# GRC Engineer (grcengineer.com)

> The GRC Engineering newsletter, podcast, and research by Ayoub Fandi, co-author of the GRC Engineering Manifesto. GRC engineering applies software engineering principles to governance, risk, and compliance: policy FROM code, evidence from pipelines, outcomes over activity.

## Key pages
- [What is GRC Engineering](https://grcengineer.com/what-is-grc-engineering/): the practitioner's definition
- [The GRC Engineer role](https://grcengineer.com/grc-engineer/): skills, path, career
- [State of GRC 2026](https://grcengineer.com/report): independent survey, 795 practitioners
- [The Changelog](https://grcengineer.com/archive): every release since #001
- [Study guide](https://grcengineer.com/study-guide) · [Persona quiz](https://grcengineer.com/persona/) · [About](https://grcengineer.com/about/)
- [The GRC Engineering Manifesto](https://grc.engineering/) (co-authored by Ayoub Fandi)

## Recent releases
- [The PR Approval Is Decaying. Your Change Management Control Hasn't Noticed.](https://grcengineer.com/p/the-pr-approval-is-decaying-your-change-management-control-hasn-t-noticed): Agent velocity is hollowing out the one artifact every change-management control leans on: the screenshot still looks fine while the approva
- [The Definitive GRC Engineering Guide to Infrastructure as Code ](https://grcengineer.com/p/the-definitive-grc-engineering-guide-to-infrastructure-as-code): Your terraform repo is the best auditor you never hired. What it can prove, where it lies, and how to read it without losing the platform te
- [5 Metrics That Prove a Control Works. "It Exists" Didn't Make the List.](https://grcengineer.com/p/5-metrics-that-prove-a-control-works-it-exists-didn-t-make-the-list): Existence checks are the weakest claim you can make about a control. Five GRC Engineering effectiveness checks: what each replaces, how to m
- [The Compliance Leverage Ladder: Your GRC Roadmap Is Pulling the Weakest Levers](https://grcengineer.com/p/the-compliance-leverage-ladder-your-grc-roadmap-is-pulling-the-weakest-levers): Most GRC energy goes into the weakest interventions there are. That's why a control can fail for 11 months before anyone notices.
- [Everyone Says Get Technical. Nobody Says At What.](https://grcengineer.com/p/everyone-says-get-technical-nobody-says-at-what): Being technical in GRC is local. Here is how to find your at-what, starting from the workflows you already own.
- [Threatify Your GRC Workflows: Keep the Steps, Swap the Questions](https://grcengineer.com/p/threatify-your-grc-workflows-keep-the-steps-swap-the-questions): AppSec escaped the "think like a hacker" trap with an operational method, tested across 400+ products. Here is the GRC Engineering port, one
- [GRC Finally Has Too Much Context. Most Teams Will Waste It...](https://grcengineer.com/p/grc-finally-has-too-much-context-most-teams-will-waste-it): For the first time, GRC ingests more context than the work it governs produces. You get  raw material, and the teams that notice first will 
- [Your GRC Program Has No Garbage Collector. So It Leaks.](https://grcengineer.com/p/your-grc-program-has-no-garbage-collector-so-it-leaks): A control that passes perfectly, while the risk it was built for quietly died. Your dashboard can't tell it apart from one that still matter
- [A Lot Of GRC Work Is Performative. So Was Security, Once Upon a Time.](https://grcengineer.com/p/a-lot-of-grc-work-is-performative-so-was-security-once-upon-a-time): GRC looks performative because it owns activity, not outcomes. GRC Engineering is how you flip that by owning decision-support at .
- [Not Every Control Belongs in the ICU: A GRC Engineering Guide to Control Triage ](https://grcengineer.com/p/not-every-control-belongs-in-the-icu-a-grc-engineering-guide-to-control-triage): A GRC engineering guide to triaging your controls: where to spend real hardening effort, which ones to just keep honest, and which to stop u
- [You Spent a Year Learning to Use AI for GRC. The Real Skill Is Assessing It.](https://grcengineer.com/p/you-spent-a-year-learning-to-use-ai-for-grc-the-real-skill-is-assessing-it): The SOC 2 narratives, questionnaire answers and control docs crossing your desk are now written by AI, and built to pass, not to be true. Le
- [I just started at Lovable. 5 things I've been thinking about as I'm onboarding.](https://grcengineer.com/p/i-just-started-at-lovable-5-things-i-ve-been-thinking-about-as-i-m-onboarding): You're shipping from day one. The question is whether you understand what you're building into. Five things I focus on in parallel with the 
- [Meet The GRC Companion: Your GRC Engineering AI Learning Buddy](https://grcengineer.com/p/meet-the-grc-companion-your-grc-engineering-ai-learning-buddy): A free, open, learning-only AI companion that teaches GRC engineering through your real work, inside Claude Code, Cursor, Claude Projects, o
- [GRC as Git: A Mental Model for your Whole Programme](https://grcengineer.com/p/grc-as-git-a-mental-model-for-your-whole-programme): Borrow the discipline behind modern software, and apply it to policy, controls, risk, and TPRM in whatever tools your team already uses. Wit
- [Your First GRC Lead Left. Their Instincts Are Still Running Your Program.](https://grcengineer.com/p/your-first-grc-lead-left-their-instincts-are-still-running-your-program): Four layers of inheritance are running your GRC programme. Here is an audit framework to find out what is intentionally designed and what is
- [What If Compliance Was Just a Query on Data You Already Collect?](https://grcengineer.com/p/what-if-compliance-was-just-a-query-on-data-you-already-collect): Observability exists because understanding the true state of a system is hard. Control for the same reason. GRC Engineering can help you get
- [GRC Teams Are Getting More Capable Than Ever But The Shape Looks Different.](https://grcengineer.com/p/grc-teams-are-getting-more-capable-than-ever-but-the-shape-looks-different): Why the future GRC team looks more like a basketball team than a football team, what that means for ICs and managers, and how to position yo
- [Your GRC Program Serves the Audit. The Best GRC Engineering Programs Don't.](https://grcengineer.com/p/your-grc-program-serves-the-audit-the-best-grc-engineering-programs-don-t): How the discipline collapsed into evidence collection, what enterprise GRC teams I know actually focus on, and why the audit should be a tra
- [Build vs. Buy: We Did Both. Here's What We Learned (RSAC 2026 Talk Summary)](https://grcengineer.com/p/build-vs-buy-we-did-both-here-s-what-we-learned-rsac-2026-talk-summary): We cycled through four GRC tools in four years before we built our own. The exercises that made us better builders are the same ones that ma
- [Your Certification Covers 100%. Your Auditor Checked 0.07%.](https://grcengineer.com/p/your-certification-covers-100-your-auditor-checked-0-07): The math behind compliance assurance does not work the way you think it does. Why moving at agentic speed means rebuilding the primitives of