The Risk Wheelhouse

S4E5: Wheelhouse's 2025 IRM Navigator™ Vendor Compass for Risk Management Consulting

• Wheelhouse Advisors LLC • Season 4 • Episode 5

Share episode

The fog of risk management is lifting. What was once a checkbox exercise has transformed into a strategic imperative that drives enterprise resilience and competitive advantage.

Dive deep with us as we explore the groundbreaking 2025 IRM Navigator™ Vendor Compass for Risk Management Consulting Report from Wheelhouse Advisors. This essential analysis maps the dramatic evolution underway in how organizations operationalize Integrated Risk Management (IRM) and the crucial role expert consulting now plays in this landscape.

We unpack the fundamental shift from traditional Governance, Risk, and Compliance (GRC) to a holistic IRM approach organized around four key enterprise objectives: Performance, Resilience, Assurance, and Compliance (PRAC). The numbers are staggering – the IRM market is projected to grow from $61.6 billion to $147 billion by 2032, with Risk Management Consulting emerging as the fastest-growing segment at a 16.9% CAGR.

Artificial Intelligence has become a game-changer, but comes with critical caveats. While leading firms develop enterprise-grade multi-agent platforms with auditable trust layers, the market remains "long on ambition, short on verifiable delivery." We provide practical guidance on how to evaluate AI claims beyond marketing hype, demanding production use cases, documented trust controls, and clear outcome metrics.

The Vendor Compass framework helps navigate the provider landscape, categorizing firms into Integrators (like the Big Four), Accelerators (specialized domain experts), and Pacesetters (agile niche players). Whether you lead a global enterprise or a growing mid-market company, you'll gain concrete, actionable advice for selecting the right partner, structuring effective contracts, and implementing a practical 12-week proof of value approach.

Risk management has transformed from protecting against pitfalls to actively propelling performance. How is your organization integrating risk to build lasting resilience in our increasingly unpredictable world? Listen now to chart your course through the shifting risk landscape.



Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.

Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.

Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.


Ori Wellington:

Have you ever felt like navigating risk in your organization is like trying to sail through a constantly shifting fog?

Sam Jones:

Yeah, it's definitely complex.

Ori Wellington:

It's gone far beyond just checking boxes for compliance, hasn't it? It's now about embedding resilience and well, strategic advantage directly into the DNA of your business.

Sam Jones:

Exactly, it's a fundamental shift.

Ori Wellington:

Today we're embarking on a deep dive into a really insightful piece the 2025 IRM Navigator Vendor Compass for Risk Management Consulting Report from Wheelhouse Advisors.

Sam Jones:

A very useful report.

Ori Wellington:

This report isn't just a survey. It's more like a detailed map showing us how risk management is dramatically evolving and where expert consulting fits into that rapidly changing landscape.

Sam Jones:

That's a good way to put it. It provides clarity.

Ori Wellington:

Our mission today is to help you understand why risk management consulting RMC, is no longer just a support function. It's really become a central strategic force in how enterprises operationalize what's called integrated risk management or IRM. We'll unpack why this shift matters now more than ever, highlight the key players driving this change and, crucially, provide some practical guidance for how businesses, large or small, can strategically select the right partners.

Sam Jones:

Yeah, that practical guidance is key.

Ori Wellington:

Over the next few minutes we'll explore the evolution from traditional GRC that's, governance, risk and compliance to this more holistic IRM approach.

Sam Jones:

A necessary evolution.

Ori Wellington:

We'll dive into the surprising growth of the RMC segment, how cutting-edge AI is shaping this field and, perhaps most importantly, get into some concrete advice for choosing a consulting provider that truly delivers.

Sam Jones:

Sounds good, let's dig in.

Ori Wellington:

Okay, that idea of embedding risk really brings us to the core shift this report highlights. For years, many organizations approached risk through the familiar lens of GRC, but this report points to a fundamental, well almost a reinvention of how risk is perceived and managed.

Sam Jones:

Yeah. What's truly transformative here, I think, is that risk management consulting, RMC, has moved beyond merely implementing software solutions. It's now the central orchestrator of integrated risk management.

