Use a mixed panel: a recognised researcher, an operating-model specialist, an assurance practitioner, an engineering practitioner and a sector specialist. Add a recent buyer who operated the selected platform after implementation; do not substitute a supplier-selected success story for that perspective.
| Suggested expert | Publicly documented basis for inclusion | Best questions to put to them | Interview safeguard |
|---|---|---|---|
| Michael Rasmussen | Founder of GRC 20/20 Research; his biography describes research and advisory work on GRC architecture and technology decisions, including relationships with suppliers and investors. (grc2020.com) | Platform boundaries, implementation due diligence, architecture, commercial assumptions and exit. | Request disclosure of relevant supplier, investor and advisory relationships. |
| Carole Switzer | OCEG co-founder, with published work on GRC, controls and AI. (oceg.org) | Accountability, minimum viable scope, control ownership and adoption. | Distinguish operating-model guidance from claims about particular products. |
| Norman Marks | Former internal audit leader, CRO and compliance leader; author on risk management, SOX and internal audit. His biography also discloses work with software vendors. (normanmarks.wordpress.com) | Whether to buy, risk reporting, evidence quality and assurance independence. | Ask which conclusions come from direct operating experience and which are professional judgement. |
| Ayoub Fandi | Author of a first-person account accompanying an RSAC 2026 presentation on buying and building GRC tooling at GitLab. (grcengineer.com) | Workflow discovery, build-versus-buy boundaries, integrations and engineering ownership. | Test whether lessons transfer from an engineering-led technology company to the buyer’s regulated environment. |
| Gregory C. Rasner | Founder of Third Party Threat Hunting and former SVP of Cybersecurity Third-Party Risk at Truist, according to his published biography. (rasner.com) | Third-party dependencies, monitoring, resilience and supplier due diligence. | Disclose consulting, training and commercial relationships relevant to the discussion. |
| Apostol Vassilev | NIST researcher and an author of its 2025 adversarial machine-learning taxonomy. (nist.gov) | AI evaluation, adversarial inputs, permissions and limits of assurance. | Seek technical principles, not government endorsement or comparative product recommendations; participation would be subject to applicable approvals. |
Additional voices to recruit: a bank GRC product owner, a healthcare security/compliance lead, a SOX programme owner, a platform administrator and a software procurement specialist. These are recruitment requirements, not identified or confirmed interviewees.
Before recording, ask every participant to disclose employment, implementation partnerships, referral arrangements, sponsored research and investments relevant to named suppliers. Record the date, product version, modules, deployment model and extent of hands-on experience behind each product-specific statement.
Sources cited on this page
- grc2020.com ↗grc2020.com
- oceg.org ↗www.oceg.org
- normanmarks.wordpress.com ↗normanmarks.wordpress.com
- grcengineer.com ↗grcengineer.com
- rasner.com ↗rasner.com
- nist.gov ↗www.nist.gov