The GRC Question Index: what practitioners ask, Q4 2026
The 159 questions GRC practitioners and buyers ask most, ranked from 4,935 real questions on calls, in support and in search, with the source mix, the role, the buying stage and the page that answers each. Refreshed quarterly, free to reuse.
- Policy management software is the most asked GRC question cluster (7.55% of the weighted corpus), ahead of third-party risk management (6.26%) and risk management software (2.47%).
- Evaluation questions are 45.8% of the corpus; integrations is the most asked evaluation cluster, with 156 records.
- 64.5% of the questions were asked on calls and 12.5% in search, so keyword tools see about one question in eight.
- Regulatory change management, external-user licensing and AI-assistant connectors rose on calls between spring and autumn 2026; policy management and SOC 2 basics fell.
- 159 clusters, 4,935 questions, refreshed quarterly, CC BY 4.0, CSV download.
Answer first. The question GRC practitioners ask most is about policy management software, not risk: it is the top cluster in a corpus of 4,935 distinct questions gathered from sales and customer calls, support conversations, search queries, AI-answer prompts, practitioner communities and competitor FAQ pages between 14 Apr and 14 Oct 2026. Third-party risk management is second, risk management software third, and the most asked evaluation question is which systems a platform integrates with. The index ranks all 159 question clusters by a published weight, shows where each question comes from, and names the page that answers it. The data is free to reuse under CC BY 4.0.
Which GRC questions are asked most?
Policy management software, third-party risk management and risk management software are the three most asked clusters, and the top ten carry 30.3% of the weighted corpus. The ranking below uses weight, which multiplies how many people asked a question by how commercial the question is and how direct the channel is (the formula is in the methodology); by raw record count the order changes, and the platform questions (integrations, automations, dashboards, permissions) move to the top because they are asked on almost every call.
The two clusters at the top are also the two the regulators have written most about. ISO 37301:2021, the compliance management system standard, requires a documented compliance policy in clause 5.2, which is the obligation behind most policy management questions. For third-party risk, the US banking agencies' Interagency Guidance on Third-Party Relationships: Risk Management (Board, FDIC and OCC, June 2023) sets out the five-stage lifecycle that the software questions in cluster two are trying to buy.
| Rank | Cluster | Representative question | Share of weighted corpus | Records | Source mix | Answered on smartsuite.com | Trend on calls |
|---|---|---|---|---|---|---|---|
| 1 | Policy management software | What does policy management software do, and which one fits a small compliance team? | 7.55% | 115 | 49.6% calls, 44.3% search, 6.1% other | /blog/policy-management-software | Falling |
| 2 | Third-party risk management software, platforms and programs | What should third-party risk management software do, and how do we move our vendor assessments into it? | 6.26% | 142 | 62% calls, 2.8% support, 31% search, 4.2% other | /blog/third-party-risk-management-software | Steady |
| 3 | Risk management software and platforms | What is risk management software, and how much does it cost? | 2.47% | 30 | 6.7% calls, 70% search, 23.3% other | /blog/risk-management-software (partial) | Too few calls |
| 4 | GRC software, tools and platforms | What is a GRC tool, and which GRC platforms are the best? | 2.34% | 62 | 35.5% calls, 33.9% search, 30.6% other | /blog/grc-tools (partial) | Falling |
| 5 | Audit management and internal audit software | What does audit management software do, and which one is best for internal audit? | 2.34% | 30 | 20% calls, 56.7% search, 23.3% other | /blog/audit-management-software | Too few calls |
| 6 | Compliance management software and tools | What is compliance management software, and what does it cost? | 2.32% | 26 | 19.2% calls, 57.7% search, 23.1% other | /blog/compliance-management-tools | Too few calls |
| 7 | Integrations | Which systems does the platform integrate with, and who builds the integration? | 2.12% | 156 | 87.8% calls, 9% support, 3.2% search | /integrations (partial) | Steady |
| 8 | AI governance and AI risk | What is AI governance, and what does AI governance software do? | 1.75% | 63 | 57.1% calls, 25.4% search, 17.5% other | /what-is/what-is-ai-governance | Steady |
