# Video and podcast roundups Controlspan Research Desk · Last updated 28 October 2026 # What should an enterprise GRC buyer watch first? **Start with the build-versus-buy panel from Dune Security, Hotman Group’s selection discussion and CompliancePoint’s implementation episode.** Our editorial judgement is that these provide the strongest starting sequence for a buying team: understand the operating commitment, define the selection criteria, then secure the sponsorship and adoption needed to implement. For spreadsheet migration, add the Universal Investment customer presentation. For AI-enabled GRC, pair the AntiCheckBox interview with NIST’s measurement webinar: use the first to challenge governance assumptions and the second to develop more demanding evaluation questions. This is a **media shortlist, not a platform ranking**. Inclusion does not establish that a supplier is suitable for your organisation. ### How was this roundup researched? We reviewed accessible publisher pages, transcripts, episode descriptions and recording announcements. **We did not watch or listen to every recording in full.** Each entry identifies its evidence basis; summaries based on an agenda are explicitly distinguished from transcript-based takeaways. The first six recommendations are YouTube videos or podcasts. Five supplementary publisher-hosted recordings follow because they address enterprise RFPs, implementation, product evaluation and US banking requirements. They are not presented as YouTube videos. Dates distinguish events, publication and recap pages where necessary. Speakers’ affiliations reflect the source or recording, not an independently verified current employment status. Where playback, runtime or access conditions could not be confirmed, that limitation is stated. --- # Which viewing route fits your buying decision? The routes below are **editorial recommendations**, not claims that the recordings collectively resolve the decision. | Your immediate decision | Start with | Produce afterwards | |---|---|---| | Should we buy, build or retain parts of our existing setup? | **1. Dune Security** and **5. GRC Engineer** | A build/buy/partner decision record, including maintenance ownership | | What belongs in our enterprise GRC software requirements checklist? | **2. Hotman Group**, **3. CompliancePoint** and **7. OCEG** | A first-release scope and weighted evaluation scorecard | | How should we move from spreadsheets to GRC software? | **4. Universal Investment** and **8. TransUnion** | A migration readiness checklist and named configuration owners | | What should we test in a ServiceNow IRM demonstration? | **9. ServiceNow Exchange**, followed by **1. Dune Security** | A buyer-specific demonstration script and integration acceptance tests | | How should we assess AI-enabled GRC? | **6. AntiCheckBox** and **10. NIST** | An AI evidence, permissions and human-approval test plan | | What additional context does a US banking buyer need? | **11. FFIEC**, then the relevant platform demonstrations | A framework-version and assessment-mapping decision log | --- # Which YouTube videos and podcasts deserve a place on the shortlist? ### 1. What changes the GRC build-versus-buy decision? **[Buying vs. Building Compliance Automation Tools — watch on YouTube](https://www.youtube.com/watch?v=RoSml7IyL5w)** - **Who:** Jeffrey DeNardo of The Hershey Company, Pierre-Paul Ferland of Coveo and Ayoub Fandi discussing GitLab’s approach; moderated by Alan Luk of Microsoft. - **Date and length:** 6 April 2026; publisher lists one hour. - **Evidence:** Full publisher transcript. Vendor-hosted practitioner panel. **Key takeaways:** The panellists describe different decisions rather than one universal answer. Their discussion identifies ongoing maintenance and audit-season support as important build costs, while purchased platforms can leave substantial integration work with the buyer. They also emphasise mapping core workflows before evaluating tools and checking what apparently healthy dashboards actually measure. [Publisher recording and transcript](https://www.dune.security/events/buying-vs-building-compliance-automation-tools). ([dune.security](https://www.dune.security/events/buying-vs-building-compliance-automation-tools)) **Our suggested buyer exercise:** Create three ownership columns: supplier, implementation partner and internal team. Assign responsibility for every connector, failed data load, workflow change and audit-period incident. **Boundary:** These are organisational experiences, not