Adapting to the Speed of Risk: Why GRC Programs Must Move with the Business | A Brand Highlight Conversation with Steve Schlarman, Senior Director of Archer

RSA C2026 conference, where insights drive action, solutions emerge, and community connections

spark innovation.

Be there March 23rd through March 26th, secure your spot at rsaconference.com forward slash

ITSPMAG26.

Hello everybody, welcome to a new brand Highlight, and we are thrilled to welcome Steve Slarman

from Archer, How are you Steve?

Good, good.

We're going to be talking about governance, risking compliance, AK-AGRC, adaptive GRC,

and of course the ARCHER evolve suite that helps organizations get a hand in on all the

stuff.

Quick word for me about your role at ARCHER and what you're up to these days.

Sure, sure.

So I'm Steve Slarman.

I've been with ARCHER for quite a few years, started my 19th, 18th year, something of

that nature.

So I generally work with helping define what the overall industry with the GRC direction

is, the strategy, and help guide some of our direction from a product perspective.

So I leverage my experience in the industry and my working with clients on what their

challenges are, and then help translate that into our product organization.

So let's look at that quickly, kind of the trends you're seeing, customers having challenges

with the GRC, and the trends you're kind of helping organizations get ahead of as you

build new products and capabilities.

Yeah, I think the forces that are affecting organizations are kind of well known.

It's the velocity of change, it's the volume of change, it is the uncertainty that all

of that change creates, and it's compounded by the complexity of business today.

So those forces have remained consistent, but I think one of the things that the GRC functions

are seeing is that the business is moving really fast.

And by the time common traditional cycles of GRC activities like the annual audit planning

or the quarterly risk and control self-assessment, by the time those activities get done and

the reports and the data kind of flow back to the decision makers, things have changed

already.

So it not only is lagging behind the business, but it's creating a drift between the

perspectives that the decision makers are looking for and the perspectives that GRC functions

can provide, there's this drift, there's this gap, if you will, and every gap is going

to create some type of exposure because you're making decisions potentially on old data.

The other thing is that that requires then a lot of rework.

So there's a lot of extra costs associated with these gaps in trying to close them very

quickly.

GRC functions end up many times in a reactive mode and that's really what we're focused

on at Archer is how do we help GRC functions adapt and manage the risk of change, not

just manage risk and compliance as a check the box exercise or really as a rear view mirror

type of thing.

We really want to help our clients project out what are some of the implications of business

changes like moving into new jurisdictions or launch products.

What are the compliance obligations?

What are those requirements that can help the business make other decisions or as emerging

risks start affecting the business, how does the exposure change?

And so that's really what we're focused on is how do we accelerate those processes?

How do we get current data and recreate this program that's in motion all the time?

It's not waiting for approvals, it's not waiting for an assessment to get finished.

It's moving along with the business.

Yeah, so sure everybody recognizes you have to look back to see where you came from.

You have to know where you are at the moment.

You have to have a view for the future.

That's kind of moving from reactive to proactive, but you're taking it to the next level

with the adaptive, which is kind of a full cycle, full circle.

Exactly.

And one of the things that is really propelling this from a technology perspective is the use

of AI, but in a much, in a focused, meaningful manner, our AI strategy is really, how do we

leverage this new technology with guardrails, so that you're not just building generic

agents, you're building AI operators to solve G or C problems, and that's really where

our strategy lies.

So tell us where folks can learn more about the evolve suite.

Visit our website, archerirm.com, and you'll see more and more materials coming out as

we expand our efforts around archer evolve.

Anytime if you're a existing archer customer and you haven't seen our technology lately

or what we're up to, please engage with your client success teams that we have in place.

Because this has been with archer for a long time.

It's not the same archer that it was even five years ago.

And so the technology is accelerated, and so reach out to us, be happy to explore how

we can help take your G or C program to the next level.

Perfect.

Thanks, Steve.

Appreciate you sharing this highlight with us, and I hope everybody enjoys it.

Great.

Thank you.

RSA C2026 conference, where insights drive action, solutions emerge, and community connections

spark innovation.

Be there March 23rd through March 26th.

Secure your spot at rsaconference.com, forward slash ITSPMAG26.