Only 4.7% of GRC functions report that ‘activity is underway to remove governance, risk and compliance controls’ in response to global deregulatory moves, while 48.4% say these measures have had ‘no impact at all’.
In practice, deregulation is generating analysis work for GRC teams rather than reducing their workload — and ‘understanding the business’ and ‘company culture and values’ remain the two factors practitioners rank highest for keeping the business honest as red tape recedes.
Key Statistics
- 48.4% of firms report deregulation moves have had ‘no impact at all’ on them to date.
- Only 4.7% say ‘activity is underway’ to remove GRC controls in response to deregulation.
- 28.1% rank ‘understanding the business’ as the single most important GRC activity.
- ‘Interpreting and applying legal & regulatory requirements’ scores highest overall among GRC activities (score 7.19).
- 61.5% rank ‘company culture and values’ as the top factor ensuring right conduct, absent the threat of penalties.
Source: ICA Global GRC Survey 2025. Survey of 383 practitioners across 87 countries and 30+ sectors.
Impact of deregulatory moves on firms
Despite significant political noise around deregulation — particularly in the US and UK — firms are, for now, mostly watching rather than acting. Nearly half report no impact at all, and a similar share say there are discussions underway but no action yet taken.
| Impact reported | % of respondents |
|---|---|
| No impact at all | 48.44% |
| There are discussions but no action | 46.88% |
| Activity is underway to remove GRC controls | 4.69% |
Most important GRC activities (ranked)
‘Understanding the business’ is rated the single most important GRC activity by the largest share of respondents (28.1%), narrowly ahead of ‘interpreting and applying legal & regulatory requirements’ (15.6% rank-1, but the highest weighted score overall at 7.19). This reflects a shift away from GRC as a purely technical, rules-based function.
| GRC activity | Rank 1 | Score |
|---|---|---|
| Interpreting and applying legal & regulatory requirements | 15.63% | 7.19 |
| Understanding the business | 28.13% | 7.15 |
| Facilitating good governance | 7.81% | 6.48 |
| Educating the business | 17.19% | 6.47 |
| Managing risk | 10.94% | 6.11 |
| Horizon scanning | 9.90% | 5.12 |
| Policy development | 2.08% | 4.65 |
| Oversight | 6.77% | 4.14 |
| Delivering training | 0.52% | 3.92 |
| Problem solving | 1.04% | 3.77 |
What ensures ‘the right business in the right way’, aside from regulatory penalty risk
Company culture and values is, by a very wide margin, the factor practitioners trust most to keep a business behaving well absent the threat of enforcement — 61.5% rank it first, more than three times the next-highest factor (reputational risk, 19.3%).
| Factor | Rank 1 | Score |
|---|---|---|
| Company culture and values | 61.46% | 5.91 |
| Reputational risk | 19.27% | 5.42 |
| Business performance / competitive advantage | 7.29% | 3.94 |
| Staff attraction and retention | 2.60% | 3.86 |
| Supply chain / third-party risk | 1.56% | 3.39 |
| Litigation risk | 4.17% | 3.11 |
| Shareholder activism | 3.65% | 2.38 |
Summary
The data suggests deregulation, in the near term, means change rather than relief for GRC teams — removing rules doesn't remove the underlying principles firms have built into their culture, systems and controls. As one survey respondent put it, the burden shifts from following new rules to analysing and coordinating the removal of old ones.