Why employee engagement is critical to your GRC program’s success: key takeaways from Gartner ERAC 

Effective GRC (governance, risk, and compliance) depends on the people across your organization. You can have well-designed, optimized processes supported by sophisticated technology that automates workflows. However, if employees and other stakeholders are not engaged or do not follow those processes, the value is lost. People provide the data, insights, and critical review that make GRC work. 

As GRC commentator Michael Rasmussen states:

“GRC is not just for back-office risk experts. For GRC to be successful, organizations must engage employees. It is no longer good enough to just have well documented policies and controls. Organizations must demonstrate GRC is active and operational across the organization.” 

Michael Rasmussen, GRC Analyst & Pundit, GRC 2020

AI and technological innovation dominate many discussions and conference agendas, including Gartner’s Enterprise Risk, Audit and Compliance Conference in Dallas. Yet several sessions also reinforced the importance of stakeholder buy-in. 

In part 2 of our takeaway series, we explore how to engage your people effectively and take your risk and compliance program to the next level. 

3 key lessons stood out for improving engagement with GRC programs. 

1. Reduce compliance friction  

In the session “Accurately Assess Compliance Program Effectiveness,” Kelly Larmon, Director Analyst at Gartner, highlighted outcomes that quality assurance should help compliance teams achieve: 

• Promote understanding 

• Reduce the effort required to comply 

• Increase the personal value employees associate with complying. 

Why does that matter? 

Because most employees do not start their working day thinking about how effectively they can engage with the compliance program. They are trying to serve a customer, share information, approve a supplier, recruit someone, complete a project, or meet a deadline. 

“Compliance is entering their workflow, not the other way around.”

Kelly Larmon, Director Analyst, Legal and Compliance, Gartner

As discussed during the session, “the harder compliance is to do, the less compliance you’re likely to get.” When a process is unnecessarily difficult, compliance can begin to compete with productivity instead of supporting it. 

Gartner’s Kelly Larmon emphasized making compliance requirements easy to see, remember, access, and complete: “If it takes more than 3 clicks to get to, the activity will be abandoned.” Examples include accessing information in a policy portal, requesting a new supplier, and logging an incident. 

The principle is straightforward: don’t make somebody work harder than necessary to do the right thing. 

This “ 3 clicks or fewer” mindset strongly resonates with us at CoreStream GRC. Our founder, Rich Eddolls, wanted enterprise GRC technology to feel as intuitive as the consumer technology people use in everyday life. 

His early test was wonderfully simple: could his -year-old create an action in 3 clicks without instructions? 

Nearly 2 decades later, technology has transformed. That principle has not. 

If a process designed to reduce organizational risk is so difficult that people avoid using it, the technology has become part of the problem. 

ACTION: Assess an employee-facing element of your program, such as an existing workflow or business touchpoint, against quality standards. How straightforward is it to complete? Where can you optimize? What can you remove? 

2. Align with your stakeholders 

Angie Kolar, Chief Compliance Officer at Norfolk Southern Railroad, delivered a compelling executive story in “The Transformational Journey of Norfolk Southern’s Ethics and Compliance Program.” Her talk showed how the rail company evolved its approach to compliance, governance, and crisis management following increased regulatory scrutiny. Stakeholder alignment and incremental change helped establish compliance as a strategic partner to leadership. 

Angie shared how, as the first CCO of a 200-year-old company, she built credibility by aligning with the executive team and listening to employees across the organizational hierarchy. Her discovery process included spending time with frontline teams: she attended safety testing, operated trains, and went to derailment sites to understand where the compliance program needed to go. Her goal was to create long-term organizational resilience in the wake of crisis, navigate resistance during a period of change, build a modern compliance function, and expand its role across the business. 

How did Norfolk Southern transform its ethics and compliance program? It used a 3-pillar model: 

1. Advance the compliance and ethics program  

2. Provide regulatory compliance assurance  

3. Deliver advanced resiliency capabilities  

Angie emphasized the importance of a “plan, do, check” process for identifying improvements in a manageable, scalable way. She also highlighted the value of an integrated software platform across case, regulatory, and policy management. Such a system helps teams determine who owns what and who should take over when someone leaves, rather than discovering a gap through an incident or regulatory review. 

