MY STORY
My journey didn't start in GRC.
It started on a basketball court.
I became a professional basketball coach at 23. For many years I coached athletes from around the world to help them reach their full potential. Coaching taught me how people actually learn: not by reading the playbook alone, but with a coach who corrects you and an environment that holds you accountable when motivation runs out.
Then I left the court and started a new life.
I entered the corporate world. First handling security and privacy for a managed services provider with its own data center, then as a Security Officer at a large professional services firm. This is where I learned to implement and run an ISMS in accordance with ISO 27001. It's also where I ran into the problem every implementer knows: the standard tells you what must be done, but never how.
I learned the how the hard way. Audit after audit, I was the auditee — the one answering for the ISMS. You quickly learn what holds up and what falls apart the moment someone asks "why." No book teaches you that.
Then I switched sides.
I became a Lead Auditor for ISO 27001 and 27701. Now I was the one asking the questions.
Auditing made my own understanding far deeper. Seeing dozens of different ISMS, from the outside, you start to notice what really works and what only looks good on paper.
And I kept seeing the same problems I'd once had myself. Person after person, fully trained and certified, would freeze when I asked them why — why this control, why this decision. They could show me the policy. They just couldn't stand behind it. I knew that feeling, because I'd been in their seat.
Then AI arrived, and it made that problem far more serious.
What used to be enough — producing the documents, knowing the standard on the surface — is now exactly what a machine does in seconds. The shallow work isn't just limited anymore. It's becoming irrelevant.
That's the quiet fear I hear from GRC professionals everywhere:
My answer is no. And here's why:
Aron Lange
Founder, GRC Lab
That's exactly why the world still needs professionals with a deep understanding of this standard. Someone has to challenge what the machine produces, evaluate whether it's right, and answer for the decision. AI can't do that. A person who truly understands can.
And you don't get there by collecting more documents. You get there the way people get good at anything: with a coach who corrects you, and an environment that keeps you accountable until you finish.
So I took everything coaching taught me about how people genuinely learn — clear structure, real guidance, and the accountability to finish — and I built GRC Lab around it.
Aron Lange
CISM
CISA
CRISC
CGEIT
ISO 27001 Lead Auditor
I’m Aron Lange, founder of GRC Lab. I’ve spent my career on both sides of the audit table. Whatever stage you’re at, my goal is the same: to make sure that when someone asks you “why,” you have the answer — and the confidence behind it.