comparative pricing benchmarks or proof that buying or building is generally cheaper. ### 2. How do you evaluate a GRC platform beyond its demonstration? **[A Practical Approach to Choosing the Right GRC Tool — watch on YouTube](https://www.youtube.com/embed/abz5FaCZDV0)** - **Who:** Cheri Hotman and Angie Iturbide, Hotman Group. - **Date:** Companion page dated 4 June 2025; runtime not verified. - **Evidence:** Detailed publisher recap and linked video. Consultancy perspective. **Key takeaways:** The discussion centres on organisational fit rather than a perfect feature list. The recap addresses desired outcomes, ownership, implementation resources, total cost, adoption, reporting and demonstration warning signs. Its useful dashboard examples include failed controls, missing evidence, residual risk and overdue remediation—not simply an aggregate compliance score. [Publisher recap](https://hotmangroup.com/a-practical-approach-to-choosing-the-right-grc-tool/bpage/3/). ([hotmangroup.com](https://hotmangroup.com/a-practical-approach-to-choosing-the-right-grc-tool/bpage/3/)) **Our suggested buyer exercise:** Replace each broad requirement with an observable task. For example, change “strong reporting” to “trace an overdue remediation from the committee dashboard to its owner, evidence and approval history”. **Boundary:** Use this to improve selection discipline, not to infer which product will satisfy your requirements or what its implementation will cost. ### 3. What should happen before the GRC implementation programme starts? **[S3 E29: Integrating GRC Tools Into Your Compliance Program — listen](https://rss.com/podcasts/compliancepointers/2151287/)** - **Who:** Host Jordan Eisner and Brandon Breslin, introduced as CompliancePoint’s Security Assurance practice director. - **Date and length:** 6 August 2025; 23:52. - **Evidence:** Publisher transcript; audio episode and embedded YouTube version. **Key takeaways:** Breslin puts executive alignment, budget and business objectives before tool selection. He also discusses framework fit, training and wider participation, rather than leaving the platform with one enthusiastic owner. The operational objective is recurring control activity and evidence collection, not a last-minute audit preparation exercise. [Video and transcript](https://www.compliancepoint.com/resources/integrating-grc-tools-into-your-compliance-program/); [episode metadata](https://rss.com/podcasts/compliancepointers/2151287/). ([compliancepoint.com](https://www.compliancepoint.com/resources/integrating-grc-tools-into-your-compliance-program/)) **Our suggested buyer exercise:** Ask the sponsor to approve a one-page charter naming the first workflow, accountable process owner, expected contributors and training owner. **Boundary:** This is principally a security-assurance discussion. Do not assume its framework-oriented examples establish enterprise operational-risk or internal-audit fit. ### 4. What does a spreadsheet-to-GRC customer story reveal about administration? **[Universal Investment × GBTEC | From Spreadsheets to Streamlined GRC with BIC GRC — watch on YouTube](https://www.youtube.com/watch?v=_1ielkrU6ac)** - **Who:** Ewa Cebula, identified by GBTEC as Universal Investment’s Group Digitalization Officer. - **Date and length:** KonBriefing’s media index lists 19 November 2025 and 28:15; player metadata was not independently retrievable. - **Evidence:** Supplier session announcement and customer case study; not a reviewed transcript. **Key takeaways:** GBTEC’s account describes a move away from spreadsheet-based operational and compliance risk management towards configurable workflows. The important implementation detail is the combination of in-house self-service and continuing support from GBTEC specialists. The case therefore offers a useful prompt for discussing administration ownership, not just interface flexibility. [Supplier case study](https://www.gbtec.com/success-stories/universal-investment/), [session announcement](https://www.linkedin.com/posts/gbtec-group_grc-riskmanagement-compliance-activity-7429487282786820098-wXgi) and [media metadata](https://konbriefing.com/ai/en/news.html). ([gbtec.com](https://www.gbtec.com/success-stories/universal-investment/)) **Our suggested buyer exercise:** Request a customer-administrator demonstration: change a field, approval route and report without the implementation partner taking over. **Boundary:** This is a supplier-selected European customer story. It does not establish US regulatory fit, independently