The Risk Wheelhouse

S4E1: The 2025 IRM50—Integrated Risk Management All-Stars

• Wheelhouse Advisors LLC • Season 4 • Episode 1

Share episode

The baseball All-Stars aren't the only MVPs making headlines in Atlanta this summer. Just as the MLB's finest gather at Truist Park, Wheelhouse Advisors has released their game-changing 2025 IRM Navigator™ Viewpoint Report, spotlighting the 50 most influential players in integrated risk management.

This explosive market—projected to reach a staggering $147 billion by 2032—is undergoing a profound transformation. What was once a back-office compliance function has evolved into a strategic imperative for boards, CISOs, and transformation leaders worldwide. The Viewpoint Report cuts through the noise, evaluating over 220 global providers to identify the IRM50— 50 all-stars across five critical domains: Enterprise Risk Management, Governance Risk & Compliance, Operational Risk Management, Technology Risk Management, and—new this year—Risk Management Consulting.

Perhaps most striking is the report's findings on market leadership and ownership structure. Only six providers achieved the coveted Market Leader status, reflecting increasingly rigorous standards as the industry matures. Meanwhile, over 80% of these influential companies remain privately held, despite some serving up to 75% of Fortune 500 organizations. Their collective workforce exceeds 1.5 million professionals—enough to fill Atlanta's Truist Park 36 times over.

We're witnessing the emergence of "autonomous IRM," where systems continuously identify risks, automatically correlate data, and even implement responses without human intervention. Organizations are shifting from checkbox compliance toward outcome-oriented approaches that demonstrate real business value. The future belongs to those leveraging AI-native platforms and digital twin advisory models that simulate scenarios before implementation, essentially creating risk management "flight simulators."

Ready to discover which all-stars are transforming risk from a defensive necessity into a strategic advantage? Download the 2025 IRM Navigator™ Viewpoint Report and find out which providers are truly changing the game for forward-thinking organizations.



Visit www.therisktechjournal.com and www.rtj-bridge.com to learn more about the topics discussed in today's episode.

Subscribe at Apple Podcasts, Spotify, or Amazon Music. Contact us directly at info@wheelhouseadvisors.com or visit us at LinkedIn or X.com.

Our YouTube channel also delivers fast, executive-ready insights on Integrated Risk Management. Explore short explainers, IRM Navigator research highlights, RiskTech Journal analysis, and conversations from The Risk Wheelhouse Podcast. We cover the issues that matter most to modern risk leaders. Every video is designed to sharpen decision making and strengthen resilience in a digital-first world. Subscribe at youtube.com/@WheelhouseAdv.


Sam Jones:

OK, let's, let's dive right in. So right now, july 15th 2025, atlanta's buzzing, you've got the 95th MLB All-Star Game happening.

Ori Wellington:

That's right, big day for baseball fans.

Sam Jones:

Exactly Celebrating top talent. You know strategic plays. But interestingly, while that's going on at Truist Park, there's another kind of all-star roster making news here in Atlanta too.

Ori Wellington:

And that's what we're digging into.

Sam Jones:

Yeah, that's our focus today.

Ori Wellington:

Because today Wheelhouse Advisors, also based right here in Atlanta, just dropped their 2025 IRM 50 report.

Sam Jones:

OK, IRM 50.

Ori Wellington:

Yeah, and this isn't about batting averages, obviously. It's about identifying the 50 most influential players technology providers, consultants in integrated risk management or IRM.

Sam Jones:

Gotcha, the ones really shaping the future of how companies handle risk.

Ori Wellington:

Precisely. They're the heavy hitters in this field.

Sam Jones:

So our mission here for you listening, is really to give you that shortcut you know, to quickly get you up to speed on this really crucial and fast moving industry.

Ori Wellington:

We'll break down what IRM actually means, why this report is such a big deal.

Sam Jones:

And maybe uncover some surprising things about who's leading the charge and what trends are driving this whole thing. You get those aha moments without you know getting bogged down.

Ori Wellington:

Sounds good. So maybe start with the basics. Why IRM? Why now? What's the big deal?

Sam Jones:

Yeah, what's driving this?

Ori Wellington:

Well, the first thing is just the sheer speed of this market. It's accelerating like crazy.

Sam Jones:

How fast are we talking?

Ori Wellington:

We're talking projections hitting something like $147 billion by 2032.

Sam Jones:

Wow Okay, $147 billion. That's not just growth, that's an explosion.

Ori Wellington:

It really is, and it signals a pretty fundamental shift in how businesses are thinking about risk. It's not just a back office function anymore.

Sam Jones:

So who's really feeling that pressure? Who needs this clarity? Is it boards, CISOs?

Ori Wellington:

It's all of them really yeah Boards, definitely CISOs, chief risk officers, even leaders driving big transformations.

Sam Jones:

Right.

Ori Wellington:

They're all looking for. You know who's actually leading. Who can they rely on in this increasingly complex landscape? They need trusted partners.

Sam Jones:

Makes sense, and that's where this IRM 50 report comes in handy, I guess.

