Executive Summary
Your GRC function isn’t failing because of poor controls or inadequate policies. It’s failing because of poor influence. When GRC professionals can’t communicate effectively with senior leadership, even the most robust frameworks become organisational theatre – impressive on paper, ineffective in practice.
This article reveals how mastering influence transforms GRC from a perceived cost centre into an indispensable strategic partner. Through practical communication techniques grounded in human psychology, your GRC team can become the “Protective Experts” who effectively safeguard your organisation from its own blind spots.
The GRC Reality: Beyond Compliance Theater
Governance, Risk, and Compliance represents your organisation’s ability to achieve what we call “Principled Performance” – reliably hitting objectives whilst managing uncertainty and maintaining integrity. Yet for most senior leaders, GRC remains an opaque burden rather than a strategic enabler.
This perception creates a dangerous blind spot. When your leadership team views GRC as bureaucratic overhead, you’re wasting resources and actively weakening your organisation’s resilience.
The Common Hurdles
This perception stems from several persistent challenges:
Lack of Executive Buy-in: GRC initiatives struggle to secure adequate resources without strong endorsement from the top. Without this support, GRC becomes an isolated function rather than an integral part of business strategy.
Communication Gaps: Unclear or ineffective communication between GRC teams and executives hinders policy-making, planning, and integration into daily operations. The most brilliant risk analysis becomes worthless if it can’t drive decision-making.
Siloed Operations: Governance, risk management, and compliance functions often operate independently, leading to inefficiencies, duplicated efforts, and fragmented visibility into the organisation’s risk posture.
The Perception Problem: GRC is often seen as saying “no” rather than enabling “yes” – as a barrier to innovation rather than a framework for safe exploration of opportunities.
However, when effectively integrated and influential, GRC transcends its traditional role to become a powerful strategic asset. It shifts focus from reactive problem-solving to proactive risk mitigation and opportunity identification, transforming GRC from mere obligation into competitive advantage.
Understanding the Human Element: Why Logic Alone Fails
At its heart, GRC isn’t merely about policies, procedures, and systems – it’s fundamentally about human behaviour and decision-making. While frameworks provide necessary structure, their effectiveness depends entirely on how individuals perceive, interpret, and act upon them.
This human element represents the critical blind spot in traditional GRC approaches, which rely heavily on logical arguments, mandates, and fear of non-compliance.
The Disconnect Between Logic and Decision-Making
The challenge lies in the inherent gap between the rational, risk-averse world of GRC and the emotionally-driven, outcome-focused reality of senior leadership. Human beings, including senior managers, aren’t purely rational actors. Decisions emerge from a complex interplay of logic, emotion, personal values, past experiences, and perceived incentives.
Consider this scenario: A GRC professional presents a meticulously detailed report outlining significant compliance gaps and potential financial penalties. The logical response would be immediate action. However, a senior manager might perceive this as:
- Another burden: Adding to an already overwhelming list of priorities
- A distraction: Diverting resources from revenue-generating activities
- An abstract threat: Penalties seem distant or unlikely to materialise
- A personal attack: Implicating their department or previous decisions
This highlights the critical oversight: traditional GRC assumes that clear articulation of risk automatically leads to desired action. Without understanding the psychological landscape of decision-makers, even the most robust GRC arguments fall on deaf ears.
The insight: Effective GRC requires moving beyond facts and figures to engage with the human dimension of influence and persuasion.
The Science of Influence: Core Techniques for GRC Professionals
For GRC professionals, the ability to communicate persuasively and build rapport is as crucial as technical expertise. By understanding and consciously adjusting their own behaviour, they can dramatically improve their communication effectiveness and drive better outcomes.
Building Rapport: The Foundation of All Influence
Rapport is the ability to relate to others in a way that creates trust and understanding. It’s the bedrock upon which all effective influence is built. Without rapport, even the most logical arguments encounter resistance.
