Post-Merger GRC Integration: The Hidden Risks of Fragmented Compliance Tools

The Business Risks of Fragmented GRC Systems After an Acquisition

GRC tool fragmentation in a post-acquisition group is not an organisational inconvenience — it is a generator of concrete, measurable risks.

Risk 1: Risk Decisions Made on Incomplete Data

The first risk is epistemic. When supplier data is spread across fifteen distinct systems, no decision-maker has a complete picture.

The Procurement Director sees performance data. The Compliance Manager sees regulatory alerts. The CFO sees financial data. But no one sees all three simultaneously.

As a result, the correlation between a financial deterioration, an emerging documentary non-compliance, and a quality performance decline at the same supplier often goes unnoticed until the failure occurs.

Hutchinson experienced this reality before its transformation. With fifteen unsynchronised supplier databases spread across Procurement, Finance and industrial systems, the group faced permanent data discrepancies. Each department held its own version of the truth about the same suppliers, with no reliable way to reconcile them.

The decision to make Ivalua the group’s master supplier repository and integrate Aprovall into it was not an IT project. It was a governance decision: creating the conditions for a shared view of supplier risk accessible to Procurement, Finance and IT simultaneously.

Risk 2: Regulatory Compliance That Cannot Be Demonstrated

The second risk is evidentiary.

In a merger and acquisition context, regulatory obligations apply to the consolidated entity — not to pre-acquisition entities in isolation. The French Duty of Vigilance, Sapin 2, and the CSRD all reason in terms of the group, the consolidation perimeter, and the integrated value chain.

An organisation that manages compliance through tools fragmented by entity cannot produce credible consolidated reporting.

It may be able to demonstrate that each individual entity met a given standard. What it cannot easily demonstrate is that the group as a whole exercised due diligence across its entire supplier portfolio.

Yet this consolidated demonstration is precisely what regulators and auditors increasingly require.

Eiffage, with 70,000 suppliers and subcontractors spread across dozens of business lines and entities, illustrates this challenge at scale. Before centralising documentary collection through Aprovall integrated into Ivalua, each group entity was collecting the same information from the same suppliers using different tools.

Without sharing. Without consolidation. Without group-level visibility.

Compliance existed in silos. Group reporting did not.

Risk 3: A Degraded Supplier Experience That Signals Internal Disorder

The third risk is relational — and frequently underestimated.

A supplier working with several entities of a post-acquisition group may receive redundant documentary requests, inconsistent questionnaires, and communications from multiple uncoordinated contacts.

For the supplier, the conclusion is immediate: this group is poorly organised.

That perception has tangible consequences. It influences the priority suppliers assign to compliance requests, the quality of responses they provide to ESG or due diligence questionnaires, and their willingness to proactively raise emerging risks rather than manage them quietly.

Over time, supplier engagement deteriorates.

GRC fragmentation therefore creates more than an internal governance problem. It weakens the quality of supplier relationships and, in turn, the quality of the information on which risk management depends.

When suppliers experience disorder, organisations should not be surprised when visibility into supplier risk declines as well.

Risk 4: An Enlarged Attack Surface for Fraud

The fourth risk is financial and security-related.

Fragmented systems mechanically create control gaps — spaces between tools where verifications do not occur, where data is not cross-checked, and where anomalies fail to trigger alerts.

These gaps are rarely visible until they are exploited.

They are also the preferred entry points for payment fraud, supplier identity theft, and attempts to manipulate approval workflows.

In a post-acquisition environment, where processes are still being harmonised and responsibilities are often distributed across multiple entities, the number of these gaps tends to increase rather than decrease.

SPL Lyon Part-Dieu is not a post-acquisition group, but its experience illustrates the mechanism clearly. Before integrating Aprovall and Sis ID, the absence of automated bank account verification and the lack of task separation in the payment chain created precisely this type of vulnerability.

The result nearly cost the organisation €1.7 million in fraud.

In post-acquisition groups, where multiple systems and control frameworks coexist, these vulnerabilities multiply — often without being detected until an incident occurs.

The Four Risks of GRC Fragmentation After an Acquisition

Fragmented vs Unified GRC Architecture

How to Start Rationalising GRC After an Acquisition

Recognising fragmentation is one thing. Addressing it requires a structured approach.

Organisations that successfully rationalise post-acquisition GRC environments rarely begin by replacing every existing system. Instead, they focus first on visibility, governance and standardisation.

Three priorities typically come first:

1. Establish a single supplier source of truth

Before processes can be harmonised, organisations need a common repository that identifies suppliers consistently across all acquired entities. Without this foundation, reporting, due diligence and risk monitoring remain fragmented.

2. Standardise compliance requirements across entities

Acquisitions often bring different risk management practices, document requirements and approval workflows. Defining a common compliance framework creates consistency while allowing entities to retain operational autonomy where appropriate.

3. Identify the highest-risk integration gaps

Not every system needs to be integrated immediately. Priority should be given to areas where fragmentation creates the greatest exposure — supplier onboarding, documentary compliance, payment controls and third-party risk monitoring.

The objective is not immediate tool replacement. It is creating a common governance layer that allows the group to manage risk consistently while integration progresses.