CPI Card Group Inc.

Jonathan Flink, Director of IT Governance, Risk and Compliance (“GRC”)

Building Trust as a Foundation for Effective GRC Leadership

Jonathan Flink

Governance Trust Advocate

Building Trust through Strong GRC Relationships

Throughout my career in audit and risk management, I've found that trust is often the difference between basic compliance and effective risk management. When business leaders view GRC professionals as trusted advisors, they are more willing to openly discuss risks, control challenges, process breakdowns and emerging concerns before they escalate.

That transparency strengthens audits, risk assessments and remediation efforts by shifting conversations from defending past decisions to collaboratively solving problems. As a result, stakeholders become more engaged, recommendations are more readily adopted and remediation efforts gain momentum.

Strong control environments are built on a culture where employees feel safe raising potential concerns, reporting mistakes and disclosing control weaknesses without fear of blame. In these environments, risks are identified earlier, root causes are better understood and remediation efforts are more effective because the focus is on improvement rather than fault.

In my experience, credibility and relationship-building are essential to influencing positive change. While authority can drive compliance, trust creates partnership, leading to stronger control adoption, more effective risk mitigation and a healthier risk culture across the organization.

Turning Technical Expertise into Meaningful Influence

Technical expertise establishes credibility, but interpersonal skills turn credibility into influence. Throughout my career, I've found that empathy, active listening, collaboration and mutual respect are just as important as understanding controls, regulations or risk frameworks. Business leaders are more likely to engage openly when they feel heard and understood, and when the focus is on solving problems rather than assigning blame.

The most effective GRC professionals approach engagements as partnerships, taking the time to understand operational realities, align stakeholders around shared objectives and focus on practical remediation. Being approachable and maintaining perspective can also make difficult conversations about potential risk, control failures, fraud concerns or compliance gaps more productive and less adversarial.

Trust is strengthened through consistency, integrity and discretion. Equally important is the ability to challenge assumptions and address risks directly while encouraging dialogue rather than defensiveness. In my experience, the most successful practitioners balance technical expertise with genuine human connection, enabling them to influence decisions, navigate complex situations and build lasting partnerships that extend well beyond any single audit or assessment.

Fostering Collaboration beyond Compliance

As regulatory requirements, cybersecurity threats, emerging technologies and third-party dependencies continue to evolve, organizations can no longer view GRC as a standalone compliance function. Effective GRC leaders position their teams as strategic partners who help the business achieve its objectives in a secure, compliant and sustainable manner.

This starts by engaging stakeholders early and integrating risk, compliance and governance considerations into business planning, technology initiatives and operational change. By focusing on business outcomes rather than regulatory requirements alone, GRC becomes an enabler that helps identify challenges before they become obstacles and promotes shared ownership of risk.

Successful collaboration is built on transparency, mutual respect and an understanding of operational realities. The most effective solutions emerge through partnership among compliance, technology, operations, legal and business leaders. When stakeholders believe GRC is invested in their success, compliance becomes a shared responsibility rather than a departmental obligation.

Ultimately, modern GRC leaders serve as connectors, bringing together diverse perspectives, translating complex requirements into practical actions and aligning stakeholders around common objectives. By doing so, they help organizations strengthen resilience, accountability and long-term business performance.

Earning Credibility to Drive Organizational Change

One of the most valuable lessons I've learned while leading technology governance and compliance initiatives is that credibility must be earned before influence can be exercised. No matter how strong a recommendation may be, people are far more likely to embrace change when they trust the individual delivering the message. Credibility is built through consistency, integrity, business understanding and a genuine commitment to helping others succeed.

Early in my career, I realized that addressing risk is most effective when conversations focus on business outcomes rather than compliance requirements alone. By helping leaders achieve their goals, manage uncertainty and reduce operational friction, GRC becomes a business enabler rather than a control function, often turning resistance into partnership.

I've also learned that credibility is strengthened when GRC leaders model the same standards they expect of others. Admitting mistakes, accepting accountability and being transparent when challenges arise reinforces trust and demonstrates authenticity.

Equally important is recognizing what teams do well, not just where they fall short. Acknowledging strong controls, effective processes and proactive risk management reinforces positive behaviors and strengthens relationships.

Ultimately, credibility is earned through actions, not authority. When GRC professionals are viewed as trusted partners invested in business success, organizational change becomes a collaborative effort rather than a compliance exercise.

Advice for Emerging GRC, Audit and Risk Professionals

My advice to emerging GRC, audit and risk professionals is that credibility is earned through both competence and character. Technical expertise is essential, but becoming a trusted advisor also requires integrity, strong relationships and consistently delivering on your commitments.

Take time to understand the business beyond the controls you evaluate. Learn how the organization operates, serves customers and measures success. When you understand the business context behind risks and compliance requirements, your recommendations become more practical, relevant and impactful.

Equally important are strong interpersonal skills. Listen more than you speak, approach conversations with curiosity, and focus on building partnerships rather than policing activities. Identifying a problem is important, but helping the business navigate toward a solution is what creates lasting value and trust.

Finally, protect your reputation through integrity, transparency, confidentiality, and follow-through. People may forget the details of an audit or risk assessment, but they will remember how they were treated throughout the process. In my experience, trusted advisors are defined not only by what they know but by how consistently they demonstrate professionalism, credibility, and a genuine commitment to helping others succeed.