measured savings or a repeatable migration timetable. ### 5. Is there a useful alternative to a binary build-or-buy decision? **[Build vs. Buy, GRC Success Metrics and Compliance Commoditisation — watch the GRC Engineering Podcast](https://youtube.com/embed/MnpO8yI58PY)** - **Who:** Ayoub Fandi interviewing Justin Pagano, identified in the recap as Klaviyo’s Director of Security Risk & Trust. - **Date:** Publisher recap dated 24 December 2024; this is not a verified episode-release date. - **Evidence:** Host’s episode recap. Older conceptual material retained for its buying relevance. **Key takeaways:** Pagano introduces a third option: work with a supplier willing to develop around the buyer’s needs. The recap also challenges documentation-heavy activity that is disconnected from meaningful security outcomes. This makes the episode useful for considering partnership and success measures, rather than simply comparing licence features. [Host’s recap](https://grcengineer.com/p/is-grc-engineering-the-next-devsecops/). ([grcengineer.com](https://grcengineer.com/p/is-grc-engineering-the-next-devsecops/)) **Our suggested buyer exercise:** If a shortlist depends on co-development, document ownership, support, delivery acceptance and what happens if the promised capability never ships. **Boundary:** A partnership concept is not evidence that any particular supplier will contractually support it. Do not treat roadmap discussions as delivered functionality. ### 6. How should buyers challenge claims about AI governance? **[ISO 42001 will not make your AI safer | Guest: James Kavanagh — listen](https://podcasts.apple.com/us/podcast/iso-42001-will-not-make-your-ai-safer-guest-james-kavanagh/id6795705666?i=1000788955467)** - **Who:** James Kavanagh on the GRC Engineering Club’s AntiCheckBox Podcast, whose listed creator is Dr. Omar Sangurima. - **Date and length:** 10 September 2026; 47 minutes. - **Evidence:** Publisher-supplied episode description and takeaways, not a reviewed transcript. **Key takeaways:** Kavanagh argues for governance that changes with the systems being governed. The episode description challenges a separation between management-system documentation and engineering practice, including impact assessments that do not influence implementation. Treat the provocative title as the guest’s argument—not an authoritative finding about the standard. [Episode page](https://podcasts.apple.com/us/podcast/iso-42001-will-not-make-your-ai-safer-guest-james-kavanagh/id6795705666?i=1000788955467). ([podcasts.apple.com](https://podcasts.apple.com/us/podcast/iso-42001-will-not-make-your-ai-safer-guest-james-kavanagh/id6795705666?i=1000788955467)) **Our suggested buyer exercise:** Ask an AI-enabled GRC supplier to show what happens when a model, data source or approved use changes: who is notified, what is reassessed and which evidence remains available. **Boundary:** This is governance commentary, not a certification guide or product evaluation. --- # Which supplementary recordings fill the enterprise buying gaps? These five resources are **publisher-hosted webinars or videos**. Their inclusion broadens the decision coverage; it does not imply that they are independently reviewed product tests. ### 7. What belongs in a GRC RFP and implementation specification? **[Navigating the Pitfalls and Challenges of a GRC Software RFP and Implementation — OCEG recording](https://www.oceg.org/navigating-the-pitfalls-and-challenges-of-a-grc-software-rfp-and-implementation-encore-recording/)** - **Who:** Michael Rasmussen of GRC 20/20 Research and Cameron Jackson of Riskonnect. - **Date and access:** Undated encore page. A recording link is provided; playback entitlement was not confirmed. - **Evidence:** Published agenda. Explicitly sponsored by Riskonnect. **What the published agenda supports:** The session addresses GRC strategy, solution capabilities, RFP requirements and selection and implementation pitfalls. Its framing separates organisational GRC practice from the technology bought to support it. Those are directly relevant questions for a cross-functional procurement workshop. [Recording description and sponsorship disclosure](https://www.oceg.org/navigating-the-pitfalls-and-challenges-of-a-grc-software-rfp-and-implementation-encore-recording/). ([oceg.org](https://www.oceg.org/navigating-the-pitfalls-and-challenges-of-a-grc-software-rfp-and-implementation-encore-recording/)) **Our suggested buyer exercise:** Give every mandatory requirement five fields: business purpose, accountable