However, the point she returned to time and again was the importance of leading with curiosity and active listening. Without genuine collaboration, stakeholders would not have bought in. Through the work Angie and her team implemented, the company has put preparedness into action through crisis-response training, an incident command structure, and business continuity and crisis-management programs, all built on the answers to the questions Angie asked in her first weeks in the role. 

There is a simple lesson in that for any organization undertaking GRC transformation: 

“Before redesigning compliance, understand the work.”

Angie Kolar, Chief Compliance Officer, Norfolk Southern Railroad

You cannot design effective GRC from a distance. 

You need to understand how work actually gets done, where employees experience friction, what information they need at the point of decision, and where ownership or compliance gaps could emerge. 

Listen first. Then enable with technology. 

The order matters: People → process → technology 

Not: Technology → hope people use it.

3. Manage the risk of burnout 

Designing GRC around people also requires acknowledging an uncomfortable reality. 

“People have finite capacity.” 

Suneel Gupta, CEO, RISE

Suneel Gupta’s Day 2 keynote, “Momentum: The Energy To Keep Going” focused on maintaining energy when “running lean teams asked to cover more and prove more with less.” The statistics he shared were stark: 77% of the workforce reported being completely exhausted, while 40% of C-suite leaders felt like leaving their roles because of fatigue. 

That should resonate with risk and compliance leaders. Many teams are operating lean while simultaneously being asked to: 

• absorb increasing regulatory change; 

• maintain controls and assurance; 

• respond to incidents; 

• support business transformation; 

• demonstrate greater value; 

• implement new technologies; 

• understand the implications of AI; and 

• help the wider business take greater ownership of risk. 

Meanwhile, success in GRC can be remarkably invisible. As Gupta put it in the keynote, there is often:

“no applause for the crisis you avoid.” 

Suneel Gupta, CEO, RISE

Human-centered GRC also means designing for human capacity. 

One practical idea shared in the session was the 55:5 approach: taking five minutes at the end of each hour to deliberately recharge and reset before moving to the next task. 

But the broader lesson for GRC is not about how long someone should take a break. 

It is about the assumptions we build into our operating models. 

If our processes depend on people having unlimited attention, capacity, and energy, we have not designed very effective processes. 

Our Head of Solution Design, Lionel, created a blog series and webinar on exactly this point.

This is also where technology, automation, and AI have an important role to play. 

Their value should not simply lie in enabling organizations to add more activity. The greater opportunity is to remove unnecessary administrative work so people can apply human judgment, expertise, creativity, and connection where those capabilities matter most. 

5 questions for risk and compliance leaders designing their next GRC transformation 

Amid rapid advances in GRC technology, how do we make sure people are not forgotten? 

Here are 5 questions we would take from Gartner ERAC 2026 into any GRC transformation: 

1. How much friction have we built into doing the right thing? 

Take a high-volume employee-facing GRC process and experience it from their perspective. How many steps does it take? Is the guidance clear? Can they find what they need? Where could they give up? 

2. Are we measuring activity or effectiveness? 

Go beyond asking: “Did they complete the training?” 

Ask: “Could they apply what they learned when making a decision?” 

3. When did we last design a GRC process with the people who actually use it? 

Listen. Observe. Ask questions. 

Understand how the business works before deciding how GRC should fit into it. 

4. Is our technology reducing effort or adding another layer? 

Every workflow, notification, portal and system should earn its place by making something clearer, easier or more effective. 

5. Are we accounting for people’s capacity? 

Do not design risk and compliance processes on the assumption that people have limitless attention. 

Ask what can be simplified, automated or removed so employees can focus their energy where judgment really matters. 

Better technology. Still human. 

At CoreStream GRC, we’ve believed from the beginning that technology should be an enabler, not a barrier. 

That belief predates today’s conversations about generative AI, agents and intelligent automation. It came from seeing what happened when GRC technology failed the people it was supposed to help. 

What we heard at Gartner reinforced why that principle still matters. 

Organizations have extraordinary new possibilities for connecting data, automating processes and applying technology across governance, risk and compliance. 

But sophisticated technology wrapped around a poor employee experience is still poor GRC. 

The objective isn’t to create more GRC activity. 

It’s to create: 

• easier, better-informed decisions 

• clearer accountability 

• more relevant guidance 

• greater employee understanding 

• less unnecessary friction 

• better business outcomes. 

If you would like to learn more about transforming your GRC program to engage employees and drive value, contact us today! 

Frequently asked questions for employee engagement and GRC