| 9 | ITSM software, tools and platforms | What is the best ITSM software for a mid-size or large enterprise? | 1.65% | 32 | 25% calls, 59.4% search, 15.6% other | /blog/itsm-software | Too few calls |
| 10 | Building automations | How do we build an automation with triggers, conditions, loops and branching? | 1.47% | 153 | 46.4% calls, 52.9% support | help: managing-automations (partial) | Steady |
| 11 | Dashboards, charts and reports | How do we build dashboards and reports with drill-down and role-based views? | 1.46% | 141 | 63.8% calls, 32.6% support, 3.6% other | help: getting-started-with-dashboards (partial) | Steady |
| 12 | Permissions | How do we control who can see, edit or export which records, fields and views? | 1.46% | 135 | 74.1% calls, 25.9% support | help: smartsuite-permissions (partial) | Steady |
| 13 | Vanta | How much does Vanta cost, and who are its competitors? | 1.44% | 20 | 15% calls, 70% search, 15% other | /blog/vanta-pricing | Too few calls |
| 14 | Incident management software and tools | What is incident management software, and why is it better than a manual process? | 1.4% | 27 | 66.7% calls, 25.9% search, 7.4% other | /blog/incident-management-software | Rising |
| 15 | GDPR, data privacy regulations and privacy management software | Which data privacy regulations apply to us, and how do we select privacy management software? | 1.32% | 26 | 53.8% calls, 34.6% search, 11.6% other | /what-is/what-is-data-privacy-management (partial) | Falling |
| 16 | What is GRC, what it stands for, why it matters, components | What is GRC, and what does it stand for? | 1.29% | 54 | 3.7% calls, 25.9% search, 70.4% other | /what-is/what-is-grc | Too few calls |
| 17 | Control testing, evidence requests, automated evidence collection and continuous monitoring | How do we test controls and collect evidence automatically, and what is continuous monitoring? | 1.18% | 90 | 94.4% calls, 1.1% support, 1.1% search, 3.4% other | /grc-foundation/evidence-management-in-grc-building-an-audit-ready-evidence-trail | Steady |
| 18 | Ticketing, SLAs, service desk, customer portal, on-call and requester views | How do ticketing, SLAs and a requester portal work in a service desk? | 1.15% | 82 | 84.1% calls, 8.5% support, 3.7% search, 3.7% other | /products/service-desk-request-portal (partial) | Steady |
| 19 | What SmartSuite costs | What does each plan cost, and can we get a quote for our size? | 1.13% | 54 | 68.5% calls, 31.5% support | /pricing | Falling |
| 20 | Alternatives to other GRC vendors (ZenGRC, Riskonnect, Diligent, Onspring, SAI360, StandardFusion, Corporater, Origami) | What are the alternatives to the GRC vendor we use today? | 1.12% | 27 | 29.6% calls, 70.4% search | /blog/riskonnect-alternatives | Too few calls |
| 21 | ServiceNow pricing, licensing and company questions | How much does ServiceNow cost, and how is it licensed? | 1.09% | 43 | 46.5% calls, 44.2% search, 9.3% other | /blog/servicenow-pricing | Steady |
| 22 | Email in and out, comments, @mentions, Communication Center, Teams and Slack messaging | How do we send and receive email from records, and work with comments, mentions, Teams and Slack? | 1.07% | 92 | 75% calls, 20.7% support, 3.3% search, 1% other | help: communication-center (partial) | Steady |
| 23 | Importing and migrating data from spreadsheets, Smartsheet, Airtable or an incumbent GRC tool | How do we import or migrate data from spreadsheets, Smartsheet, Airtable or our current GRC tool? | 1.07% | 95 | 70.5% calls, 25.3% support, 2.1% search, 2.1% other | /features/data-import (partial) | Steady |
| 24 | Vendor due diligence, security questionnaires (SIG), trust centers and questionnaire automation | How do we run vendor due diligence and security questionnaires such as the SIG, and can they be automated? | 1.06% | 60 | 86.7% calls, 5% support, 5% search, 3.3% other | /what-is/what-is-vendor-due-diligence (partial) | Steady |
| 25 | Views, filters, record layouts, tabs, display logic and field types | How do we configure views, filters, record layouts, tabs and field types? | 1.05% | 110 | 43.6% calls, 55.5% support | help: view-overview (partial) | Steady |
How to read the table: share of weighted corpus is the cluster's weight as a percentage of the total; records is the number of source records (one per call question, support message, query row or FAQ entry); source mix is where those records came from; the last two columns say which smartsuite.com page answers the cluster today (partial means the page covers part of it) and whether the cluster's share of sampled call questions rose, fell or held between the April to June and June to October windows.