For GRC professionals, establishing genuine rapport with senior managers is essential for moving beyond transactional relationships to trusted partnerships.
Matching and Mirroring: Creating Subconscious Comfort
This involves subtly aligning your physiology (posture, gestures, breathing), voice (tone, tempo, volume), and language patterns with the other person. This creates a subconscious sense of familiarity and comfort.
Why it works: Mirror neurons in our brains automatically mirror the behaviour we observe in others. When someone mirrors our behaviour, we unconsciously perceive them as similar to us, triggering a natural trust response.
Practical application: If a senior manager leans forward and speaks slowly, subtly adopt a similar posture and pace your speech accordingly. This isn’t mimicry – it’s respectful attunement that demonstrates understanding and creates psychological safety.
Active Listening: Understanding Beyond Words
Active listening goes beyond merely hearing words to demonstrating understanding of the messages, emotions, and intentions. This involves paying attention, asking clarifying questions, and reflecting back what you’ve heard to confirm understanding.
Why it works: People feel valued and understood when truly heard. This creates psychological safety and openness to influence. Additionally, active listening often reveals the real concerns behind stated objections.
Practical application: When a senior manager expresses concern about new regulations, don’t immediately launch into compliance requirements. Instead, explore: “Help me understand your primary concerns about implementation.” Then paraphrase back: “So your main worry is the potential impact on project timelines and team productivity?”
Pacing and Leading: Building Trust Before Requesting Change
Pacing involves first acknowledging the other person’s current reality, concerns, or perspective. Once rapport is established, you can then gently lead them towards new perspectives or desired outcomes.
Why it works: People resist being pushed but will follow where they feel understood. By first meeting people where they are, you earn the right to guide them somewhere new.
Practical application: If a manager focuses on immediate operational challenges, acknowledge those challenges first: “I understand you’re under significant pressure to deliver this quarter’s results. That’s exactly why this conversation is important – this framework actually supports those objectives by…”
Understanding Representational Systems: Speaking Their Mental Language
People process information and experience the world through different representational systems: Visual (seeing), Auditory (hearing), and Kinaesthetic (feeling). While all three are used, individuals often have preferred systems that influence their language and decision-making patterns.
Why This Matters
When you communicate using someone’s preferred representational system, your message feels more natural and compelling to them. It’s like speaking their mental native language.
Visual Preference
These individuals often use visual predicates such as “I see what you mean”, “Let’s look at this”, or “It appears clear”. They respond well to charts, graphs, diagrams, and vivid descriptions.
Practical application: When communicating with visual managers, use phrases like “Picture a clear path to compliance” or “Let me show you how this creates a transparent view of our strategy.” Present information using visual aids and metaphors that help them “see” the implications.
Auditory Preference
Auditory individuals use auditory predicates such as “I hear you”, “That sounds right”, or “Let’s discuss this”. They appreciate clear explanations, verbal processing, and opportunities for dialogue.
Practical application: With auditory managers, say “Let’s talk through this path to compliance” or “Listen to how this approach harmonises with our strategy”. Provide opportunities for discussion and verbal processing of information.
Kinaesthetic Preference
Kinaesthetic people focus on feelings and sensations, using phrases like “I feel good about this”, “Let’s get a handle on it”, or “Something doesn’t feel right”. They respond to tangible examples, hands-on experiences, and emotional resonance.
Practical application: When engaging kinaesthetic managers, use phrases like “How does this solution feel in terms of our path to compliance?” or “Let’s get a firm grasp on the concrete benefits with our strategy”. Focus on the emotional and practical impact of decisions.
The Art of Reframing: Transforming Perception
Reframing changes the meaning of a situation by changing the context through which it’s perceived. For GRC, this is invaluable for transforming negative perceptions into positive opportunities.
Why Reframing Works
The human brain constantly interprets events based on context and past experience. By consciously shifting the frame of reference, you can change how someone experiences and responds to information. The same facts can feel threatening or empowering depending on how they’re presented.
