This is a précis of Tor Inge Vasshus’s presentation at the G[P]RC Summit 2026 held in Riyadh, KSA.
Organizations today operate in an environment defined by constant change. Geopolitical shifts, evolving regulations, technological disruption, cybersecurity threats, and changing stakeholder expectations mean that achieving strategic objectives has never been more challenging.
Traditional Governance, Risk, and Compliance (GRC) practices have helped organizations strengthen oversight and meet regulatory obligations. Yet many organizations still manage strategy, performance, risk, compliance, and assurance as separate disciplines.
The question is no longer whether organizations need governance.
The question is whether governance is helping organizations consistently achieve what matters most.
Governance as a strategic enabler
Governance is often perceived as a necessary constraint, something that introduces additional reviews, approvals, and controls before decisions can be made. But effective governance should do the opposite.
Consider a Formula 1 car. Its powerful braking system isn’t designed to slow the car down; it’s designed to give the driver the confidence to go faster. Knowing the car can safely handle sharp corners allows the driver to accelerate with confidence.
Organizations work the same way.
“Strong governance provides leaders with the visibility, controls, and confidence to make faster, better-informed decisions. Rather than becoming a barrier to innovation or growth, governance becomes an enabler of sustainable performance.”
The Future of Governance is connected
Growing business complexity demands a more connected approach, yet many organizations continue to manage strategy, performance, risk, compliance, and assurance as separate functions.
The future of governance lies in bringing these disciplines together.
By integrating governance, performance, risk, and compliance into a single connected framework, and supporting it with technologies like Digital Twins, organizations can move beyond oversight toward resilient performance.
From GRC to GPRC
For decades, GRC has provided organizations with the structure to manage governance, risk, compliance, and assurance. These disciplines remain fundamental, but they often operate independently of strategy execution and performance management.
This is where GPRC introduces an important shift. By adding Performance to the equation, organizations can connect strategic objectives with the risks, controls, and governance activities that influence their success. Instead of reviewing performance in one meeting, risks in another, and compliance in a third, leaders gain a connected view of how each discipline contributes to achieving business outcomes.
The value of GPRC isn’t that it replaces GRC; it’s that it closes a long-standing gap between governance and strategy execution.
Why Performance alone isn’t enough
Many organizations measure success through dashboards filled with KPIs.
“If revenue is growing, projects are on schedule, and operational metrics are green, leadership assumes the organization is performing well. “
But performance metrics only tell part of the story. They show what has happened, not necessarily what could prevent future success.
The Titanic is a fitting example. Before it struck the iceberg, many operational indicators suggested the voyage was progressing exactly as planned. The ship was moving at speed, passengers were on board, and the journey appeared successful. Yet the true objective wasn’t simply to maintain speed, it was to get everyone safely to New York. Performance looked healthy, but unmanaged risks ultimately determined the outcome.
The lesson for organizations is clear: performance and risk cannot be viewed independently. Real success comes from understanding both.
The Path to Resilient Performance
To consistently achieve strategic objectives, organizations need an approach that brings performance, and risk together. Resilient performance is built on this principle.
Every organization sets a strategy to achieve its long-term vision. But executing that strategy requires more than tracking performance, it requires understanding the uncertainties that could influence its success. Resilient performance is the ability to consistently achieve strategic objectives by balancing strategic ambition with effective risk management, even as conditions change.
Rather than treating strategy, performance, and risk as separate disciplines, organizations should recognize that they are inherently connected. Strategy defines where the organization wants to go, performance measures whether it is making progress, and risk highlights what could prevent it from getting there. Only by viewing these together, can leaders gain a complete picture of organizational health and make better-informed decisions.
Connecting the Enterprise through a Digital Twin
Achieving resilient performance requires more than reports and dashboards. Organizations need a connected understanding of how strategy, objectives, risks, controls, compliance obligations, projects, processes, and organizational structures influence one another.
By creating a digital representation of the enterprise and the relationships between its key business elements, a digital twin of an organization (DTO) provides leaders with a holistic view of how decisions in one area impact outcomes across the organization. Instead of navigating disconnected systems and siloed information, leadership gains a unified view that strengthens governance, improves decision-making, and supports the successful execution of strategy.
AI must be Reliable before it can be valuable
Artificial intelligence is rapidly becoming part of enterprise decision-making, but not every AI implementation creates value. Generic AI tools can generate quick answers, yet executive decisions require something far more important than speed, they require trust.
For AI to support governance effectively, it must operate within the context of the organization. A connected GPRC framework provides that context by bringing together strategy, performance, risk, compliance, and governance into a single source of truth. Combined with a Digital Twin of the Organization, this gives AI access to structured business information, clear governance models, reliable data, and transparent decision paths. Without these foundations, AI risks producing recommendations that are difficult to verify, explain, or audit.
To continue learning how to achieve resilient performance through connected governance, watch the full replay of the GPRC Summit Riyadh 2026 keynote session here
AI-Powered GPRC – Built for the Enterprise