What do practitioners ask at each buying stage?
Evaluation questions (does it do X, what does it cost, who builds the integration) are 45.8% of the in-scope records, more than awareness (15.7%), onboarding (15.7%) and use (19.5%) combined with purchase and renewal. The practical consequence is that most of what a GRC buyer wants to know is specific to a platform's behavior, and most of it is asked on a call, not typed into a search engine. The awareness questions (what is GRC, what is SOC 2, which risk management software is best) are the ones that reach the open web, which is why they dominate the search channel and the rival content libraries.
The most asked evaluation cluster is integrations (#7, 156 records, 87.8% from calls): which systems the platform connects to and who builds the connection. Permissions (#12) and dashboards and reporting (#11) follow. In the use stage, automations (#10) lead, and in onboarding, import and migration from spreadsheets or an incumbent GRC tool (#23).
Which questions does each GRC role ask?
Roles are observed only on calls, where 2,493 of the questions carry a mapped role; for search and support records the role is the cluster's target role, so the table reads as who the question is written for rather than a census of who asked. Compliance managers lead on policy management and control testing, third-party risk managers on vendor assessment and the questionnaire workflow, internal auditors on audit management software and how a platform is priced, and IT service managers almost entirely on tool selection and alternatives.
| Role | Most asked clusters, highest weight first |
|---|---|
| Compliance manager | Policy management software (#1); Compliance management software and tools (#6); What is GRC, what it stands for, why it matters, components (#16); Control testing, evidence requests, automated evidence collection and continuous monitoring (#17); Alternatives to other GRC vendors (ZenGRC, Riskonnect, Diligent, Onspring, SAI360, StandardFusion, Corporater, Origami) (#20) |
| Risk manager | Risk management software and platforms (#3); Risk assessment (#38); Risk scoring, heatmaps, risk matrix, likelihood and impact, quantification (#63); Which features and integrations each plan includes (Team, Professional, Enterprise) (#88); Contract management, obligations and playbooks on the platform (#93) |
| Third-party risk manager | Third-party risk management software, platforms and programs (#2); GRC software, tools and platforms (#4); Email in and out, comments, @mentions, Communication Center, Teams and Slack messaging (#22); Vendor due diligence, security questionnaires (SIG), trust centers and questionnaire automation (#24); SOC 2 (#27) |
| Internal auditor | Audit management and internal audit software (#5); How SmartSuite is priced (#32); Internal audit (#72); Optro (formerly AuditBoard) (#83); Ready-made templates and solutions for a use case (#87) |
| IT service manager | ITSM software, tools and platforms (#9); ServiceNow alternatives and competitors (#26); Alternatives to other ITSM vendors (ManageEngine, SolarWinds, Ivanti, TOPdesk, Zendesk) (#28); HaloITSM (#34); Freshservice (#50) |
| AI governance lead | AI governance and AI risk (#8) |
Which questions are rising or falling?
Among the 82 clusters with at least 12 call records, 22 rose and 17 fell between the April to June and June to October windows; the rest held steady. Regulatory change management (#40), guest and external-user licensing (#49), MCP and AI-assistant connectors (#56) and AI governance intake (#97) rose most; policy management software (#1), pricing of plans (#19), SOC 2 basics (#27) and NIST frameworks (#36) fell. Both windows are samples of call transcripts, so a move of a few tenths of a percent is a signal to watch, not a finding; the next edition will say whether it held.