Powerful Reframes for GRC
From Compliance as Cost to Competitive Advantage: Instead of “We need to implement this regulation to avoid fines”, try “By proactively adopting this standard, we differentiate ourselves in the market and build deeper customer loyalty, turning regulatory compliance into competitive advantage”.
From Risk as Threat to Innovation Catalyst: Rather than “This risk could harm the business”, reframe as “Understanding this risk isn’t about limiting innovation but understanding the boundaries within which we can innovate safely, allowing us to explore new opportunities with confidence”.
From Control as Constraint to Enablement: Instead of “This policy prevents dangerous behaviour”, try “This framework creates the structure within which your team can operate with confidence, knowing they’re protected and empowered to achieve ambitious goals”.
Outcome Orientation: Focusing on Desired Results
Senior managers are inherently outcome-oriented. They think in terms of goals achieved, problems solved, and value created. By consistently framing GRC discussions around benefits and positive results, GRC professionals align their objectives with executive priorities.
Focus on Benefits, Not Features
Instead of detailing technical specifications of a new control, explain how it delivers business value. For example: “This new monitoring system isn’t just about meeting regulatory requirements – it’s about ensuring continuity of our critical operations and providing real-time intelligence that enhances our decision-making speed and accuracy.”
Creating Future Vision
Help senior managers mentally rehearse the positive future state that GRC initiatives will create. Use vivid, specific language: “Imagine operating with such robust risk intelligence that we can confidently pursue aggressive market expansion, knowing our foundations are absolutely secure and our stakeholders talk about their confidence in our judgement.”
The Six Principles of Persuasion: Elevating GRC Conversations
Beyond specific techniques, the broader science of persuasion provides powerful tools for GRC professionals. Dr Robert Cialdini identified in his book, “Influence”, universal principles that are highly relevant for engaging with senior management:
1. Authority: Becoming the Protective Expert
People follow those they perceive as credible and authoritative. For GRC professionals, this means consistently demonstrating expertise, integrity, and reliability – becoming the “Protective Expert” who sees around corners that others can’t.
Building Authority Through Competence
Demonstrate Deep Expertise: Stay ahead of regulatory changes, industry developments, and emerging risks. Be able to articulate complex concepts clearly and provide evidence-based recommendations. Your insights should consistently prove valuable and prescient.
Show Uncompromising Integrity: Always act in the organisation’s best interests, even when delivering uncomfortable truths. Your advice must be seen as objective and unbiased, free from departmental politics or personal agenda.
Deliver Consistent Reliability: Follow through on every commitment and consistently deliver high-quality work. Reliability builds trust incrementally – each kept promise strengthens your authority for future interactions.
Visual and Behavioural Authority
Professional presentation and calm confidence subtly reinforce expertise. This is projecting the calm authority of someone who understands complex situations and can guide others through them safely.
2. Reciprocity: The Power of Giving First
The principle of reciprocity states that people feel obligated to return favours to those who have first given to them. For GRC, this means offering value proactively, without immediate expectation of return.
Practical Applications
Provide Valuable Insights: Share relevant industry intelligence, emerging risks, or best practices that benefit senior managers, even when not directly related to immediate GRC projects. For example, proactively sharing analysis of how regulatory changes might create market opportunities for their division.
Offer Solutions, Not Just Problems: When identifying risks or compliance gaps, come prepared with potential solutions and mitigation strategies. This positions GRC as a problem-solver rather than just a problem-identifier.
Be Genuinely Helpful: Develop a reputation as the function that’s accessible and willing to assist beyond formal requirements. This creates a bank of goodwill that can be drawn upon when difficult conversations are necessary.
3. Social Proof: Success Leaves Clues
People are more likely to adopt behaviours or beliefs when they see others, especially similar others, doing so. This is particularly powerful in organisational settings where peer behaviour strongly influences decision-making.
