# Which YouTube videos and podcasts deserve a place on the shortlist?

### 1. What changes the GRC build-versus-buy decision?

**[Buying vs. Building Compliance Automation Tools — watch on YouTube](https://www.youtube.com/watch?v=RoSml7IyL5w)**

- **Who:** Jeffrey DeNardo of The Hershey Company, Pierre-Paul Ferland of Coveo and Ayoub Fandi discussing GitLab’s approach; moderated by Alan Luk of Microsoft.
- **Date and length:** 6 April 2026; publisher lists one hour.
- **Evidence:** Full publisher transcript. Vendor-hosted practitioner panel.

**Key takeaways:** The panellists describe different decisions rather than one universal answer. Their discussion identifies ongoing maintenance and audit-season support as important build costs, while purchased platforms can leave substantial integration work with the buyer. They also emphasise mapping core workflows before evaluating tools and checking what apparently healthy dashboards actually measure. [Publisher recording and transcript](https://www.dune.security/events/buying-vs-building-compliance-automation-tools). ([dune.security](https://www.dune.security/events/buying-vs-building-compliance-automation-tools))

**Our suggested buyer exercise:** Create three ownership columns: supplier, implementation partner and internal team. Assign responsibility for every connector, failed data load, workflow change and audit-period incident.

**Boundary:** These are organisational experiences, not comparative pricing benchmarks or proof that buying or building is generally cheaper.

### 2. How do you evaluate a GRC platform beyond its demonstration?

**[A Practical Approach to Choosing the Right GRC Tool — watch on YouTube](https://www.youtube.com/embed/abz5FaCZDV0)**

- **Who:** Cheri Hotman and Angie Iturbide, Hotman Group.
- **Date:** Companion page dated 4 June 2025; runtime not verified.
- **Evidence:** Detailed publisher recap and linked video. Consultancy perspective.

**Key takeaways:** The discussion centres on organisational fit rather than a perfect feature list. The recap addresses desired outcomes, ownership, implementation resources, total cost, adoption, reporting and demonstration warning signs. Its useful dashboard examples include failed controls, missing evidence, residual risk and overdue remediation—not simply an aggregate compliance score. [Publisher recap](https://hotmangroup.com/a-practical-approach-to-choosing-the-right-grc-tool/bpage/3/). ([hotmangroup.com](https://hotmangroup.com/a-practical-approach-to-choosing-the-right-grc-tool/bpage/3/))

**Our suggested buyer exercise:** Replace each broad requirement with an observable task. For example, change “strong reporting” to “trace an overdue remediation from the committee dashboard to its owner, evidence and approval history”.

**Boundary:** Use this to improve selection discipline, not to infer which product will satisfy your requirements or what its implementation will cost.

### 3. What should happen before the GRC implementation programme starts?

**[S3 E29: Integrating GRC Tools Into Your Compliance Program — listen](https://rss.com/podcasts/compliancepointers/2151287/)**

- **Who:** Host Jordan Eisner and Brandon Breslin, introduced as CompliancePoint’s Security Assurance practice director.
- **Date and length:** 6 August 2025; 23:52.
- **Evidence:** Publisher transcript; audio episode and embedded YouTube version.

**Key takeaways:** Breslin puts executive alignment, budget and business objectives before tool selection. He also discusses framework fit, training and wider participation, rather than leaving the platform with one enthusiastic owner. The operational objective is recurring control activity and evidence collection, not a last-minute audit preparation exercise. [Video and transcript](https://www.compliancepoint.com/resources/integrating-grc-tools-into-your-compliance-program/); [episode metadata](https://rss.com/podcasts/compliancepointers/2151287/). ([compliancepoint.com](https://www.compliancepoint.com/resources/integrating-grc-tools-into-your-compliance-program/))

**Our suggested buyer exercise:** Ask the sponsor to approve a one-page charter naming the first workflow, accountable process owner, expected contributors and training owner.

**Boundary:** This is principally a security-assurance discussion. Do not assume its framework-oriented examples establish enterprise operational-risk or internal-audit fit.

