether those controls work today.
2. Regulatory and legal exposure
The laws above share a common thread. Each asks organizations to show that their procedures were reasonable, proportionate and working. That is very hard to prove from scattered spreadsheets and email trails, and much easier to prove from a connected record of risks, controls, owners and evidence.
3. Unreliable evidence
Spreadsheets remain the default GRC tool for many teams because they cost almost nothing to start. The hidden cost appears later, when someone asks for proof. As Tom Cornelius, co-founder of the Secure Controls Framework, told a CoreStream GRC webinar:
“Excel spreadsheets, while they’re great for a point in time, they’re really not evidence-based.”
The Modern CISO’s Compliance Stack: Frameworks, Automation and AI webinar
4. Manual control effort
Every manual control has a running cost in people’s time. Rebecca McLean, Risk Conduct and Governance Director at AXA Insurance, argues that this is where GRC leaders can most easily put a number on value.
“Some of what we do in risk and compliance is quite intangible… Sometimes you’ve avoided bad things happening. It’s really hard to put a cost on that. But the cost of control is an area that I think if firms really take the time to understand the control landscape, work out where they want to invest and how they can optimize, that can add value to your expense line straight away.”
Rebecca McLean, Risk, Conduct & Governance Director
At Nottingham University Hospitals NHS Trust, the change was tangible:
“We used to spend Wednesday mornings manually chasing FOI leads. Now, it’s all automated.”
Head of Information Security & Data Protection Officer, Nottingham University Hospitals NHS Trust
5. Missed strategic value
The largest cost is the hardest to see. When GRC sits apart from the business, it is consulted late, if at all, and its insight never shapes the decisions that matter.
Yvonne Gordon, 2026 Women in GRC Woman of the Year and a defense sector Head of Compliance and Continuous Improvement sees the consequence across industries. When systems are built and released before risk and compliance are involved, as she says:
“Now we’ve got to put all the controls in place after the fact, retrospectively. It’s going to cost you more money in the long term. Bring us in early!”
Yvonne Gordon, Head of Compliance and Continuous Improvement
AI changes the compliance business case in two ways
AI now sits on both sides of the ledger. It adds new risks to govern, and it raises the cost of standing still.
AI is a risk you can’t govern on a spreadsheet
AI adoption is outpacing oversight. IBM found that:
- 13% of organizations reported breaches of AI models or applications, and…
- 97% of those lacked proper AI access controls.
- 63% of all breached organizations had no AI governance policy or were still developing one
- $670,000 per breach more paid by those with high levels of “shadow AI”
As IBM’s Suja Viswesan put it, “a gap between AI adoption and oversight already exists, and threat actors are starting to exploit it.”
The next wave is agentic. The Microsoft Digital Defense Report 2026 finds that 88% of enterprises are experimenting with AI agents, and 82% of leaders plan broader rollouts within 12-18 months. It identifies 5 classes of agentic risk, from sensitive data exposure to “excessive agency”, and calls identity “the primary control plane for defense,” extending to non-human identities such as agents.
This governance gap isn’t confined to any one industry. In Deloitte’s global survey of 3,500 senior leaders:
- 40% said they allow AI to execute decisions or actions without human approval to at least a moderate degree, and…
- 23% said accountability for a negative outcome remains unclear.
In healthcare, the safety organization ECRI ranked misuse of AI chatbots first on its Top 10 Health Technology Hazards for 2026.
Governing AI risk means maintaining a live inventory of AI systems, owners, risk assessments, controls and evidence, all of which change week to week. A static spreadsheet can’t keep up. Neither can the people defending against AI-enabled crime. As Jaypee Soule observes:
“Fraudsters out there are already getting ahead with AI and deepfakes. The only way to stay on top and keep people safe is to learn the system yourself and get ahead of it.”
Jaypee Soule, VP Compliance and MLRO, PensionBee
Modernizing means adopting AI safely, before you fall behind
The second side is opportunity. GRC teams that cannot use AI safely will fall behind those that can, and so will their organizations. Deloitte found that 44% of retail executives say legacy systems are slowing innovation.
Safe adoption needs the right foundations. Richard Eddolls, Co-Founder and Chief Product Officer at CoreStream GRC, sets out the balance:
“There is no doubt that the correct adoption of AI has the potential to make our clients more efficient and effective, but it is also inherently risky and potentially puts data, processes, and even decision-making at risk. That risk is increased if adoption is not controlled effectively.”
Artificial Intelligence (AI) strategy, CoreStream GRC
Done well, the gains are real. Nikki Absolom, former Head of Internal Financial Controls at Pets at Home, describes linking a large language model to Pets at Home’s GRC platform so a control description could generate a draft test plan at the press of a button:
“It reduced the time taken to write test plans by about 65%, which, when you’ve got a lot of test plans to write, that’s a really big time saving.”
Nikki Absolom, Tax Technology and Transformation Lead at IVC Evidensia and former Head of Controls at Pets at Home
How to build a business case for compliance and risk management automation in 7 steps
A strong business case doesn’t lead with software. It leads with what the organization is trying to achieve, and shows what stands in the way.
Step 1: Start with objectives, not features
List the strategic objectives your board cares about most, then map the risks and obligations that could stop you reaching them. This is the core of value-based GRC, and it reframes the investment from a cost of compliance to a contribution to growth.