Leveraging Social Proof Effectively
Internal Success Stories: Highlight instances where other departments or business units have successfully implemented GRC initiatives, leading to tangible benefits. “Marketing implemented this data governance framework and saw customer trust scores increase by 20% whilst reducing compliance overhead by 30%.”
Industry Benchmarking: Reference how leading organisations in your sector approach similar challenges. “Our top three competitors are investing heavily in this area, recognising it as a key differentiator for customer acquisition and retention.”
Expert Endorsements: Cite external experts, regulatory bodies, or industry associations that endorse the GRC approaches you’re advocating. This adds external validation to internal recommendations.
4. Scarcity and Urgency: The Cost of Inaction
Opportunities appear more valuable when their availability is limited or when there’s a deadline. While GRC should avoid fear-mongering, communicating genuine costs of inaction or benefits of timely adoption can be powerfully motivating.
Ethical Application
Highlight Missed Opportunities: “By delaying investment in this fraud detection system, we risk missing significant cost savings that our industry peers are already realising. The window for first-mover advantage is narrowing.”
Communicate Evolving Landscapes: “The regulatory environment is shifting rapidly. Proactive action now positions us ahead of requirements, whilst reactive responses later will be more costly and potentially inadequate.”
Emphasise Competitive Positioning: “Early adoption of this ethical AI framework gives us first-mover advantage in a market increasingly focused on responsible innovation.”
5. Consistency and Commitment: Small Steps to Big Changes
Once people commit to something, even a small action, they become more likely to honour that commitment and take further, consistent actions. This principle suggests starting with manageable requests and building momentum.
Building Commitment Gradually
Seek Small Initial Agreements: Instead of proposing comprehensive overhauls, suggest pilot programmes or small, low-risk initiatives. Success with smaller commitments builds confidence for larger projects.
Encourage Public Commitments: When senior managers publicly endorse GRC initiatives, even in small ways, they become more likely to follow through. A public statement creates psychological pressure for consistency.
Align with Existing Goals: Frame GRC initiatives as directly supporting strategic objectives or commitments that senior managers have already made publicly.
6. Liking: Building Genuine Relationships
People say yes to those they like and trust. This goes beyond professional competence to genuine interpersonal connection and mutual respect.
Developing Authentic Relationships
Find Common Ground: Discover shared interests, values, or experiences. This could range from professional background to personal interests, creating bonds beyond work requirements.
Offer Sincere Appreciation: Acknowledge and appreciate the contributions and achievements of senior managers and their teams. Genuine recognition builds goodwill and strengthens relationships.
Collaborate Actively: Seek opportunities to work together on projects, fostering shared purpose and mutual success. Joint problem-solving creates stronger bonds than hierarchical reporting.
Practical Application: GRC Influence in Action
Theory becomes powerful only through practical application. Here are detailed scenarios demonstrating how these techniques transform GRC effectiveness:
Case Study 1: Securing Investment for Proactive Cyber Resilience
The Challenge: Sarah, Head of Cyber GRC, identified critical vulnerabilities in legacy systems, posing significant data breach risks. Her proposal for substantial investment in a new cyber resilience platform met resistance from David, the CFO, who viewed it as unbudgeted expense during a tight fiscal year.
The Traditional Approach (and Why It Failed)
Sarah’s initial presentation was data-heavy, focusing on technical specifications and statistical breach probabilities. David, whilst analytical and financially driven, acknowledged the data but remained unconvinced, citing budget constraints and competing investment priorities. He saw cost, not value.
The Influence-Based Approach
Recognising the disconnect, Sarah shifted strategy. She identified David as preferentially Auditory and highly outcome-oriented, driven by financial prudence and clear returns on investment. She also understood the power of Reciprocity and Reframing.