Ori Wellington:

Exactly, it provides that clarity. Wheelhouse looked at I think it was over 220 providers globally 220 to get down to 50. Yeah, quite the filtering process. And they used three main criteria.

Sam Jones:

Okay, what were they looking for?

Ori Wellington:

So first was solution breadth Basically, how comprehensive are their offerings? Do they cover different types of risk? Second, integration capability how well does their stuff plug into everything else a company uses? Can you get that unified view Critical. Avoid those silos Absolutely. And third was market influence, which is interesting. It's not just about size, oh how. So it's more about are they shaping the conversation, pushing best practices? Are peers and analysts actually citing them? That kind of impact?

Sam Jones:

Right. So it's about thought leadership and, well, actual influence, not just market share.

Ori Wellington:

Exactly A really important distinction.

Sam Jones:

And these top 50 providers. They operate across what? Five core areas, five domains of IRM?

Ori Wellington:

That's right, Five main buckets. You've got your enterprise risk management ERM that's the big picture across the whole company. Then governance, risk and compliance, GRC that's rules, regulations, policies, making sure you're compliant the classic stuff, Pretty much. Then operational risk management ORM that's about the risks in your day-to-day business processes, things going wrong internally.

Sam Jones:

Right.

Ori Wellington:

Fourth is technology risk management, trm. So cyber risk, it vulnerabilities, all that tech stuff obviously huge now.

Sam Jones:

Hugely important yeah.

Ori Wellington:

And then the fifth one is actually a game changer for this year's report Risk management consulting RMC.

Sam Jones:

Ah, okay, so consultants are now officially part of the IRM 50 mix. That is a big deal.

Ori Wellington:

It's a really significant evolution. Yeah, First time they're included as like full-fledged contributors.

Sam Jones:

What does that signal? Do you think about how companies are tackling risk now?

Ori Wellington:

Well, there are 10 consulting firms on the list this year that's 20%, 20%, wow. Yeah, I think it really acknowledges that the technology is vital, but the strategy and the execution that requires expert guidance.

Sam Jones:

So it's not just buying a tool, it's about making it work effectively.

Ori Wellington:

Exactly, companies want outcomes, tangible results, and these consultants, they're kind of like the coaches or maybe the closers in baseball terms.

Sam Jones:

Huh, I like that. The coaches and closers of IRM.

Ori Wellington:

Yeah, they bring that advisory strength drive, the maturity, help actually implement things properly.

Sam Jones:

Makes total sense. Ok, so, speaking of top talent, the report also calls out market leaders, but you said this group is smaller this year.

Ori Wellington:

Much smaller, very exclusive club. Now Only six providers made that cut.

Sam Jones:

Six Down from what potentially over 20 in the past.

Ori Wellington:

Yeah, exactly, it used to be a broader category. Now it's much more rigorous.

Sam Jones:

So what does it take to be a market leader in 2025,?

Ori Wellington:

according to this, it means demonstrating really top-tier performance across well everything Core capabilities, how deeply integrated their solutions are and their ability to work across different risk domains.

Sam Jones:

So they're the dependable all-rounders, the starting lineup, as the report calls them.

Ori Wellington:

That's a good way to put it Reliable across any risk inning. The fact that there are fewer just shows the bar is getting higher as the market matures.

Sam Jones:

Right, higher standards for leadership, but OK, every lineup needs its strong rookies too right.

Ori Wellington:

Are there new players breaking in? Absolutely. The report highlights five new entrants to the IRM 50 this year the rookies to watch.

Sam Jones:

OK, what got them onto the list?

Ori Wellington:

Generally it's standout innovation or maybe really strong market momentum or bringing some genuinely new capability to the field.

Sam Jones:

Like. What kind of innovation are we seeing?

Ori Wellington:

Well, they give examples like AI-native TRM platforms.

Sam Jones:

AI-native meaning.

Ori Wellington:

Meaning built with AI at the core from the start, not just AI sprinkled on top of an old system. It allows for much more predictive and continuous risk monitoring in the tech space.

Sam Jones:

Proactive, not just reactive.

Ori Wellington:

Exactly, and another example was digital twin advisory models.

Sam Jones:

Digital twins for risk. How does that work?

Ori Wellington:

Yeah, Think of creating like a virtual replica of your organization's risk landscape. Okay, Then consultants can use that model to simulate different scenarios market shifts, supply chain breaks, cyber attacks and test out strategies before you implement them in the real world.

Sam Jones:

Wow, okay, that's like having a risk flight simulator lets you see potential impacts beforehand pretty much.

Ori Wellington:

It provides a level of foresight that's quite new. So real game-changing stuff from these new entrants definitely sounds like it now.

Sam Jones:

We've mentioned Atlanta a couple of times because of wheelhouse and the All-Star Game. Is this primarily a US-centric market or is it global?

Ori Wellington:

Good question, While the US does still have the most company headquarters on the list the 2025. Irm50 is actually the most globally representative it's ever been.

Sam Jones:

Oh really, when else are these companies based?

Ori Wellington:

We're seeing firms from Canada.

Sam Jones:

Norway, the UK, France, Switzerland, the Netherlands, even.

