GRC Uncensored

As organizations contend with growing threats and shrinking GRC teams, this episode explores the widening talent gap in governance, risk, and compliance. Guest Shruti Mukherjee, a former software engineer turned GRC practitioner, shares her journey, her insights on the evolving nature of the field, and her call to action for both professionals and organizations to rethink what GRC careers can look like.

Guests: Shruti (GRC Professional)

Hosts: Troy Fine, Kendra Cooley

Producer: Elliot Volkman

Runtime: ~55 minutes

Show Notes & Segments:

00:00 – Intro & Banter

Casual chatter and AI banter with the crew, including Shruti’s first ChatGPT query and a few carrot cake recipes.

09:00 – GRC’s Image Problem: Is It Just Boring?

Shruti discusses the perception problem around GRC, generational gaps in interest, and why it’s often viewed as unsexy or undervalued work.

14:30 – Reframing the Pipeline: Who Should We Be Recruiting?

The group considers alternative talent pipelines, especially mid-career professionals who better understand the strategic value of GRC.

Quote: “Maybe it’s time to come to the good side.” – Kendra

20:30 – The Role of AI and Automation: Friend or Foe?

Shruti and the hosts weigh in on how automation platforms are shaping the field—for better or worse—and whether GRC jobs are at risk of being replaced.

Quote: “I treat AI like an intern. It can do some of the work, but I’ll always check it before it leaves the building.” – Shruti

26:00 – What Should New GRC Pros Learn?

Shruti shares what she wishes she had known earlier—especially around audit practices—and the value of soft skills and continuous learning.

30:30 – Critical Thinking, Not Just Checkboxes

Why GRC professionals must retain their ability to think critically, validate automation outputs, and question assumptions.

Quote: “We are losing our ability to be critical thinkers.” – Kendra

36:00 – Does GRC Need to Be Technical Now?

Shruti unpacks how her technical background helps her talk with engineers, understand tooling, and embrace AI; arguing that technical fluency is becoming essential.

44:30 – Final Thoughts: Risk Culture, Knowledge Transfer, and the Future

The group reflects on the need to pass down GRC fundamentals, resist overreliance on AI, and target new demographics for hiring.

Hosted on Acast. See acast.com/privacy for more information.

Guest: Pete Strouse, Cybersecurity Talent Advisor & Host of The Talent Gap Fireside Chat

This episode explores how governance, risk, and compliance (GRC) roles are filled, and why it's getting harder to land one. Pete Strouse unpacks the current job market, share recruiter insights, and offer advice to job seekers and hiring managers navigating a GRC landscape shaped by automation, offshoring, and unrealistic expectations.

[02:30] – GRC Careers Usually Start in Consulting

[09:45] – Are Candidates Using ChatGPT to Fake It?

[17:00] – How Recruiters Actually Source Talent

[23:00] – Red Flags: What Turns Recruiters Off Immediately

[28:30] – Is There Really a Talent Shortage in GRC?

[36:00] – How Automation and Offshoring Are Reshaping GRC Roles

[42:00] – Advice for Candidates and Hiring Managers

Hosted on Acast. See acast.com/privacy for more information.

This episode of GRC Uncensored goes full behind-the-scenes as Troy Fine, Kendra Cooley, and producer Elliot Volkman sit down for an unscripted discussion. From the challenges CPAs face in the security world to the ethics of auditing, the team explores what happens when trust, risk, and reputation collide. Plus, a big reveal: Troy is starting his own CPA firm—Fine Assurance.

[00:10:00] The CPA Debate

Troy breaks down the CPA backlash in cybersecurity, explaining why the criticism isn’t always fair—and why the problem might be deeper than just the credential.

[00:16:00] What Does “Technical” Really Mean?

The team explores what it means to be “technical” in security and whether that should be a requirement for auditors or GRC pros.

[00:30:00] Kendra’s Take: Use Your Auditor to Scale Security

Kendra flips the audit narrative: instead of hiding problems, she embraces audits as an opportunity to advocate for budget and resources.

