GRC Leadership: Why a Plan Isn't a Vision

Governance, risk and compliance leaders are operating under a genuine triple bind at the moment, and it shows no sign of easing.

The Triple Bind

The first is structural: business appetite for growth remains loud, while regulatory scrutiny hasn't softened to match it. The gap between "risk on" rhetoric and enforcement reality is where most of my coaching conversations start, and it isn't closing.

The second follows from the first, but it's a separate problem: the playbooks leaders have always relied on are proving less reliable. Traditional approaches were built for a steadier regulatory cycle, and didn’t factor in the speed, urgency or nature of the AI element, and so they're breaking down exactly when leaders need them most.

The third is cultural rather than regulatory: the retreat from flexible working arrangements is quietly reopening questions of trust that many leaders thought were settled. One head of surveillance told me recently that once she'd totted up the childcare logistics, the commute, and the lost family time, staying in her role became a genuine question rather than a given. She wasn't alone in her team.

Any one of these would be manageable alone. Together, they're producing something I see constantly in the coaching room: leaders who are technically excellent, trusted by their boards, and quietly running on empty.

The Difference Between a Plan and a Vision

What separates the leaders coping well from the ones actually leading isn't how they manage the pressure. It's something more fundamental, and it comes from an unlikely source: Timothy Gallwey's The Inner Game of Golf. Gallwey's point is simple, knowing where the hole is matters more than how hard you hit the ball. A perfect swing aimed at the wrong target is wasted effort.

I see a version of this play out regularly in GRC leadership. The leaders I work with are, almost without exception, technically excellent. They build strong frameworks, run comprehensive programmes, and manage regulatory relationships well. But when I ask a different kind of question - "what does your function look like when it's working at its best, beyond meeting regulatory obligations?" - many find it harder to answer. They can tell me what they're doing this year. They can walk me through the plan, the book of work, what's just been remediated. However, the bigger picture, the vision for what the function is actually trying to become, and why that matters to the organisation, is often unclear or unspoken.

This distinction matters more than it might seem. A plan is operational: it tells your team what to do. A vision is directional: it tells people where you're going and why it's worth getting there. When purpose, values and desired outcome are clear, leaders operate with conviction. When they're not, even the most capable people end up stuck in execution mode, doing the work, rather than leading it.

What Vision Actually Buys You

Without a clear vision, it's very difficult to influence senior stakeholders. You're always reactive, responding to what the business or the regulator needs, rather than setting direction. This is a large part of why GRC leaders often feel like "the person who says no." They're protecting the firm, but they can't articulate what they're building toward, only what they're preventing. Prevention is a much harder thing to rally people around than a destination is.

The GRC leaders I see who genuinely influence and who get a different reception from the CEO or the business heads, generally share one thing: a clear, articulated view of what their function contributes to the organisation, beyond compliance as prevention. They can connect conduct, culture and risk management to business strategy in a way that makes senior stakeholders want to engage, rather than merely comply. It’s often a story and/or has a visual – one of the most passionate CCO’s I know used to have a ‘Compliance Donut’ as the image that led people into the vision.

One thing worth sitting with, whichever camp you fall into: if someone asked you today what your vision for your function is - not your plan for the year, but what it looks like when it's working at its best - what would you say? And would your team, your board, or your business stakeholders give the same answer?