- Building Rapport and Understanding: Sarah scheduled a follow-up meeting, but instead of immediately presenting solutions, she began by pacing David’s concerns. “David, I hear your concerns about the budget, and I appreciate your diligent oversight of our financial health. It’s precisely that prudence that makes this conversation so important.” She actively listened, allowing David to fully articulate his financial pressures.
- Reframing Risk as Opportunity Cost: Instead of focusing on solution costs, Sarah reframed the conversation around the cost of inaction and opportunity of proactive investment. “David, let’s talk through a scenario where we face a significant breach. Beyond immediate financial impact and regulatory fines, consider how our brand reputation being damaged would sound to investors, how losing customer trust would feel for our growth projections, and what declining stock prices would look like for our market position.”
- Leveraging Social Proof and Authority: Sarah introduced social proof from peer organisations. “I’ve been speaking with GRC leaders at [Competitor A] and [Competitor B]. They’ve recently invested in similar platforms and are reporting not only enhanced security, but significant reduction in operational overhead through automation, freeing resources for innovation. They’re positioning this as securing future growth and competitive advantage.”
- Outcome Orientation and Future Pacing: Sarah concluded by future pacing positive outcomes. “With this investment, we’re buying software as investment in a clear path to sustained financial stability, enhanced brand value, and the peace of mind that comes from knowing our digital assets are robustly protected. This allows us to confidently pursue aggressive growth targets without the constant weight of underlying cyber risk.”
The Outcome: Sarah’s approach, rooted in understanding David’s perspective and reframing the investment from cost to strategic enabler, secured the critical funding.
Case Study 2: Navigating Resistance to New Compliance Policy
The Challenge: Mark, a GRC Manager, needed to implement mandatory data handling policies across the sales department. Emily, the sales director, was highly resistant, fearing new policies would create bureaucracy and hinder sales productivity.
The Traditional Approach (and Why It Failed)
Mark initially sent detailed policy documentation followed by mandatory training sessions. Emily, a fast-paced, Visual and Kinaesthetic leader, found the documents dense and training prescriptive. She perceived it as a top-down mandate that didn’t understand her team’s work realities, leading to passive resistance and complaints.
The Influence-Based Approach
Mark realised he needed to engage Emily differently. He understood her need for speed, clarity, and control over her team’s processes. He decided to leverage Liking, Consistency and Commitment, and Reframing.
- Building Liking and Understanding: Mark approached Emily informally, first acknowledging her team’s achievements. “Emily, your team’s sales figures last quarter were truly impressive. I can see how hard they work, and I feel the energy they bring to every client interaction.” He then expressed empathy for her concerns. “I can imagine that any new process might feel like it could slow things down, especially when you’re moving so fast.”
- Seeking Small Commitments and Reframing: Instead of presenting the complete policy, Mark proposed collaborative steps. “What if we piloted a simplified version of the data capture process with just a small segment of your team for two weeks? We could look at the results together and feel how it impacts their workflow. My goal isn’t adding bureaucracy, but ensuring our sales efforts are built on a solid foundation that protects both our clients and our future revenue streams.”
- Outcome Orientation and Consistency: Mark focused on positive outcomes for Emily’s team. “By ensuring we handle client data impeccably, we’re avoiding fines and building deeper client trust, which I know is central to your long-term sales strategy. This policy is designed to help your team maintain that trust and see their sales grow securely and sustainably.”
The Outcome: Emily agreed to the pilot. During the two weeks, Mark provided hands-on support and gathered feedback, making minor adjustments. Seeing minimal disruption and understanding protective benefits, Emily became an advocate for full policy rollout, even helping Mark communicate its value to other departments.
Measuring Influence: What Success Looks Like
Measuring enhanced GRC influence can be nuanced, but its effects manifest in tangible organisational improvements. Senior managers should monitor shifts in these key areas:
Quantitative Indicators
Reduced Incidents and Breaches: More influential GRC leads to greater adherence to policies and controls, resulting in measurable decreases in security incidents, compliance breaches, and operational failures.