| Cluster | Share of call questions, 14 Apr to 15 Jun | Share, 16 Jun to 14 Oct |
|---|---|---|
| Rising | ||
| Incident management software and tools (#14) | 0.31% | 0.65% |
| Contract terms (#37) | 0.94% | 1.44% |
| Risk assessment (#38) | 1.09% | 1.82% |
| Regulatory change management and horizon scanning (#40) | 0.7% | 1.58% |
| Free plan, trial terms, extended trials, sandbox and test environments (#41) | 0.86% | 1.49% |
| Cyber and IT risk management (#45) | 0.78% | 1.49% |
| Seat minimums and pricing for a solo user or a very small team (#48) | 0.31% | 0.7% |
| Guests, external users, forms-only and view-only users (#49) | 0.62% | 1.49% |
| MCP server and connectors for Claude, ChatGPT and other assistants (#56) | 0.39% | 1.49% |
| Packaging and deploying solutions, test vs production environments, promotion (#58) | 0.86% | 1.44% |
| Customer references, case studies, industries served and ROI evidence (#64) | 0.55% | 0.98% |
| Control libraries, control-to-framework mapping, custom frameworks, multiple frameworks in one place (#65) | 0.62% | 1.21% |
| Falling | ||
| Policy management software (#1) | 2.58% | 1.12% |
| GRC software, tools and platforms (#4) | 0.86% | 0.51% |
| GDPR, data privacy regulations and privacy management software (#15) | 0.62% | 0.28% |
| What SmartSuite costs (#19) | 1.64% | 0.75% |
| SOC 2 (#27) | 0.86% | 0.51% |
| Business continuity management and plans (#30) | 0.7% | 0.19% |
| Enterprise risk management (#31) | 0.7% | 0.42% |
| NIST CSF and SP 800 series (#36) | 0.78% | 0.33% |
| Approvals, escalations, SLAs on assignments and automated reminders (#43) | 2.58% | 1.68% |
| What SmartSuite AI can do (#47) | 1.95% | 1.07% |
Where did the questions come from?
64.5% of the in-scope records are questions asked on sales and customer calls, 15.4% come from support conversations and 12.5% from search queries; competitor FAQ pages, AI-answer prompts and communities make up the rest. The mix is the reason this index differs from keyword research: a search tool sees the 601 search records and nothing else.
| Channel | Records | Share | Window |
|---|---|---|---|
| Sales and customer calls | 3,101 | 64.5% | 14 Apr to 14 Oct 2026 |
| Support conversations | 743 | 15.4% | 21 Jun to 14 Oct 2026 |
| Search queries (Search Console and keyword research) | 601 | 12.5% | 5 Jun to 2 Sep 2026 (Search Console), Oct 2026 (keyword research) |
| Competitor FAQ pages | 221 | 4.6% | Oct 2026 |
| AI-answer prompts and People Also Ask | 122 | 2.5% | Oct 2026 |
| Practitioner communities | 22 | 0.5% | Oct 2026 |
How well does the web answer these questions?
Not well enough, including on this site. For each cluster the build looked for the smartsuite.com page that answers it and scored that page on three authority signals: a primary-source citation (a regulator, a standards body or a named study), a named author, and first-party data. 68 clusters are covered, 56 are covered in part and 35 have no page. Of the pages that do answer a cluster, only 36 cite a primary source, which matches what the AI-answer prompts showed: for topics our pages already cover, the answer engines cite third-party sites instead. The index is published partly to fix that, one cluster at a time, and the "Answered on smartsuite.com" column is the honest state on 14 Oct 2026.
How was the index built?
How the questions were gathered
Seven lanes, 14 Apr to 14 Oct 2026: sales and customer call transcripts (a stratified sample of 240 of 1,393 external transcripts, 14 Apr to 14 Oct), support conversations (2,100 of 5,011 sampled, first customer message only, 21 Jun to 14 Oct), Search Console queries for smartsuite.com (5 Jun to 2 Sep 2026, 250 rows per pull), keyword-research question sets (16 seed terms), the 80 AI-answer prompts of the weekly visibility check plus People Also Ask rows, practitioner community threads (titles only), and the FAQ pages of the leading GRC vendors.
How the records were de-identified
Every record was reduced to the question itself at collection: no names, email addresses, phone numbers or customer company names; call questions are paraphrases written by the reviewer, not transcript text; askers are kept only as an organization type and an industry. The index publishes counts, shares and one representative phrasing per cluster.
How the questions were clustered
Questions were normalized (lower case, whitespace, trailing punctuation) and exact duplicates merged across lanes. Clusters are a hand-built topic ontology of 139 labeled topics with regex patterns, applied specific-first; questions no pattern matched were assigned to the nearest topic centroid by TF-IDF cosine similarity (threshold 0.22); the rest fell into 20 small residual groups. Near-duplicates inside a cluster were merged at a character n-gram cosine of 0.93 or more.
