Inside GRCMANA
Why I Built GRCMANA: Closing the Enterprise Trust Gap
Good firms lose deals and regulatory ground because they can't prove their controls run. The founding thesis behind GRCMANA.
Key takeaways
The Enterprise Trust Gap is the distance between what a firm can prove about its security and governance and what a buyer, investor or regulator needs to see. It is a proof problem, not a security problem. Closing it means treating trust as infrastructure: evidence collected from systems, reused, published and owned by one named person.
- Enterprise Trust Gap
- The distance between what a firm can prove about its security and governance and what an enterprise buyer, investor or regulator needs to see before saying yes.
- The commercial gate
- For B2B tech firms selling into regulated industries, the gap shows up as the security questionnaire, the certification demand and the due diligence that stalls a deal.
- DORA flow-down
- Since 17 January 2025, DORA has required EU financial entities to put supplier cooperation with authorities in their ICT contracts and, for critical or important functions, unrestricted access and audit rights.
- FCA operational resilience
- Insurers, banks, payment firms and other firms in scope had until 31 March 2025 to ensure they could keep their important business services within their impact tolerances.
Good firms lose enterprise deals, and regulated firms lose ground with the regulator, for a reason that has little to do with security. They are usually secure enough. What they can't do is prove it when a buyer, a board or a supervisor asks. That distance is the Enterprise Trust Gap, and I built GRCMANA to close it. Trust is market access infrastructure, not overhead. If you treat it as overhead, you produce documents once a year and hope. If you treat it as infrastructure, you build a system that can show the proof on demand. Do the first, and the deal waits at procurement while you look for the proof.
What is the Enterprise Trust Gap?
The Enterprise Trust Gap is the distance between what a firm can prove about its security and governance and what an enterprise buyer, investor or regulator needs to see before saying yes. It is a proof problem, not a security problem. A firm can run good controls and still fall into it, because nobody can show those controls working.
It isn't the "AI trust gap" you'll find in most articles that use similar words. Those pieces ask whether people can trust what an AI model tells them. This gap sits between two firms, or between a firm and its regulator. One side has to show evidence. The other side has to decide whether to accept it.
Why the usual view gets it wrong
The usual view says a stalled deal or a hard regulatory question is a security problem, so the fix is more security. Write more policies, buy a platform, commission an assessment. Each of those has its place. None of them closes the gap on its own, because none of them produces proof that controls run today.
Look at the three fixes most firms reach for:
- More documents. Policies say what should happen. They don't show that it did. Most compliance work produces documents. Enterprise buyers and regulators are looking for evidence.
- A platform with nobody to run it. Software can collect and display evidence, but someone has to own the controls behind it, fix what fails and answer the follow-up questions. Without that person, failures pile up on the dashboard and nobody fixes them.
- Findings with no system behind them. A one-off review tells you what's wrong in a given month. If nothing is built to keep the fixes running, the same findings come back next year.
None of this is wasted effort. It just answers a different question from the one the other side is asking.
What I saw from the buyer's side
I spent four years on the buy side in financial services, deciding whether technology suppliers passed or failed security review. I'm the buyer who used to reject your security questionnaire, and I know what those reviews are actually looking for. It isn't a long policy library. It's evidence that the controls you describe are running.
From the buyer's seat, the pattern rarely changed: good firms with real products, parked at procurement because nobody could show that their controls actually ran. The same gap shows up with two different stakes, depending on who is asking.
The commercial gate
For a B2B tech firm selling into regulated industries, the gap is a commercial gate. It looks like the security questionnaire that arrives late in the sales cycle, the buyer who asks for a certification you don't hold yet, or the due diligence call that stalls the deal. The buyer isn't being difficult. A regulated buyer that outsources a critical or important function stays fully responsible for its own obligations, under the FCA's outsourcing rules in the UK and under DORA in the EU. So it needs evidence it can put on file.
The regulatory gate
For a regulated financial services or insurance firm, the gap is a regulatory gate. It shows up as the supervisory question, the board challenge, or a request from an EU client that you can't answer with evidence.
The FCA's operational resilience rules came into force on 31 March 2022. Firms in scope, which include insurers, banks, and payment and e-money firms, had until 31 March 2025 to ensure they could keep their important business services within impact tolerances. The FCA has also published new incident and third-party reporting requirements (PS26/2), which come into force on 18 March 2027.
DORA reaches UK firms by a different route. Regulation (EU) 2022/2554 has applied since 17 January 2025. It is aimed at EU financial entities, not at the UK firms that supply them. But it keeps those entities "fully responsible" for their obligations when they rely on ICT suppliers, and Article 30 requires their ICT contracts to include supplier cooperation with competent authorities. For services that support critical or important functions, it also requires "unrestricted rights of access, inspection and audit". If you supply ICT services to an EU bank or insurer, those clauses land in your contract, and the evidence requests follow.
One thesis, then, with different stakes. For tech firms, trust unlocks enterprise revenue. For regulated firms, trust is the licence to operate.
The strongest objection: a platform and an annual audit are enough
The fair version of the objection goes like this. A compliance platform plus an annual audit by your certification body is cheaper than anything else on offer. It produces a certificate buyers recognise and a dashboard the board can see. For a firm of 50 people, why build anything more?
It's a reasonable position, and for some firms it holds. Platforms are strong tools for firms with a compliance team to run them. Most firms with 25 to 250 people don't have one. Without that team, the platform becomes one more system for someone to run on top of their day job.
The certificate has a different limit. It tells a buyer that a control set was assessed at some point in the past. It doesn't tell them those controls are running today. The questionnaire, the supervisor and the DORA audit clause all ask about now. A certificate is the start of the answer, not the answer.
What to do about it this quarter
Five moves you can start this quarter, and none of them needs a new purchase:
- List what your buyers and your regulator ask for. Pull the last few questionnaires, the due diligence requests and any supervisory or client letters. Write down each question and the evidence that would answer it.
- Collect evidence from systems, not documents. Where a control runs in a system, take the proof from that system on a schedule. Our guide to automated evidence collection shows how that works.
- Answer questionnaires once and reuse the answers. Build one approved answer set with evidence attached, so the same question asked in different words gets the same answer. Our guide to security questionnaires sets out how.
- Publish your proof. Put what you can share in one place a buyer can check before they ask. A trust centre does this when it shows evidence, not slogans.
- Name one owner. One person, with the time and authority to keep the evidence current. Which GRC operating model fits depends on your size, but the owner has to be named.
Trust is infrastructure, so build it like infrastructure
The Enterprise Trust Gap closes when proof stops being a yearly project and becomes something the firm runs. That's why GRCMANA exists: to help firms build proof that keeps working after we leave. If you sell into regulated industries, start with our guide to GRC for B2B tech firms.
Frequently asked questions
No. The AI trust gap is about whether people can rely on what an AI system produces. The Enterprise Trust Gap is about whether a firm can prove its security and governance to a buyer, investor or regulator. The two meet when a firm sells an AI product: the buyer will then ask for evidence of how that AI is governed, and that evidence sits inside the Enterprise Trust Gap.
Take the questions from your last few questionnaires and any regulator or client requests, and sort each one into three groups: answered with current evidence from a system, answered with a document only, or not answered at all. The second and third groups are your gap. Work through them in order of the deals or reviews they hold up.
A certificate helps, but a buyer reads two things on it: the date and the scope. It covers only what its scope statement names, as assessed at that time. So the buyer will still ask whether the service they are buying sits inside that scope, and whether the controls are running now.