### 4. What does a spreadsheet-to-GRC customer story reveal about administration?

**[Universal Investment × GBTEC | From Spreadsheets to Streamlined GRC with BIC GRC — watch on YouTube](https://www.youtube.com/watch?v=_1ielkrU6ac)**

- **Who:** Ewa Cebula, identified by GBTEC as Universal Investment’s Group Digitalization Officer.
- **Date and length:** KonBriefing’s media index lists 19 November 2025 and 28:15; player metadata was not independently retrievable.
- **Evidence:** Supplier session announcement and customer case study; not a reviewed transcript.

**Key takeaways:** GBTEC’s account describes a move away from spreadsheet-based operational and compliance risk management towards configurable workflows. The important implementation detail is the combination of in-house self-service and continuing support from GBTEC specialists. The case therefore offers a useful prompt for discussing administration ownership, not just interface flexibility. [Supplier case study](https://www.gbtec.com/success-stories/universal-investment/), [session announcement](https://www.linkedin.com/posts/gbtec-group_grc-riskmanagement-compliance-activity-7429487282786820098-wXgi) and [media metadata](https://konbriefing.com/ai/en/news.html). ([gbtec.com](https://www.gbtec.com/success-stories/universal-investment/))

**Our suggested buyer exercise:** Request a customer-administrator demonstration: change a field, approval route and report without the implementation partner taking over.

**Boundary:** This is a supplier-selected European customer story. It does not establish US regulatory fit, independently measured savings or a repeatable migration timetable.

### 5. Is there a useful alternative to a binary build-or-buy decision?

**[Build vs. Buy, GRC Success Metrics and Compliance Commoditisation — watch the GRC Engineering Podcast](https://youtube.com/embed/MnpO8yI58PY)**

- **Who:** Ayoub Fandi interviewing Justin Pagano, identified in the recap as Klaviyo’s Director of Security Risk & Trust.
- **Date:** Publisher recap dated 24 December 2024; this is not a verified episode-release date.
- **Evidence:** Host’s episode recap. Older conceptual material retained for its buying relevance.

**Key takeaways:** Pagano introduces a third option: work with a supplier willing to develop around the buyer’s needs. The recap also challenges documentation-heavy activity that is disconnected from meaningful security outcomes. This makes the episode useful for considering partnership and success measures, rather than simply comparing licence features. [Host’s recap](https://grcengineer.com/p/is-grc-engineering-the-next-devsecops/). ([grcengineer.com](https://grcengineer.com/p/is-grc-engineering-the-next-devsecops/))

**Our suggested buyer exercise:** If a shortlist depends on co-development, document ownership, support, delivery acceptance and what happens if the promised capability never ships.

**Boundary:** A partnership concept is not evidence that any particular supplier will contractually support it. Do not treat roadmap discussions as delivered functionality.

### 6. How should buyers challenge claims about AI governance?

**[ISO 42001 will not make your AI safer | Guest: James Kavanagh — listen](https://podcasts.apple.com/us/podcast/iso-42001-will-not-make-your-ai-safer-guest-james-kavanagh/id6795705666?i=1000788955467)**

- **Who:** James Kavanagh on the GRC Engineering Club’s AntiCheckBox Podcast, whose listed creator is Dr. Omar Sangurima.
- **Date and length:** 10 September 2026; 47 minutes.
- **Evidence:** Publisher-supplied episode description and takeaways, not a reviewed transcript.

**Key takeaways:** Kavanagh argues for governance that changes with the systems being governed. The episode description challenges a separation between management-system documentation and engineering practice, including impact assessments that do not influence implementation. Treat the provocative title as the guest’s argument—not an authoritative finding about the standard. [Episode page](https://podcasts.apple.com/us/podcast/iso-42001-will-not-make-your-ai-safer-guest-james-kavanagh/id6795705666?i=1000788955467). ([podcasts.apple.com](https://podcasts.apple.com/us/podcast/iso-42001-will-not-make-your-ai-safer-guest-james-kavanagh/id6795705666?i=1000788955467))

**Our suggested buyer exercise:** Ask an AI-enabled GRC supplier to show what happens when a model, data source or approved use changes: who is notified, what is reassessed and which evidence remains available.

**Boundary:** This is governance commentary, not a certification guide or product evaluation.