As Paul Cadwallader cautions,
“People tend to focus on the efficiency dimension… Saving maybe 40% from automating processes might be great, but there’s a much bigger impact when you design your GRC project around the outcomes the organization is aiming to achieve.”
Paul Cadwallader, GRC Strategy Director, CoreStream GRC
If GRC can help secure an objective of 20% revenue growth by identifying and managing the risks of achieving only 10%, that is a value any CFO understands.
Step 2: Baseline what today really costs
Document the activities in your priority processes, measure the staff time they take, apply internal labor rates, and add the cost of every tool and spreadsheet involved, including overlaps. KPMG recommends exactly this current-state costing as the foundation of any GRC return on investment calculation.
Step 3: Put a price on inaction
Use the 5 categories above to build 2-3 realistic scenarios, each with a likelihood and an impact. Recent incidents in your own sector make useful reference points. The aim is not to frighten the board, but to show that “do nothing” carries a cost of its own that belongs alongside the investment.
A couple of hypothetical examples show how this could work in practice.
A mid-sized manufacturer tracks its 40 critical suppliers in spreadsheets and reviews each one once a year. Its risk team estimates a 1 in 5 chance that a key supplier fails or suffers a cyber incident in the next 12 months, halting a production line for 5 days. At $400,000 of lost contribution per day, that is a $2 million impact, or an expected cost of $400,000 a year. Continuous supplier monitoring would not remove the risk, but earlier warning could halve the likelihood and cut the outage to 2 days. That brings the expected cost down to $80,000, an annual saving of $320,000 to set against the investment.
A regional healthcare provider collects conflict of interest disclosures from 2,000 staff by email and spreadsheet. 3 compliance staff spend around a third of their time chasing and reconciling returns, which costs about $85,000 a year in salary. The team also judges there is a 1 in 20 chance that a regulator or auditor finds incomplete disclosures, with remediation, external review and penalties costing around $1.5 million. That adds $75,000 a year in expected loss. The cost of standing still is roughly $160,000 a year before any reputational damage is counted.
Step 4: Prioritize 2-3 use cases, and fix the process first
Choose the processes where compliance workflow automation and continuous compliance monitoring will make the biggest difference, such as controls testing, third-party risk or policy attestation. Redesign each process before you automate it. BCG calls this “compliance by design”, fixing processes before automating them.
Step 5: Model total cost and time to value
License fees are only part of the cost. Implementation partners, configuration changes, upgrades and the internal team needed to run the platform can outweigh them. Ask every vendor for reference customers of a similar size and complexity, and ask how long it took them to go live. CoreStream GRC’s average go-live time is 6 weeks.
Step 6: Calculate compliance and risk automation ROI the way your CFO will
Separate the benefits into 3 groups. Hard savings, such as hours released and tools retired. Risk reduction, expressed as lower expected loss in your inaction scenarios. And strategic value, linked to the objectives in Step 1. Agree the measures up front, such as time to produce evidence, audit findings, time to remediate and hours spent on manual reporting, so you can prove the return after go-live. The appetite is there: 82% of companies plan to invest more in technology for compliance (PwC).
Step 7: Build sponsorship, then turn the plan into an RFP
Bring the CFO, CIO or CISO, business owners and the audit committee in early, so the case reflects their priorities as well as yours. Once the case is approved, a structured request for proposal turns it into a fair, objective selection. CoreStream GRC’s free RFP templates cover enterprise risk management, third-party risk, policy management, conflicts of interest, and gifts and entertainment.
Conclusion: make the cost of GRC inaction visible
The status quo looks safe because its costs are hidden. They show up later, as an incident nobody priced, a control that couldn’t be evidenced or an AI risk nobody owned.
A business case built around objectives makes those costs visible and puts GRC where it belongs: helping the organization achieve what it is trying to do, rather than recording what went wrong. That’s the difference between tick-box compliance and value-based GRC.
If you’re ready to build that case, we can help. Book a free, one-hour workshop with our GRC experts to map your objectives, baseline your current program and explore how a value-based approach could work for your organization.
Frequently asked questions on GRC modernization and compliance automation
Compliance automation uses technology to run compliance tasks that would otherwise be manual, such as collecting evidence, routing approvals, sending attestations and monitoring controls. Done well, it replaces spreadsheets and email chains with a single, auditable record, freeing compliance teams to focus on judgment and advice rather than administration.
Start by costing today’s process: staff hours multiplied by internal labor rates, plus tools and spreadsheets. Model the future-state cost, including implementation. Then add risk reduction, measured as lower expected loss from realistic incident scenarios, and strategic value linked to business objectives. Agree measures up front so you can track the actual return.
Integrated risk management connects risk, compliance, controls, audit and third-party risk in a single framework and data set, linked to business objectives. Instead of each team keeping its own register, everyone works from a single view of risk, which makes reporting faster and decisions better informed.
The cost of inaction usually falls into 5 areas: disruption and lost revenue, regulatory and legal exposure, unreliable evidence, manual control effort and missed strategic value. Most never appear in the GRC budget, which is why they are easy to underestimate.
Yes, with the right governance. Keep humans accountable for decisions, control which data AI can access, and choose a GRC platform that lets you adopt AI models selectively, rather than having them built in by default.