owner, representative scenario, evidence requested and acceptance criterion. **Boundary:** The public description does not establish the detailed advice delivered in the recording. Its sponsorship and unknown original date make it unsuitable as evidence of current competitive positioning. ### 8. How can a customer implementation inform your business case? **[How to Make the Move in Your GRC Program — Onspring recording](https://onspring.com/resources/on-demand-webinars/how-to-make-the-move-in-your-grc-program-on-demand-webinar/)** - **Who:** Jennifer Plowman, identified as TransUnion’s Director of Risk & Compliance Systems & Reporting. - **Date:** Recording page first published 3 February 2025 and updated 19 March 2026; the update is not a new event date. - **Evidence:** Recording description and publisher recap. Vendor-hosted customer account. **Key takeaways:** The material covers product evaluation, translating requirements into solutions, mapping required metrics and gaining internal support. The companion recap emphasises stakeholder participation and choosing measures aligned with organisational objectives, including the distinction between leading and lagging indicators. [Recording page](https://onspring.com/resources/on-demand-webinars/how-to-make-the-move-in-your-grc-program-on-demand-webinar/) and [recap](https://onspring.com/resources/blog/3-proven-insights-for-choosing-the-perfect-grc-platform/). ([onspring.com](https://onspring.com/business-function/grc/how-to-make-the-move-in-your-grc-program-on-demand-webinar/)) **Our suggested buyer exercise:** Define the management report you need first, then work backwards to the records, owners and update routines required to produce it. **Boundary:** The accessible material does not establish a transferable implementation budget or staffing model. Recording playback was not tested. ### 9. What can a ServiceNow IRM release demonstration help you evaluate? **[ServiceNow Exchange: What’s New in the Australia release for IRM and Smart Assessment Engine — recording page](https://www.servicenow.com/community/grc-events/servicenow-exchange-what-s-new-in-the-australia-release-for-irm/ec-p/3557184)** - **Who:** ServiceNow’s risk product team; individual presenters were not named in the reviewed description. - **Date:** 18 June 2026; scheduled as a one-hour event. - **Evidence:** Official on-demand description and recording route. Vendor product presentation. **What the description supports:** The session includes demonstrations of GRC Common Core tools, Smart Assessment Engine and issue-management enhancements. Use it to familiarise evaluators with the workflows the supplier presents—not to establish that those workflows are configured, licensed or appropriate for your organisation. [Official event page](https://www.servicenow.com/community/grc-events/servicenow-exchange-what-s-new-in-the-australia-release-for-irm/ec-p/3557184). ([servicenow.com](https://www.servicenow.com/community/grc-events/servicenow-exchange-what-s-new-in-the-australia-release-for-irm/ec-p/3557184)) **Our suggested buyer exercise:** Repeat an assessment using your own synthetic records, then introduce an overdue response, rejected evidence and an issue requiring reassignment. **Boundary:** This is a June 2026 release-specific recording, not a claim about the newest release. Playback, current packaging and buyer-specific configuration were not validated. ### 10. How can buyers demand better evidence from agentic AI features? **[NIST Information Technology Laboratory AI Webinar Series: Building Measurement Probes into Agentic AI Ecosystems — watch](https://www.nist.gov/video/nist-information-technology-laboratory-ai-webinar-series-building-measurement-probes-agentic)** - **Who:** NIST Information Technology Laboratory’s AI programme. - **Date:** Event dated 7 April 2026; recording runtime not verified. - **Evidence:** Official video and event descriptions. Government research briefing. **Key takeaways:** NIST describes early research into measurement probes, knowledge-grounded verification and evaluation of agentic outputs. The material focuses on traceability and gaps in measurement infrastructure. It is valuable as a counterweight to polished AI demonstrations, but it is research—not a certification of a commercial GRC feature. [Video description](https://www.nist.gov/video/nist-information-technology-laboratory-ai-webinar-series-building-measurement-probes-agentic) and [event