Ori Wellington:

Orchestrator. I like that.

Sam Jones:

Think of it this way Technology provides the instruments right, but RMC firms write the score, conduct the orchestra and make sure everyone's playing in harmony to achieve real enterprise outcomes not just outputs, but outcomes.

Ori Wellington:

OK, so how does the report define that harmony, that IRM?

Sam Jones:

Well, it lays out IRM around four key enterprise objectives, what it calls PRAC Performance, resilience, assurance and Compliance.

Ori Wellington:

PRAC Exactly.

Sam Jones:

And these aren't just buzzwords. They're activated through four integration points goals, processes, assets and policies.

Ori Wellington:

Goals processes, assets and policies. Goals processes, assets, policies.

Sam Jones:

Right. So when we talk about RMC's role, it's about making this blueprint a reality, for instance, linking enterprise risk management ERM directly to your strategic goals. Makes sense, or connecting operational risk management ORM to your core business processes. It means tying technology risk management TRM to your critical assets and even your AI oversight.

Ori Wellington:

AI oversight, that's new.

Sam Jones:

And then modernizing GRC to serve these broader enterprise objectives, not just hitting regulatory marks.

Ori Wellington:

So, if we look back a bit, how did we get here? The report traces GRC back to the early 2000s. Powerful for compliance, sure, but often resulted in a lot of documentation over actual proactive management.

Sam Jones:

That's spot on. It could become documentation heavy. Irm really emerged as a structural response to that, emphasizing enterprise-wide coordination, even predictive analytics and really linking risk directly to performance.

Ori Wellington:

And you're saying this history still matters now, in 2025.

Sam Jones:

Oh, absolutely. This historical context is vital because, honestly, a philosophical split is still very much alive in the market today.

Ori Wellington:

How so.

Sam Jones:

Some firms now truly lead with an IRM narrative. They see GRC tools as just one enabler within a much larger integrated strategy.

Ori Wellington:

Okay.

Sam Jones:

Others, though, still present IRM as simply GRC modernization.

Ori Wellington:

Ah, so it's more of an upgrade than a fundamental rethink for them.

Sam Jones:

Kind of, and for you the buyer, the first approach the IRM led one tends to show stronger cross segment integration and better alignment with your actual business outcomes. The latter, the GRC modernization view, while often excellent in control rigor, still risks kind of recreating the very silos IRM is designed to break down.

Ori Wellington:

Yeah, you see, yeah, I get that. Now, what really jumped out at me from this report were the numbers on market growth. The entire IRM market is estimated to soar from about $61.6 billion in 2025 to a huge $147 billion by 2032. Massive numbers, but within that, rmc, the consulting piece is the fastest growing segment, projected to rise from 9.5 billion to 28.2 billion over the same period. That's a 16.9 percent CAGR compound annual growth rate.

Sam Jones:

It's remarkable, isn't it?

Ori Wellington:

What do you think is the biggest driver behind that unexpected acceleration? It seems counterintuitive, sometimes focusing on services over tech.

Sam Jones:

Well, that explosive growth reflects a simple, undeniable truth Enterprises aren't just buying individual controls or software anymore. They're buying coordination. They're buying resilience, they're buying tangible performance improvements, and consulting capacity is where that comprehensive coordination is actually engineered. Think about it Boards now demand AI assurance. Regulatory environments are constantly shifting.

Ori Wellington:

Yeah, always volatile.

Sam Jones:

And digital interdependencies mean everything is connected. This forces buyers toward providers who can genuinely integrate strategy, process, assets and policies into one cohesive IRM program. It takes human expertise to stitch that together.

Ori Wellington:

And the report specifically calls out AI assurance as a new baseline requirement. But it also gives a warning right. It says the market is long on ambition and short on verifiable delivery for AI. What does that actually mean for someone trying to buy these RMC solutions?

Sam Jones:

That's a really critical point and yeah, the report is quite direct there. Consulting firms are evolving their delivery models significantly. We're moving beyond. You know the one-off gen AI pilot right the shiny object phase exactly.

