New GRC Intelligence capabilities automate testing, vendor assessments and AI governance while keeping human oversight and auditability central to risk management.
Optro has expanded its AI-powered Governance, Risk and Compliance (GRC) platform with autonomous agents designed to automate workflows across internal audit, compliance, third-party risk management and AI governance. Announced at the company’s annual CRX user conference, formerly known as Audit & Beyond, the launch signals a shift towards what Optro calls GRC Intelligence.
The platform combines a central system of record for risk and compliance data with AI agents that execute workflows and governance capabilities designed to oversee enterprise AI operations. Optro says its agents use domain-trained capabilities and operate within organisation-defined permissions, controls and risk parameters, with actions and evidence trails logged for auditability.
The expanded portfolio includes six key capabilities.
Autonomous Testing extends agentic testing beyond Sarbanes-Oxley (SOX) requirements to operational audits covering different control types. The system uses Optro Analytics to support full-population testing, allowing auditors to focus more on strategic analysis and professional judgement. Optro also plans to introduce automated evidence collection.
“We built both into one platform with intention. Our agents work inside your live, permissioned context, taking on real-world workflows to deliver the exact business outcomes you need so teams can move fast with a human in control.” — Happy Wang, Chief Product and Technology Officer, Optro
Reddit’s internal audit team automated 175 controls during its first three months using Autonomous Testing, covering more than 40% of its SOX scope and reducing average testing time per control by 60%. The team has since expanded the technology to more than 75% of its SOX controls and other recurring testing programmes.
Agentic Stakeholder Management aims to reduce evidence collection delays by helping stakeholders clarify requests and address documentation gaps before submission. Meanwhile, Agentic Risk Assessment Scoring analyses selected platform data to recommend initial risk scores supported by evidence, helping teams improve assessment consistency and prioritisation.
For compliance teams, Agentic Compliance automates framework scoping, evidence collection and control evaluation, while leaving final judgements and attestations with human teams. Agentic Third-Party Risk Management supports vendor onboarding and due diligence through configurable workflows and policy controls.
The sixth capability, Agentic AI Governance, automates parts of AI system intake by populating records from existing documentation and identifying controls already supported by available evidence. Optro also previewed AI Discovery, which is planned ahead of a 2027 availability target and is designed to identify shadow AI across enterprises.
Happy Wang, Chief Product and Technology Officer at Optro, said the platform was designed to combine agents operating within permissioned enterprise data with governance for AI systems across the organisation. He added that the company uses extensive testing and continuous monitoring to support reliable execution while keeping customer data within their environments.
Optro argues that traditional GRC approaches, built around documenting risks and applying controls, must evolve as AI accelerates business operations and introduces new forms of risk. Its approach focuses on using agents to execute end-to-end workflows while retaining human accountability and traceable evidence.
The launch reflects a broader enterprise challenge: scaling AI-driven automation without weakening oversight, compliance or accountability. For risk leaders, the value of agentic GRC will depend not only on reducing manual work but also on whether automated decisions remain transparent, verifiable and aligned with organisational risk policies.