details](https://www.nist.gov/news-events/events/2026/04/nist-information-technology-laboratory-ai-webinar-series-building). ([nist.gov](https://www.nist.gov/video/nist-information-technology-laboratory-ai-webinar-series-building-measurement-probes-agentic)) **Our suggested buyer exercise:** Require an inspectable record of source material, tool calls, output, reviewer action and final workflow changes. Separately test restricted evidence, unsupported conclusions and rollback. **Boundary:** Those procurement tests are our recommendation, not a NIST-prescribed GRC checklist. This session does not compare platforms. ### 11. What should US banking buyers understand before accepting framework mappings? **[Cybersecurity Assessment Tool (CAT) Transition — Cyber Risk Institute (CRI): FFIEC recording](https://industryoutreach.ffiec.gov/events/event/1ce9c8b0-119e-4b1f-9fc7-e546c2e08581)** - **Who:** FFIEC Industry Outreach, focusing on the Cyber Risk Institute Profile; individual speakers were not identified on the reviewed page. - **Date and access:** 13 August 2025; the webinar route requests attendee details. - **Evidence:** Official archived-event description. **Key takeaways:** This historical session introduces CRI Profile Version 2.1 in the context of the CAT’s 31 August 2025 sunset. Its value for platform selection is framework-transition context—not endorsement of a software product or a determination of your institution’s obligations. FFIEC states that outreach views are informational and not binding on its members. [Official event description](https://industryoutreach.ffiec.gov/events/event/1ce9c8b0-119e-4b1f-9fc7-e546c2e08581). ([industryoutreach.ffiec.gov](https://industryoutreach.ffiec.gov/events/event/1ce9c8b0-119e-4b1f-9fc7-e546c2e08581)) **Our suggested buyer exercise:** Ask the supplier to identify the exact framework version in its library and demonstrate how changed mappings preserve previous assessment decisions and evidence. **Boundary:** Do not assume the version discussed in this recording remains the appropriate version for a 2026 procurement. Confirm applicability and updates with the institution’s specialists. --- # How should a buying team turn these recordings into evidence? **Use the recordings to generate tests, not to award supplier scores.** The following workshop is our proposed method; it is not a process claimed by any speaker. ### Step 1: Agree the first operational problem Before watching, write down one problem narrowly enough to demonstrate. Examples might include assigning overdue remediation, collecting recurring control evidence or consolidating a particular risk assessment across business units. Record the process owner, the users affected and the decision the resulting report must support. Keep later ambitions in a separate list. ### Step 2: Separate what a source says from what procurement must prove Use four columns: | Note type | What belongs here | How to use it | |---|---|---| | **Source statement** | What the transcript or publisher description actually says | Retain the link and attribution | | **Buyer inference** | Why that statement might matter to your organisation | Validate with the affected process owner | | **Demonstration request** | The task a supplier should perform | Apply the same scenario across the shortlist | | **Acceptance evidence** | The result, limitation and configuration observed | Record demonstrated, partly demonstrated or untested | Do not convert a customer story into a universal implementation assumption. Equally, do not record an undemonstrated capability as absent: it remains unproven until investigated. ### Step 3: Build a common test pack Our recommended pack should ask each shortlisted supplier to: - [ ] Import a small synthetic dataset containing duplicate identifiers, missing owners and a broken relationship. - [ ] Explain which defects are rejected, corrected or accepted, and retain the reconciliation record. - [ ] Route an overdue action through escalation and reassignment. - [ ] Restrict an evidence attachment while allowing an authorised user to see the associated control. - [ ] Demonstrate a failed integration and the recovery process. - [ ] Let a buyer administrator change a field, routing rule and report. - [ ] Export linked records, attachments and relevant history for inspection. - [ ] Identify which demonstrated elements require extra modules, services or custom work. - [ ] Run any proposed AI feature against both sufficient and deliberately insufficient evidence. - [ ] Show how a reviewer rejects an AI recommendation without losing the decision record. These are proposed