Sam Jones:

We're moving towards enterprise-grade multi-agent platforms with auditable trust layers. Think of frameworks aligned with ISO 40 2001. That's becoming the benchmark for trustworthy AI, ensuring decisions are transparent, accountable, like having a clear audit trail for automated actions. Companies like KPMG with their Workbench, ey with their agentic platform extensions, deloitte with Zora, aigovconnectai, pwc with AI Factory they're essentially productizing parts of their delivery.

Ori Wellington:

So turning services into something more like a product.

Sam Jones:

In a way, yes, and these shifts directly map to those pure outcomes we talked about Faster analytics for performance, autonomous responses for resilience, audible provenance for assurance, continuous monitoring for compliance. It all connects.

Ori Wellington:

But the warning yeah Long on ambition.

Sam Jones:

Right. However, you, as the buyer, need to be disciplined. Wheelhouse's analysis found that, while there's a lot of impressive talk, most of these platforms still function more like engagement scaffolding. They require significant customization.

Ori Wellington:

So not quite plug and play.

Sam Jones:

Not usually. No, Think of it like this Many firms offer you a beautiful toolbox with advanced AI tools, but you still often have to build the house yourself using those tools. It's not a prefab solution dropped on your doorstep. Got it so setting?

Sam Jones:

clear verification gates, really budgeting for that integration work, using those tools it's not a prefab solution dropped on your doorstep, got it? So setting clear verification gates, really budgeting for that integration work and favoring designs that preserve your optionality, your ability to switch things out later, are absolutely key. Don't get locked in too early based on promises.

Ori Wellington:

It really sounds like risk isn't just sitting in a specific department anymore, like the risk office. It's fundamentally becoming interwoven with every part of the organization.

Sam Jones:

Precisely. Risk is now integrated into algorithms. It's embedded in your supply chains. It even impacts how you access capital through disclosures. Everywhere, basically Pretty much, and this demands orchestration across operational risk management, technology risk management and GRC. Those are exactly the interfaces where RMC firms design the governance, collect the data or telemetry and set up the escalation pathways. This integration is also leading to an emerging model, sometimes called services as software or even digital FTEs in RMC.

Ori Wellington:

Digital FTEs.

Sam Jones:

Yeah, where providers offer subscription-based access to AI agents for continuous control operations. Imagine having AI-powered team members constantly monitoring and managing certain controls. 247.

Ori Wellington:

Wow Okay, that's a big shift.

Sam Jones:

It is.

Ori Wellington:

This all sounds potentially very complex, though. So if a business understands this fundamental shift, the growth, the AI aspect, how does the Wheelhouse Advisors Report help them cut through the noise and actually choose the right partner? It mentions a vendor compass.

Sam Jones:

Yes, the vendor compass. It's a brilliant tool really. It evaluates firms along two crucial axes. First is integration level, basically how well a provider connects IRM across different domains like ERM, orm, trm, grc.

Ori Wellington:

Okay, the breadth of connection.

Sam Jones:

Exactly. And the second is service solution coverage. How much of the whole IRM lifecycle a provider can truly deliver, from strategy to operations, to technology?

Ori Wellington:

The depth Makes sense.

Sam Jones:

Right Firms are then categorized into three tiers integrator, accelerator and pacesetter based on a weighted scoring model across six criteria.

Ori Wellington:

And AI is weighted heavily.

Sam Jones:

It is Notably AI-enabled. Delivery and innovation gets a 20% weighting and for any AI claims, the report emphasizes rigorous verification. You need active client use of a functioning multi-agent platform.

Ori Wellington:

Not just a pilot.

Sam Jones:

Not just a pilot Documented governance like ISO 42001, demonstrable interoperability with existing systems and at least one outcome metric directly tied back to PREAC. They really stress Show me, don't just tell me.

Ori Wellington:

Evidence-based. Okay, so who are some of the top players you see in each of these tiers, according to the report?

Sam Jones:

Well, the integrator tier, the ones really dominating in cross-segment program design and global scale, includes the big four firms EY, kpmg, pwc and Deloitte.