Hosted on Acast. See acast.com/privacy for more information.

In this episode of GRC Uncensored, hosts Troy Fine and Kendra Cooley, along with producer Elliot Volkman chat with Rob Wood, founder and CEO of Sidekick Security, to explore the relationship between compliance and security. They dig into topics such as the limitations of compliance as a security measure, the role of compliance tools and platforms, and the importance of effective communication and leadership in fostering robust security programs. Various perspectives on compliance as a foundational element for security, contrasting viewpoints on automation tools, and the impact of breaches highlight the intricate balance between meeting compliance requirements and achieving genuine security improvements.

05:38 Compliance vs. Security: A Deeper Dive

11:26 The Role of Compliance in Building Security

25:19 The Impact of Breaches on Security Practices

32:35 Balancing Security Spending and Compliance

34:08 Risk Reduction and Customer Trust

38:03 Quantifying Risk and Compliance

47:09 Compliance Tools and Automation

51:00 High Trust Certification and Breach Impact

Hosted on Acast. See acast.com/privacy for more information.

In this episode of GRC Uncensored, hosts Troy Fine and Elliot Volkman invite Jeff Cook, a compliance expert with over 20 years of experience, to discuss the intricacies of auditor oversight and peer reviews. Jeff shares insights into the complexities of the peer review process, including the role of State Boards of Accountancy, AICPA, and the challenges of maintaining quality in SOC reports. The conversation also addresses potential improvements in the peer review system, market education, and the impact of GRC tools.

05:08 Diving into CPA and Compliance

08:50 Challenges in Peer Review and Quality Control

12:09 Market Influence and Future Directions

25:22 The Role of GRC Tools

Hosted on Acast. See acast.com/privacy for more information.

On a recent episode of GRC Uncensored, host Troy Fine and producer Elliot Volkman were joined by guest Stanley Krochik, a now seasoned GRC professional and former city security program manager, to discuss the realities of third-party risk Management (TPRM). The conversation focused on the growing issue of low-quality audits, the challenge of assessing vendor security postures, and the dilemma risk managers face when reviewing third-party documentation.

04:43 The Importance of Third Party Risk Management

05:45 Challenges with Low Quality Audits

07:45 Evaluating SOC 2 Reports

12:55 Issues with Sales-Focused GRC Tools

14:44 The Need for Better Compliance Programs

27:50 High-Risk Vendor Architecture Review

29:07 SOC 2 Reports and Vendor Risk Management

31:50 Challenges with SOC 2 and Auditor Quality

36:49 Financial Impact of Data Breaches

38:10 Differences in Security Between Old and New Systems

47:43 Proactive vs. Reactive Security Measures

Hosted on Acast. See acast.com/privacy for more information.

The latest episode of GRC Uncensored dove deep into the magical world of AI governance, specifically on ISO 42001. This week, our guests are Chris Honda, Whistic’s Manager of Security, Risk, and Compliance; and Jonathan LeBaron, MasterControl Senior GRC Engineer with the golden voice. Our due shared their firsthand experiences navigating compliance, business adoption, and the broader implications of AI risk management.

• ISO 42001 is becoming essential for companies adopting AI, not just for compliance but to build customer trust.
• AI risk assessments are more complex than traditional security frameworks, requiring new approaches to impact analysis.
• Shadow IT and vendor AI features introduce unexpected risks—companies must proactively monitor and review new AI functionalities.
• AI governance isn’t just about compliance; it’s about trust. Businesses that prioritize transparency and ethical AI use will have a competitive edge. Also, AI may or may not be making us dumber.

02:23 Discussing AI in GRC and ISO 42001

02:56 ChatGPT and AI Experiences

08:07 Implementing ISO 42001: Challenges and Insights

19:20 Third-Party Risk Management and AI

26:43 Scope and Complexity of AI in Software Products

27:57 Challenges in High-Risk AI Applications

29:43 Regulatory Landscape and AI

32:02 Driving Forces Behind ISO Certification

38:53 AI Risks and Business Understanding

43:56 Ethical and Societal Impacts of AI

Hosted on Acast. See acast.com/privacy for more information.