Ori Wellington:

India, okay, so pretty diverse geographical spread. Definitely it really underlines that IRM is a mature global market. Now these challenges are universal.

Sam Jones:

That makes sense. And something else that jumped out at me from the outline was the ownership structure of these companies. It's not what you might expect.

Ori Wellington:

Right, it's actually fascinating. You might think giants like Microsoft, ibm, servicenow would dominate this list.

Sam Jones:

Yeah, the big public tech companies.

Ori Wellington:

But nope, over 80% of the IRM50 are privately held 80% Seriously Backed by private equity VCs. Yeah, or still founder-led. But, and this is the key point, private does not mean small or niche in this space.

Sam Jones:

Okay, how so?

Ori Wellington:

Well, get this One of these private IRM50 companies used by 75% of the Fortune 500.

Sam Jones:

75% what.

Ori Wellington:

Another one powers over 40% of the Fortune 500 list. Many are deeply embedded in highly regulated industries, critical infrastructure, huge multinational corporations.

Sam Jones:

Okay, so these aren't small boutique shops. They're major players, just not publicly traded.

Ori Wellington:

Exactly, it seems like in this particular market that private structure, maybe the agility, the focused innovation, the strategic funding it allows, drives growth and influence faster, or at least as fast as going public.

Sam Jones:

That's a really interesting insight into this sector, and the size varies wildly too, right from small teams to massive organizations. Oh, absolutely.

Ori Wellington:

You've got some IRM50 vendors who are quite lean, maybe 60 to 100 employees really focusing their innovation on specific niche areas. And then you have others, especially on the consulting side, employing well over 370,000 people globally, like the big four consulting firms for example.

Sam Jones:

That's an incredible range. So what's the total workforce represented here If?

Ori Wellington:

you add it all up across the 50 firms, it's over 1.5 million people.

Sam Jones:

One and a half million.

Ori Wellington:

Yeah, Enough people to fill Truist Park, where the all-star game is more than 36 times over.

Sam Jones:

Good grief. That really puts the scale of this industry into perspective. It's massive.

Ori Wellington:

It absolutely is, and that diversity in size kind of mirrors the real world. Right Organizations need different solutions, sometimes highly focused, sometimes globally integrated.

Sam Jones:

True, so let's bring it back to the listener. What's the big takeaway here? Why does this lineup, this whole IRM 50 report, matter to you if you're dealing with risk in your job?

Ori Wellington:

Well, the report isn't just a list of names. It really captures a fundamental shift happening.

Sam Jones:

A shift in how companies approach risk.

Ori Wellington:

Exactly, it's showing a move away from you know, having lots of separate, fragmented tools just for compliance.

Sam Jones:

Right, the old, siloed approach.

Ori Wellington:

Towards truly integrated risk platforms getting that holistic compliance Right. The old siloed approach Towards truly integrated risk platforms getting that holistic view.

Sam Jones:

OK, integrated platforms. What else?

Ori Wellington:

We're also see a shift from just doing, say, periodic assessments in silos towards something they're calling autonomous IRM.

Sam Jones:

Autonomous IRM. That sounds futuristic. What does that actually mean?

Ori Wellington:

Yeah, it's a big concept. Think of it as moving beyond just manual data gathering and reporting. It's about systems that can more proactively and continuously identify risks, correlate data automatically from different parts of the business, maybe even suggest or automate responses. It brings more prediction, less reaction.

Sam Jones:

So smarter, more automated risk management.

Ori Wellington:

Kind of Right, and linked to that is another shift, moving away from a purely governance-first mindset.

Sam Jones:

Meaning just ticking the compliance boxes.

Ori Wellington:

Pretty much Shifting from did we follow the rule towards an outcome-first approach.

Sam Jones:

Okay, outcome-first. How does that look in practice?

Ori Wellington:

It means asking how is our risk management actually helping us achieve our business goals? You know, is it enabling us to enter a market faster? Is it making us more resilient when disruption hits? Is it reducing friction?

Sam Jones:

So connecting risk management directly to business performance and strategy, not just seeing it as a cost center.

Ori Wellington:

Precisely, it's about showing real value, real ROI, not just adherence. These vendors, the IRM50, are the ones enabling organizations to make that shift.

Sam Jones:

They're helping reframe risk, not as just a defensive necessity, but as potentially a strategic function.

Ori Wellington:

Absolutely Helping shape that next generation of performance, resilience, assurance and compliance. It's all becoming interconnected.

Sam Jones:

Okay. So this deep dive really shows a transformation underway in integrated risk management, driven by this diverse, all-star group of companies who are changing the game.

Ori Wellington:

It's a powerful snapshot yeah.

Sam Jones:

Yeah.

Ori Wellington:

Moving beyond. Just you know basic blocking emerging threats, ai driven cybercrime, climate risks affecting supply chains, you name it.

Sam Jones:

New challenges constantly popping up. What new capabilities, what new layers of risk management do you think will become most critical for organizations to master next, and how might that change? Who the all stars are in this field down the road?

Ori Wellington:

That's the multibillion dollar question, isn't it Definitely something to think about? What comes after autonomous IRM, what's the next frontier for managing risk effectively? Good place to leave it.