Ori Wellington:

No big surprise there, maybe.

Sam Jones:

Perhaps not, but the report notes an interesting philosophical difference among them. Ey and KPMG tend to lead with an IRM-first narrative, where GRC is seen as an enabler within that broader context. Pwc and Deloitte maybe more often frame IRM as GRC modernization, although their actual delivery is increasingly spanning the full IRM lifecycle too. They're all making credible moves towards that agentic AI delivery we discussed, like KPMG's Workbench or EYAI.

Ori Wellington:

Got it. And the other tiers accelerators and pacesetters.

Sam Jones:

Right. Then you have the accelerators Firms like FTI Consulting, ds Plus Pet Pertability. They deliver really strong value. In more targeted domains maybe complex investigations or specific areas like industrial safety they accelerate progress in a particular area.

Ori Wellington:

Makes sense. Specialized power.

Sam Jones:

Precisely. And finally, the pace setters. This includes firms like Grant Thornton, JS, Held and RSM. These often offer strong niche strengths and are very credible, especially for the mid-market or for more fit-for-purpose goals where maybe you don't need the full global scale of an integrator. The report's advice is pretty clear Think about using integrators for that broad enterprise scale orchestration. Look to accelerators to fill specific capability gaps and consider pace setters for more focused programs where maybe agility or specific niche expertise is key. So tailoring the choice to the specific need.

Ori Wellington:

Absolutely for more focused programs where maybe agility or specific niche expertise is key, so tailoring the choice to the specific need.

Sam Jones:

Absolutely.

Ori Wellington:

Okay, this is incredibly helpful context. So what does this all mean for you, the listener? Whether you're leading a large enterprise grappling with these huge, complex systems, or maybe a growing midsize company trying to build resilience from the ground up, this report gives concrete guidance. What are the absolute top say, two or three pieces of advice for large enterprises looking to navigate this RMC space?

Sam Jones:

Yeah, great question For large enterprises. If I had to boil it down, the most critical takeaways are first, aligning your partner selection very closely with your overall change agenda and, second, demanding measurable outcomes, especially when it comes to AI.

Ori Wellington:

OK. Outcomes and evidence.

Sam Jones:

Exactly so. First, the report strongly emphasizes contract for outcomes, not just hours.

Ori Wellington:

That sounds simple, but probably isn't easy.

Sam Jones:

It requires discipline, but it's a strategic imperative. Tie the fees directly to measurable business outcomes things like reducing time to assurance, speeding up incident recovery, cutting down audit exceptions.

Ori Wellington:

Real business metrics.

Sam Jones:

Real business metrics. Why is that shift so vital? Because it forces the consultant to be deeply invested in your success, not just their billable hours. It requires them to deliver a written operating model that clearly maps their work to those IRM integration points we discussed Goals, processes, assets and policies. It forces clarity.

Ori Wellington:

Makes sense. What's the second key piece?

Sam Jones:

Second, regarding AI, adopt an evidence-first posture. You mentioned that long-on-ambition, short-on-verifiable delivery line. The report is blunt Demand proof that goes way beyond marketing claims Al what kind of proof? Insist on seeing at least two production use cases working live, examples relevant to your business, not just generic demos. Ask for documented trust controls, like that ISO 42001 alignment we mentioned. Get proof of interoperability with your existing risk tech stack. You need clear outcome metrics tied back to Priyak. If they can't show you tangible proof, honestly, you should be very skeptical.

Ori Wellington:

Okay, be demanding on proof for AI Got it. Anything else for large enterprises?

Sam Jones:

And third I'd say prioritize modular managed services. Look for contracts that offer flexibility, use open connectors and have clear data portability plans. You really want to avoid vendor lock-in down the road.

Ori Wellington:

Future proofing.

Sam Jones:

Exactly. This also connects to the report's recommendation for a practical 12-week proof of value. Don't try to boil the ocean. Scope two material use cases. Run a design workshop. Implement a minimal telemetry backbone. Basically Get the basic data flows working and then decide on a larger scale up based on measurable improvements. Prove the value quickly before committing huge resources.