In this episode of GRC Uncensored, hosts Troy Fine, Kendra Cooley, and producer Elliot Volkman dive into an unfiltered discussion with Joseph Kirkpatrick, founder and president of KirkpatrickPrice. The focus is on the implications of private equity and compliance automation tools in GRC.

Joseph shares his insights on how the influx of private equity funding and the rise of 'SOC in a box' platforms have transformed the GRC landscape, often negatively impacting audit quality and independence. Key topics include the challenge of maintaining ethics in auditing, the adverse effects of aggressive marketing by compliance tools, and the importance of conducting thorough, unbiased audits. The conversation also touches on the difficulty audit firms face when pressured to lower costs or cut corners to retain business.

01:21 The Impact of SOC 2 Platforms

02:51 Private Equity's Influence on the Industry

03:04 Challenges Faced by Licensed Practitioners

04:32 Marketing Dollars and Industry Perception

06:06 The Role of Compliance Tools

10:51 Conflicts of Interest in Auditing

21:08 The Reality of Zero-Touch Audits

24:46 Trusting Compliance Platforms

33:44 Challenging the Status Quo in Auditing

34:27 Targeting the Right Market

35:09 The Role of Audit and Customer Expectations

35:44 Critique of AICPA and Cybersecurity Education

36:55 Practitioners' Responsibility in Auditing

39:13 The Problem with Automation Tools

43:30 Shady Business Practices in Auditing

47:29 Ethics and Integrity in Auditing

50:34 The Importance of Thorough Audits

Hosted on Acast. See acast.com/privacy for more information.

In this episode, host Troy Fine and producer Elliot Volkman welcome guest Kevin Kriebel, VP of Business Development at Drata. The conversation focuses on the challenges and intricacies of maintaining auditor independence and integrity in the compliance automation landscape. Key topics include the impact of bundling and price fixing on audit quality, the need for improved TPRM functionality, and the role of enterprises in ensuring higher standards. The discussion also addresses the importance of education and transparency in mitigating the risks associated with low-quality audits and driving market changes.

01:04 Introductions and Ground Rules

02:23 Discussing Auditor Independence

04:30 Challenges in the Audit Industry

06:19 Vendor Relationships and Audit Integrity

10:14 Education Gap in Compliance

23:58 Industry Price Fixing Concerns

27:30 Discussing Audit Automation and Vendor Practices

28:19 The Problem with Bundling Services

29:02 Challenges in Vendor Accountability

30:34 The Role of TPRM and AI in Compliance

33:29 The Importance of Education in Compliance

38:24 Market Dynamics and Compliance Requirements

Hosted on Acast. See acast.com/privacy for more information.

In the pilot episode of GRC Uncensored, hosts Troy Fine and Elliot Volkman introduce the podcast aimed at having unfiltered discussions about Governance, Risk, and Compliance (GRC). This episode was recorded before any interviews and offers some retrospectives of what became reality or not. They detail their professional backgrounds, especially highlighting Troy's unexpected journey into auditing and meme culture on LinkedIn. The hosts share the focus of future episodes (which have already been published), including the commoditization of compliance and the quality of audits, while emphasizing the importance of honest and authentic conversations in the GRC field. They also discuss the potential for disagreement among industry professionals and encourage audience engagement and feedback.

00:00 Introduction to GRC Uncensored

00:42 Meet the Hosts: Troy Fine and Elliot Volkman

01:34 Troy's Journey into Auditing and Memes

03:10 The Role of CPAs in Cybersecurity

05:29 The Purpose of GRC Uncensored

07:08 Pilot Season and Episode Preview

09:51 Commoditization of Compliance

19:02 Quality of Audits and Future Topics

21:45 Conclusion and Call for Feedback

Hosted on Acast. See acast.com/privacy for more information.