Most GRC work is repetitive by nature: the same evidence collection steps, the same control review routing, the same “did this migrate correctly” checks, over and over, for every release and every audit cycle. The instinct in a lot of compliance teams is to just add more people or more spreadsheets. I go the other way — if I’m doing the same manual check three times, I write a script the third time so there isn’t a fourth.
Where I start
The highest-leverage automation targets aren’t the flashiest ones. They’re the steps where a human is acting as a data-transformation layer: reading a PDF and typing values into a form, comparing two screens field by field, or copying evidence from one system into another. Those are exactly the tasks a Python script does faster and more consistently than a person — and every hour saved there is an hour back for the judgment calls that actually need a human.
An example
When our GRC platform needed to migrate between instances, the standard approach was “stare-and-compare”: two people, two screens, checking that tables, fields, workflows, and rules all moved correctly. I built a Python and Playwright automation paired with a Flask validation app to do that comparison instead — same thoroughness, a fraction of the time, and a record of exactly what was checked instead of a checklist someone initialed.
The bigger point
Compliance-as-code isn’t about replacing judgment with automation. It’s about spending less time being a human diff tool so there’s more time left for the actual risk decisions.