Improved Audit Outcomes: Enhanced engagement across departments leads to smoother internal and external audits, with fewer findings and faster remediation cycles.
Faster Decision-Making: When GRC insights are effectively integrated, decisions related to new initiatives, technology adoption, or market expansion can be made with greater confidence and speed.
Resource Optimisation: Strategic GRC integration reduces redundant controls and optimises spending on risk management activities.
Qualitative Indicators
Increased Proactive Engagement: Departments actively seek GRC guidance and report potential issues early rather than waiting for formal requirements.
Enhanced Stakeholder Confidence: Strong GRC posture translates into greater trust from regulators, investors, customers, and the public, reflected in positive media coverage and improved ESG ratings.
Cultural Shift: GRC becomes seen as an enabler rather than a barrier, with teams viewing risk management as empowerment for confident decision-making.
Continuous Improvement Process
The journey to strengthening GRC influence requires continuous learning and adaptation. Regular feedback loops, self-assessment, and commitment to refining communication strategies are essential. The philosophical principle of “Once is Never, twice is always” applies here: one communication misstep is a learning opportunity; repeated failures indicate need for fundamental change in approach.
Your Implementation Roadmap
Immediate Actions
- Assess Current Influence Levels: Survey department heads on their perception of GRC value, accessibility, and strategic relevance.
- Map Key Relationships: Identify senior leaders most critical to GRC success and analyse their communication preferences and decision-making styles.
- Audit Communication Patterns: Review recent GRC presentations and reports for influence opportunities, identifying where logical arguments could be enhanced with persuasion techniques.
Medium-Term Development
- Invest in Communication Training: Develop your GRC team’s influence and persuasion capabilities through formal training and coaching.
- Implement Structured Rapport-Building: Create regular informal touchpoints between GRC professionals and department heads to build genuine relationships.
- Reframe Key Messages: Transform compliance communications from burden-focused to opportunity-focused, emphasising enablement rather than constraint.
- Practice Representational System Recognition: Train your team to identify and adapt to different communication preferences.
Long-Term Integration
- Embed GRC in Strategic Planning: Include GRC professionals in early-stage project and initiative discussions as strategic partners rather than compliance checkers.
- Create Influence Feedback Loops: Regularly measure and refine communication effectiveness, gathering feedback on both content and delivery.
- Build Protective Expert Reputation: Consistently position GRC as the function that enables confident risk-taking rather than risk avoidance.
- Develop Internal Success Stories: Document and communicate wins where GRC influence directly contributed to business success.
The Strategic Imperative: Beyond Compliance to Competitive Advantage
In today’s complex business environment, effective GRC isn’t optional – it’s essential for sustainable success. However, technical competence alone isn’t sufficient. Your GRC function must master the art of influence to unlock its true potential as a strategic differentiator.
When your GRC professionals can communicate persuasively, build genuine relationships, and frame their expertise as strategic enablement, they transform from perceived cost centres into indispensable partners. They become the Protective Experts who safeguard your organisation from its own blind spots whilst enabling confident pursuit of ambitious objectives.
The transformation requires commitment to developing these human-centric skills alongside technical expertise. It demands understanding that influence isn’t manipulation but rather the ethical application of communication science to drive better outcomes for everyone involved.
Your competitors likely operate with traditional, influence-poor GRC functions. Your opportunity lies in making yours different and measurably more effective. Invest in these capabilities, and watch your organisation’s resilience, reputation, and performance improve substantially.
The future of GRC lies not just in robust controls and comprehensive policies, but in the mastery of human influence that makes those controls genuinely effective. Begin this transformation today, and position your organisation for principled performance that delivers sustainable competitive advantage.
Additional Reading:
- Influence: The Psychology of Persuasion by Robert Cialdini
- The Most Dangerous Business Book You’ll Ever Read by Greg Hartley
- How to Win Friends & Influence People by Dale Carnegie