IRM Market Brief: Grant Thornton Survey Points to Rising IRM Demand
Two thirds of business leaders say integrated risk management is a top priority. Fewer than half have built it. That is the headline of Grant Thornton's 2026 Cyber & Risk Survey of 1,100 senior leaders, published October 13. The first number is the demand, stated by buyers in their own words. The second is how much of it has been met.
The survey landed six days after Wheelhouse Advisors published the 2026-2027 IRM Navigator Vendor Compass for GRC, the first of four reports covering the segments on the IRM Navigator Curve's investment path: GRC, ERM, ORM, and TRM. The Vendor Compass asks the same question from the supply side: how far does the evidence a GRC provider produces travel into enterprise, operational, and technology risk decisions? This edition reads the two documents as a pair. The answer comes first; the evidence follows.
QUICK TAKE
Buyers want integrated risk management faster than they are building it, and faster than providers have proven they can deliver it.
- The demand is on record. In Grant Thornton's survey of 1,100 senior leaders, 67 percent say integrated risk is a top priority, 48 percent have built it, and 61 percent say the gap leaves them with an incomplete view of risk.
- The gap runs between enterprise risk and cyber. 96 percent outsource cyber detection and response; 25 percent have connected those providers to their own risk processes.
- Most programs have a risk record but do not yet run the business on it. Mapped to the IRM Navigator Curve, two thirds of organizations are Foundational or Coordinated, a third are Embedded or Extended, and none are Autonomous.
- Providers have not caught up. The 2026-2027 IRM Navigator Vendor Compass for GRC finds six of 33 providers with documented GRC evidence reaching enterprise, operational, and technology risk decisions.
What to do:
- Buyers: locate your program on the Curve before the next purchase. If risk is not yet informing strategy, the priority is getting the GRC record into enterprise, operational, and technology risk decisions, starting with the outsourced cyber findings that sit in a provider's portal today.
- Vendors: the 67 percent are the pipeline, and the proof they will ask for is a named customer whose GRC evidence reaches board reporting and operational decisions. Autonomy claims are landing in a market where no buyer is Autonomous yet.
- Investors: GRC grows from $17.2 billion in 2026 to $35.8 billion in 2033, and the value is moving to the providers whose evidence crosses domains. The ORM, ERM, and TRM Vendor Compasses to follow will show where the other three steps of investment land.
1. Grant Thornton finds buyers want integrated risk, and most have not built it
What happened
On October 13, Grant Thornton published the results of its 2026 Cyber & Risk Survey, fielded from August 10 to September 22 among 1,100 senior business leaders across eleven industries. The headline is in Figure 1: 67 percent prioritize integrated risk, 48 percent have implemented integrated risk management or an enterprise-wide operating model for risk, and 61 percent said insufficient integration across risk functions leaves them with an incomplete view of risk. A further 68 percent said data quality, availability, and visibility limit integration.
Figure 1: The headline finding of the Grant Thornton 2026 Cyber & Risk Survey. Source: Grant Thornton; graphic by The RiskTech Journal.
The full survey report adds two maturity questions. Asked how risk management is integrated into enterprise-wide decision-making, respondents split 2 percent no approach, 9 percent basic, 28 percent developing, 28 percent established, 29 percent advanced, and 4 percent leading. Grant Thornton draws its own line between established and advanced: for 67 percent, risk is not systematically informing strategy; for 33 percent it is. Asked separately to rate the maturity of the risk and compliance program, 9 percent chose basic, 29 percent developing, 31 percent established, 23 percent advanced, and 7 percent leading.
The cyber figures show where the gap sits. Almost every respondent (96 percent) uses outsourced capabilities for cybersecurity threat detection and response, and one in four (25 percent) says those providers are fully integrated with internal processes. Among risk and compliance leaders, 69 percent cited siloed structures as the leading obstacle to integrating enterprise risk management. In internal audit, 8 percent of organizations run continuous monitoring with dynamic risk assessment.
Our read
The survey is a demand signal. Tony Buffomante, who runs Grant Thornton's Cyber & Risk practice, says many organizations still manage cyber, compliance, fraud, and audit risks through separate teams and disconnected data, which is "creating blind spots at exactly the moment AI is making threats faster and harder to detect." The report's prescription is a shared view of exposure built on common risk definitions, with one owner accountable for how risks connect.
The numbers also say where the record breaks. Cyber is the risk most organizations have handed to outside providers, and three quarters have not connected those providers to their own processes. In the IRM Navigator Model, that is the seam between enterprise risk management, where the board sets goals and appetite, and technology risk management, where cyber controls and telemetry live. Detection and response run on a provider's record; the board's risk view runs on another. The 61 percent with an incomplete view are describing the result. Last week's piece on supplier recovery claims made the same point about resilience.
The maturity questions can be read against the IRM Navigator Curve, which describes five stages of risk program maturity, from Foundational, where risk work is fragmented and compliance-driven, to Autonomous, where human and machine agency operate together under independent verification. The Curve applies across all four IRM domains, and the primary investment moves through them in sequence: GRC first, then ERM, ORM, and TRM. Primary is the operative word. A Foundational organization still spends on technology risk, and nobody waits for Extended to buy security tooling. What the Curve says is which investment carries the program to the next stage, and that is where the majority of the spend lands at each step.
Figure 2: The IRM Navigator Curve, with its five stages, the four-step investment path between them, and the 2026-2027 Vendor Compass report for each segment. Source: Wheelhouse Advisors.
