Matt Kunkel is CEO of LogicGate, a GRC process automation platform that enables organizations to transform risk and compliance programs.
“Yes, and…” is a principle that originated in improv comedy but has become common in other contexts. The idea is simple: telling someone “no” can grind a situation to an awkward and uncomfortable halt, whether that situation is a comedy sketch or a corporate brainstorming session.
It’s better (and more productive) to roll with new ideas as they emerge, working together rather than against one another to build a stronger, more compelling result. That doesn’t mean every idea is a good one, but this approach at least provides the opportunity to fully examine a proposal rather than simply rejecting it. Who knows? Sometimes, talking through a bad idea can lead to something better.
This is particularly true for governance, risk and compliance (GRC) teams, who are often viewed as the “Department of No.” GRC teams look at everything through the lens of risk, and it can be easy to dismiss new ideas because they appear “too risky.” However, as technology like artificial intelligence (AI) becomes increasingly widespread, saying no isn’t always an option.
While AI has its risks, the technology has the potential to revolutionize the way modern businesses operate—which means failing to adopt it might be the biggest risk of all. Rather than saying “no” to new AI tools, GRC teams should instead look for ways to say, “Yes, and…here’s how we can limit the risk.”
Why Saying “No” Is Not An Option
As useful as AI promises to be, the potential risks it brings with it are very real. Businesses must account for the security concerns surrounding AI, as well as the potential for legal, regulatory and even ethical roadblocks. It’s important to understand the organization’s overall risk tolerance and have a plan in place to address potential issues like data security, bias management and intellectual property rights.
With that in mind, it’s tempting for GRC teams to simply bar the use of AI tools until those questions have been addressed more thoroughly.
But in the real world, that isn’t really an option. AI is a (if not the) top initiative for every CFO in the nation right now. It’s the number one topic at industry conferences. It’s the first question at every board meeting. AI-based solutions are helping businesses streamline their reporting, improve their approach to communications, automate cumbersome manual processes and more. Work that used to take weeks or months can now be done in a day—and that has a huge impact on an organization’s bottom line.
If your business isn’t adopting AI, you can be sure your competitors are—and you risk being left behind. GRC teams can’t just say “no,” but there are steps organizations can take to make it easier (and safer) to say “yes.”
Embracing AI While Limiting Risk
Fortunately, today’s businesses don’t need to start from scratch. Advisory bodies like the National Institute of Standards and Technology (NIST) have already issued detailed frameworks that can help organizations better determine how much risk they are willing to take on—and how to manage it.
This often starts with understanding where AI is already being used within your organization—because if you don’t think employees are already using tools like ChatGPT, you’re fooling yourself. It’s impossible to manage a technology if you don’t know where it’s being used, so discovery must be a priority.
The organization can then begin establishing acceptable use policies for AI, which will ultimately be based on risk appetite. Is the business willing to accept the risks that come along with using AI for product development? Is there a clear process for determining what data can be fed into generative AI tools? Can AI solutions be protected using the company’s existing security solutions? If not, what will it take to secure them, and how much will it cost? These are questions that GRC teams need to be asking and discussing with their C-suite.
The answers to these questions will allow GRC teams to determine how they can say “yes, and…” rather than “no” to AI implementations. Yes, there are risks associated with AI in product development, and here’s how we can mitigate them. Yes, there are data protection policies in place, and here’s how they can be applied to AI. Yes, we need additional security solutions, and here are our recommendations.
By adopting this approach, the GRC department can become a helpful ally for stakeholders looking to increase their AI investments rather than a frustrating roadblock. Ultimately, it’s not just about avoiding risk—it’s about equipping business leaders with the information they need to make risk-conscious decisions that move the business forward.
That said, AI policies are only as effective as your ability to enforce them. That means businesses need to create a culture of transparency and risk awareness, ensuring that employees understand the rules and why they are in place.
Additionally, GRC teams need continuous visibility across the digital landscape, along with the ability to measure how effectively the organization is aligned with established frameworks. This also applies to third-party risk—at a time when businesses are being compromised through partners and vendors at a worrying rate, it’s critical to ensure that third-party organizations are also in compliance with GRC policies. After all, you’re only as secure as your weakest link.
The Need For A “Yes, and…” Approach
No technology is perfect, and AI is certainly no exception. But as AI becomes more widely adopted, more and more organizations will find that they are willing to accept the risk it carries in exchange for the business outcomes it drives.
And that’s fine. A good GRC team shouldn’t be the Department of No. They should work with stakeholders not to forbid the use of AI but to help them understand how it can be used safely and effectively, driving the business forward without exposing it to unnecessary risk.
AI is a game-changer for organizations across every industry, and embracing a “yes, and…” approach allows GRC teams to generate positive business outcomes while keeping drawbacks to a minimum.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
