There is a question that surfaces in almost every governance review I conduct: can we use our GRC platform to manage company secretarial obligations? The answer, in 2026, is still mostly no. And that should concern every board that relies on a GRC tool as its single source of governance truth.
This is not a theoretical problem. It is a live compliance risk that sits in the gap between what GRC vendors promise and what company secretarial teams actually need. I have spent 20 years auditing governance frameworks across regulated industries, and the pattern is always the same: organisations buy a GRC platform expecting it to cover everything, discover it does not handle statutory filings or board administration, then bolt on a separate company secretarial tool that never talks to the risk register. The result is a governance architecture held together by email threads and shared drives.
Let me be direct about what is happening here and why it matters.
Company secretarial work is not administrative overhead. It is a legally mandated governance function that carries personal liability for directors and company secretaries. In the UK alone, a private limited company must manage:
For a single entity, this is manageable. For a group of 15, 30, or 100 entities across multiple jurisdictions, it becomes a high-volume compliance operation with hard deadlines and financial penalties for late filing. Companies House imposed over 400,000 late filing penalties in 2024/25 alone. Each one is a governance failure that should have been visible in a risk register but almost never is.
The GRC market in 2026 is dominated by platforms built around three pillars: risk management, compliance management, and audit management. Products like ServiceNow GRC, Archer, Diligent, and OneTrust are engineered to manage regulatory frameworks, control testing, risk assessments, and policy libraries. They do these things well.
What they do not do is manage the operational mechanics of company secretarial compliance. There are specific reasons for this:
GRC platforms model risk and compliance at the organisational level, but they do not model the legal entities themselves. They have no concept of a company formation date, a registered office, a share capital structure, or a filing calendar tied to a specific jurisdiction. Entity lifecycle events (incorporation, dormancy, strike-off, restoration) are invisible to the risk framework because the data model was never designed to hold them.
Company secretarial obligations are driven by hard statutory deadlines that vary by jurisdiction, entity type, and event trigger. A GRC platform can track regulatory compliance deadlines at the framework level (GDPR annual review, ISO 27001 surveillance audit), but it cannot calculate that Entity X's confirmation statement is due on 14 March 2026 because it was incorporated on 14 March 2019 and the review period runs annually from that date. That calculation requires entity-specific data that GRC platforms do not capture.
Board governance is a core company secretarial function: scheduling meetings, issuing notices, preparing board packs, recording minutes, tracking action items, managing written resolutions. GRC platforms treat board oversight as a reporting destination (the board receives risk reports) rather than an operational function that needs its own workflow management.
Statutory filings require direct submission to government registries (Companies House in the UK, CRO in Ireland, SEC in the US). This means API integration with filing portals, document generation in prescribed formats, and submission tracking with confirmation receipts. No mainstream GRC platform offers this natively. The assumption is that filings happen somewhere else, managed by someone else.
When company secretarial obligations live outside the GRC platform, three things happen:
First, governance risk becomes invisible. A missed filing deadline is a compliance failure with financial and reputational consequences, but it never appears in the enterprise risk register because the GRC platform has no visibility into the company secretarial workflow. The board sees a clean risk dashboard while a late filing penalty accrues in the background.
Second, change events create blind spots. When a new director is appointed, that is both a company secretarial event (file a CH01 with Companies House) and a governance event (update the board composition, review committee memberships, assess conflicts of interest, update the risk appetite statement). If these two workflows live in separate systems with no integration, the governance implications of the appointment are handled days or weeks after the filing, if they are handled at all.
Third, multi-entity complexity becomes unmanageable. Acquisitive businesses that add three or four entities per year through M&A face an escalating governance challenge. Each new entity brings its own filing calendar, its own statutory registers, its own board composition. Without a unified platform, the company secretarial team manages this in spreadsheets while the GRC team manages risk in a platform that has no visibility into half the group's legal structure.
The concept behind Automated Risk Injection is straightforward: every governance event, regardless of where it originates, should automatically generate or update a risk entry in the enterprise risk register. This is not a manual process. It is not a quarterly reconciliation. It is a real-time data pipeline that connects company secretarial events to risk outcomes.
Here is how it works in practice:
The system monitors company secretarial workflows for triggering events: a director resignation, a missed filing deadline approaching, a PSC change, a share transfer above a materiality threshold, a subsidiary entering dormancy. Each event type has a predefined risk classification and severity weighting.
When an event is detected, the system automatically creates a risk entry with a pre-populated description, risk category, initial likelihood and impact scores, control owner assignment, and review deadline. A director resignation, for example, generates a board composition risk (is the board still quorate? are committee positions covered?) and a filing compliance risk (has the TM01 been filed within 14 days?).
The generated risk is automatically linked to relevant controls in the GRC framework. A filing compliance risk links to the statutory filing control. A board composition risk links to the succession planning control. This eliminates the manual effort of mapping events to controls and ensures that control effectiveness is tested against real governance events rather than hypothetical scenarios.
If the risk is not addressed within the defined timeframe, it escalates automatically through the governance hierarchy. A missed filing deadline that remains unresolved for 48 hours escalates from the company secretary to the general counsel. At 72 hours, it reaches the audit committee chair. This is not email-based escalation; it is system-driven, auditable, and visible in the risk dashboard in real time.
The architecture required to manage company secretarial obligations within a GRC context is not complicated, but it does require specific capabilities that most vendors have not built:
If you are evaluating GRC platforms in 2026, here is the audit checklist I use to assess whether a vendor genuinely supports company secretarial obligations or is simply ticking a box on a feature comparison matrix:
The organisations that feel this gap most acutely are those growing through acquisition. Every deal adds entities. Every entity adds obligations. Every obligation adds risk. If your GRC platform cannot absorb company secretarial data as a native input, then every acquisition increases the distance between your risk dashboard and your actual governance position.
I have audited groups where the company secretarial team managed 60 entities in a spreadsheet while the GRC team reported "green" on governance risk because their platform only tracked risks that had been manually entered. The disconnect was not a technology failure. It was an architecture failure: two systems, no integration, and a board that assumed the GRC dashboard told the full story.
Automated Risk Injection eliminates this disconnect by making company secretarial events first-class inputs to the risk framework. When Entity 47 misses a confirmation statement deadline, that is not a spreadsheet problem handled by the company secretary. It is a compliance risk with a severity score, a control owner, an escalation path, and a board reporting obligation. The system handles this automatically because the architecture was designed to treat company secretarial obligations as governance events rather than administrative tasks.
Can GRC software manage company secretarial obligations? In 2026, the honest answer is: most cannot. They were not designed for it. The data models are wrong, the deadline engines do not exist, and the integration points are absent. What you need is not a better GRC platform. You need a governance operating system that treats entity management, company secretarial compliance, and enterprise risk as components of a single architecture.
That is what Simplif-i was built to deliver. Not a GRC tool that bolts on company secretarial features. Not a company secretarial tool that pretends to manage risk. A single platform where every governance event, from a director appointment to a contract renewal to an acquisition closing, flows through one risk framework with one audit trail and one board reporting channel.
Compliance, simplif-i'd.
--- Source: https://simplif-i.com/api/blog/readable/grc/can-grc-software-manage-company-secretarial-obligations Web Version: https://simplif-i.com/blog/grc/can-grc-software-manage-company-secretarial-obligations © Simplif-i - Unified Business Management Platform