Grant Thornton's two scales map onto those stages. No approach or a basic, untested framework is Foundational. Developing and established programs, tested and even integrated across teams but not yet informing business decisions, are Coordinated. Embedded means embedded in operations and strategy, so only the advanced group, where risk systematically informs decisions, is there. Leading is Extended. No level reaches Autonomous, and that zero is a finding in its own right.
Figure 3: Grant Thornton's two maturity questions mapped to the five stages of the IRM Navigator Curve. The survey does not use the Curve; the mapping is ours. Source: Grant Thornton; graphic by The RiskTech Journal.
Read that way, Grant Thornton's own line falls on the Coordinated to Embedded boundary. Two thirds of organizations are still building the record, a third have reached the stage where risk shapes strategy, and 4 to 7 percent have gone past it. That matches the Vendor Compass's assessment that most GRC programs sit between Coordinated and Embedded, and it reconciles the headline: 48 percent claim an integrated program, 33 percent say risk informs strategy, and the 15 points between them are organizations that have the record without using it.
Grant Thornton calls the practice Cyber & Risk. Its own data argue for the reverse order. Risk sets the business tolerance and the ownership, and cyber is one set of controls inside it. If you own enterprise risk reporting and your detection and response is outsourced, ask:
● Where the provider's findings land. If the answer is the provider's portal or a ticket queue, they are not in your risk record.
● Whether a cyber event maps to a business process and an impact tolerance before it maps to a control.
● Who owns the data definitions both records use, since 68 percent say data quality is what stops integration.
● Whether your last breach simulation tested the handoff between the provider and your own risk function.
The survey is Grant Thornton's and its recommendations point toward Grant Thornton's services, but the direction matches what buyers have been telling us in briefings all year.
What to watch
The 73 percent who said better analytics and monitoring would strengthen their response will become requests for proposals over the next two quarters. A request for one risk record that cyber feeds into is the shift to IRM in progress. A request for a better cyber dashboard is the same gap with a new screen in front of it.
2. The GRC Vendor Compass is the first step on a four-step path
What happened
On October 7, Wheelhouse Advisors published the 2026-2027 IRM Navigator Vendor Compass for GRC, the first of four Vendor Compass reports for the research year, one for each segment on the investment path of the IRM Navigator Curve in Figure 2. The ORM Vendor Compass is targeted for November, ERM for February 2027, and TRM for May 2027. Each report evaluates the providers in one segment on the breadth of what they cover and on how far the evidence they produce travels into the other three domains. The GRC edition covers 33 providers, 24 technology and nine services, all constituents of the 2026-2027 IRM50, against evidence through October 3, 2026, and sizes the segment at $17.2 billion in 2026, growing to $35.8 billion in 2033. Six of the 33 have documented GRC evidence reaching enterprise, operational, and technology risk decisions; many of the rest reach one or two. Agents that execute control tests, evidence collection, and case triage are in production at customers of a few providers; none shows agents running across all four GRC solution areas with independent verification. The report is available from IRM Navigator Research, Ori Wellington's walkthrough of October 12 explains how to read it, and it is the subject of S9E1 of The Risk Wheelhouse.
Our read
Put the survey and the Vendor Compass side by side and the market reads as one picture. The survey says 61 percent of buyers lack a connected view of risk. The Vendor Compass says six of 33 providers have shown their GRC evidence crossing into the other three domains. Demand for integration is ahead of proven supply, and the Curve says why GRC is where the series starts: it is the first investment on the path, the record of policies, controls, and attestations that ERM, ORM, and TRM will have to read from. A buyer at Coordinated, which is where most of Grant Thornton's respondents sit, needs that record to reach the business before the next investment pays off.
The Vendor Compass has a name for the condition the survey describes. The GRC Integration Trap is the pattern in which platforms integrate deeply within Assurance and Compliance and shallowly within Performance and Resilience. A buyer inside it has excellent visibility into individual risks and no view of how they connect, which is Grant Thornton's respondents in a sentence. The AI numbers fit: broad AI deployment reaches 12 percent of internal audit functions and 13 percent of compliance functions, and the Vendor Compass finds Agentic GRC real but bounded. Nobody is Autonomous, which is worth remembering when a provider sells autonomy to a market that has not yet arrived at integration.
If you sell GRC technology or services and want to be chosen by the 67 percent, the Vendor Compass states the bar:
● A named customer whose GRC evidence is used in board reporting, issue management, and control validation. Connector lists do not count.
● An agent that runs a control test, an evidence request, or an audit task at a named customer within a stated human review threshold. A copilot that drafts or recommends does not.
● One evidence model that serves the Chief Compliance Officer, the Chief Audit Executive, and the Chief Digital or Data Officer, with an independent function able to verify what the agents did.
What to watch
The ORM Vendor Compass is next, targeted for November, and it will test whether the processes, KRIs, and issues that operational risk manages can read from the GRC record the first report evaluated. In the meantime, the fourth-quarter customer conference season is where providers announce outcomes, and the test for each is whether a named customer's GRC evidence is shown reaching an enterprise, operational, or technology risk decision.
References
2. Grant Thornton, "2026 Cyber & Risk Survey," survey report, October 13, 2026.
Related from Wheelhouse Advisors
● "S9E1: Stop Buying GRC Hype," The Risk Wheelhouse podcast, October 9, 2026.