acceptance scenarios—not claims that the recordings demonstrate them or that any listed platform passes them. ### Step 4: Make the cost questions operational For a **three-year GRC total cost of ownership comparison**, request separate buyer-specific estimates for: | Cost area | Question to put to the supplier or partner | |---|---| | Subscription scope | Which user categories, modules, entities and environments are included? | | Implementation | Which decisions and data-cleansing tasks remain the buyer’s responsibility? | | Integration | Who builds, monitors and repairs each connection? | | Administration | Which changes can our administrators make, and what training is needed? | | Dual running | What assumptions underpin the proposed cutover and legacy retirement dates? | | Renewal and exit | What can be exported, in what form, with what assistance and charges? | Leave unanswered items marked **unknown**, rather than entering zero. None of the reviewed media establishes a comparable enterprise GRC price benchmark for your shortlist. --- # What does this roundup not settle? **It does not establish a winner in ServiceNow IRM vs Archer vs IBM OpenPages, or in AuditBoard/Workiva-style controls-led comparisons.** It also does not provide independently verified migration costs, implementation durations or administrator staffing ratios. The principal gaps for a second research pass are: - Field-level migration demonstrations covering attachments, relationships, historical approvals and reconciliation. - Independent accounts of failed or substantially reworked implementations. - Comparable evidence on three-year operating cost and exit assistance. - US healthcare-specific and SOX-focused platform evaluations. - Buyer-controlled tests of AI permissions, evidence provenance and action approval. For an active procurement, use this shortlist as preparation for reference interviews and scenario testing—not as a substitute for either. --- # Sources ### YouTube and podcast recommendations 1. [Dune Security — recording, speakers and full transcript](https://www.dune.security/events/buying-vs-building-compliance-automation-tools) 2. [Hotman Group — session recap and YouTube link](https://hotmangroup.com/a-practical-approach-to-choosing-the-right-grc-tool/bpage/3/) 3. [CompliancePoint — video and transcript](https://www.compliancepoint.com/resources/integrating-grc-tools-into-your-compliance-program/) 4. [Compliance Pointers — episode date, runtime and audio](https://rss.com/podcasts/compliancepointers/2151287/) 5. [GBTEC — Universal Investment customer case study](https://www.gbtec.com/success-stories/universal-investment/) 6. [GBTEC — customer-session announcement](https://www.linkedin.com/posts/gbtec-group_grc-riskmanagement-compliance-activity-7429487282786820098-wXgi) 7. [KonBriefing — video discovery and reported metadata](https://konbriefing.com/ai/en/news.html) 8. [GRC Engineer — Justin Pagano episode recap and embedded video](https://grcengineer.com/p/is-grc-engineering-the-next-devsecops/) 9. [AntiCheckBox — James Kavanagh episode and publication metadata](https://podcasts.apple.com/us/podcast/iso-42001-will-not-make-your-ai-safer-guest-james-kavanagh/id6795705666?i=1000788955467) 10. [AntiCheckBox — programme and creator information](https://podcasts.apple.com/us/podcast/the-grc-engineering-clubs-anticheckbox-podcast/id6795705666) ### Supplementary recordings 11. [OCEG — RFP and implementation recording description](https://www.oceg.org/navigating-the-pitfalls-and-challenges-of-a-grc-software-rfp-and-implementation-encore-recording/) 12. [Onspring — TransUnion recording page](https://onspring.com/resources/on-demand-webinars/how-to-make-the-move-in-your-grc-program-on-demand-webinar/) 13. [Onspring — companion selection and metrics recap](https://onspring.com/resources/blog/3-proven-insights-for-choosing-the-perfect-grc-platform/) 14. [ServiceNow — IRM and Smart Assessment Engine recording page](https://www.servicenow.com/community/grc-events/servicenow-exchange-what-s-new-in-the-australia-release-for-irm/ec-p/3557184) 15. [NIST — agentic measurement video](https://www.nist.gov/video/nist-information-technology-laboratory-ai-webinar-series-building-measurement-probes-agentic) 16. [NIST — event date and research description](https://www.nist.gov/news-events/events/2026/04/nist-information-technology-laboratory-ai-webinar-series-building) 17. [FFIEC — CAT transition and CRI archived webinar](https://industryoutreach.ffiec.gov/events/event/1ce9c8b0-119e-4b1f-9fc7-e546c2e08581)