How the questions were counted and ranked
Records are source records (one per call question, support message, query row or FAQ entry). Share of the corpus is the cluster's records divided by the 4,810 in-scope records. Weight = frequency units (1 per call, support, FAQ, community or prompt record; square root of monthly impressions or searches for search rows) x intent weight (informational 1, commercial 2, transactional 3, support 1) x source weight (calls 3, support 2, search 2, AI prompts 2, keyword research 1, communities 1, competitor FAQ 1). Clusters are ranked by weight.
In scope: GRC and the adjacent disciplines (risk, compliance, audit, third-party risk, privacy, resilience, AI governance, IT service management, security) and the questions buyers ask about a GRC platform (pricing, integrations, permissions, reporting, migration). 859 out-of-scope questions (project management, generic work management) were excluded.
How the trend is read
Where a cluster has at least 12 call records, the trend compares its share of call questions in the 14 Apr to 15 Jun window (1,280 records) with the 16 Jun to 14 Oct window (2,146 records); rising means the later share is at least 1.5 times the earlier, falling means at most two thirds.
What the index cannot tell you
Call and support records are samples, not a census. Search Console rows reflect queries smartsuite.com already ranks for, not total demand. Clustering is lexical, so a question phrased without any topic term lands in a residual group. Personas are observed only on calls; for search and support records the persona is the cluster's target persona.
When it is refreshed
Quarterly. The next edition (Q1 2027) rebuilds the corpus for the following quarter and republishes at the same URL with a change note; cluster ids are stable across editions. The as-of date of this edition is 14 Oct 2026.
How do I use or cite the index?
Download the full table of 159 clusters as a CSV: grc-question-index-2026-q4.csv (one row per cluster: rank, cluster, representative question, records, share, weight, source mix by channel, role, stage, intent, coverage, answering page and trend). The data is licensed under Creative Commons Attribution 4.0: reuse it, chart it, quote it, with the attribution "SmartSuite, The GRC Question Index (Q4 2026)" and a link to this page. If you are writing a buyer's guide, a course or a research note and want the next edition early, or a cut by role or stage that is not here, write to the author.
Author: Jon Darbyshire, founder and Chief Executive Officer of SmartSuite. Reviewer: Preston Gillum, GRC Product Manager. First published 17 Oct 2026; next edition Q1 2027.
Sources
- SmartSuite, GRC question corpus, build of 14 Oct 2026: 5,734 source records, 4,935 distinct questions, 159 in-scope clusters. Aggregate data: grc-question-index-2026-q4.csv.
- ISO 37301:2021, Compliance management systems: requirements with guidance for use, clause 5.2 (Compliance policy). https://www.iso.org/standard/75080.html
- Board of Governors of the Federal Reserve System, FDIC and OCC, Interagency Guidance on Third-Party Relationships: Risk Management, Federal Register, 9 June 2023. federalregister.gov
- OCEG, GRC Capability Model (Red Book), the definition of GRC used to set the corpus scope. https://www.oceg.org/grc-capability-model-red-book/
- Creative Commons, Attribution 4.0 International (CC BY 4.0). https://creativecommons.org/licenses/by/4.0/
Related: GRC Foundation · What is GRC? · Policy management software · Third-party risk management software · GRC tools · Integrations
Frequently asked questions
From 5,734 question records gathered between 14 Apr and 14 Oct 2026 across seven channels: sales and customer calls, support conversations, Search Console queries, keyword research, AI-answer prompts, practitioner communities and competitor FAQ pages. Exact duplicates were merged, questions were assigned to 159 topic clusters with a hand-built ontology plus TF-IDF matching, and clusters were ranked by a published weight. The methodology section on the page gives every step and every weight.
Yes. 64.5% of the in-scope records come from sales and customer calls and 15.4% from support conversations. The records were reduced to the question itself at collection: no names, email addresses, phone numbers or company names were kept, and call questions are paraphrases written by a reviewer rather than transcript text. The index publishes counts, shares and one representative phrasing per cluster.
Yes, under the Creative Commons Attribution 4.0 license (CC BY 4.0). Cite it as SmartSuite, The GRC Question Index (Q4 2026) and link to this page. The full table of 159 clusters is available as a CSV download on the page.
Quarterly. Each edition rebuilds the corpus for the quarter and republishes at this URL with a change note, so links do not break. Cluster ids are stable across editions, which makes quarter-on-quarter comparison possible.