Ori Wellington:

Start small, prove it, then scale. Very practical. That makes a lot of sense for large organizations. But what about small and mid-sized enterprises? Smes Do they just fall in the same path, or are there important nuances in how they should approach selecting an RMC partner?

Sam Jones:

That's a really important distinction. While the core principles, outcomes, evidence are definitely the same, the approach for SMEs needs to be optimized for speed, cost predictability and, frankly, minimizing the internal lift required from their potentially smaller teams.

Ori Wellington:

Okay, so efficiency and practicality are paramount.

Sam Jones:

Absolutely so. First, when it comes to rightsizing the partner, those accelerators and selected pace setters we talked about are often the natural first choices for SMEs. They're usually excellent at packaging IRM capabilities effectively for a leaner organization.

Ori Wellington:

So maybe not automatically jumping to a big four form.

Sam Jones:

Generally engaging the big four is probably reserved for SMEs in highly regulated industries or those facing really complex multi-country transformations. For many SMEs, an accelerator or pace setter might offer a better fit and value.

Ori Wellington:

Okay, what about contracting and AI?

Sam Jones:

Second, just like larger companies, contract for outcomes or pace setter might offer a better fit and value. Okay, what about contracting and AI? Second, just like larger companies, contract for outcomes, but for SMEs, fixed fee or clear milestone structures tied to those PR-equally metrics are often even more critical for budget predictability. You need that clarity up front.

Ori Wellington:

Makes sense. Predictable costs.

Sam Jones:

Third, maintain that same rigorous, evidence-first AI posture. The verification gates don't change just because you're smaller you still need working production, use cases relevant to you, documented trust controls and proof of interoperability. For SMEs, it's maybe especially important to prioritize multi-agent designs with explicit trust layers and open connectors to simplify integration with whatever systems you already have.

Ori Wellington:

Keep it manageable.

Sam Jones:

Right and finally consider modular managed services. This can be a very cost-effective option for SMEs who might lack deep internal expertise in certain areas, but again, always ensure data portability and actively avoid proprietary lock-ins. You don't want to be trapped.

Ori Wellington:

Okay, any quick start advice for SMEs.

Sam Jones:

Yeah, the report suggests a similar practical 12-week quick start, but maybe even more focus for SMEs. Pick just one or two really critical business use cases. Define the decision rights very clearly up front and implement a minimal telemetry backbone using your existing platforms plus the consultant's accelerators. Then scale up based on those measurable improvements. Keep it focused, keep it fast.

Ori Wellington:

So the key RFP prompts for SMEs should focus on Optimize for package scope and price.

Sam Jones:

Definitely look for lightweight integrations and explore robust managed services options. Insist on clear cost controls, strong ongoing support and, importantly, useful templates or tools that reduce your team's internal burden, make it easier for your team.

Ori Wellington:

Excellent, very clear distinctions there.

Sam Jones:

So if we just zoom out for a second, connect this back to the bigger picture. What's crystal clear from this deep dive, I think, is that risk is no longer just some back office control function. It's not just about compliance anymore. It has fundamentally evolved into a strategic force that profoundly shapes the very performance, the resilience and, ultimately, the future success of an enterprise. Fragmented oversight, those old compliance silos, they're simply unsustainable in today's complex, interconnected world.

Ori Wellington:

Yeah, the stakes seem much higher now. It's not just about avoiding bad things, but enabling good things too.

Sam Jones:

Precisely. It's about performance and resilience working hand in hand.

Ori Wellington:

So the real question for you, our listener, reflecting on all this, is how is your organization integrating risk? Is it just to protect itself from potential pitfalls, or are you actively using it to propel performance and build true, lasting resilience in what feels like an increasingly unpredictable world?

Ori Wellington:

That's the challenge resilience in what feels like an increasingly unpredictable world. That's the challenge. This deep dive into the 2025 IRM Navigator Vendor Compass for RMC report has laid out a powerful framework and some really practical steps. We invite you to consider what part of this integrated risk management evolution, this shift from GRC to IRM, resonates most deeply with your own organizational challenges and, importantly, your opportunities.