Governance, risk management, and compliance

Governance, risk management, and compliance or GRC is the umbrella term covering an organization's approach across these three areas: Governance, risk management, and compliance.[1][2][3]

Overview

Governance, Risk Management, and Compliance (GRC) are three pillars that work together for the purpose of assuring that an organization meets its objectives. They will be explored and their definition will be provided in detail in this article. Governance is the combination of processes established and executed by the board of directors that are reflected in the organization's structure and how it is managed and led toward achieving goals. Risk management is predicting and managing risks that could hinder the organization to achieve its objectives. Compliance with the company's policies and procedures, laws and regulations, strong and efficient governance is considered key to an organization's success. [4]

GRC is a discipline that aims to synchronize information and activity across governance, risk management and compliance in order to operate more efficiently, enable effective information sharing, more effectively report activities and avoid wasteful overlaps. Although interpreted differently in various organizations, GRC typically encompasses activities such as corporate governance, enterprise risk management (ERM) and corporate compliance with applicable laws and regulations.

Organizations reach a size where coordinated control over GRC activities is required to operate effectively. Each of these three disciplines in an organization create information of value to the other two and impacts the same technologies, people, processes and information.

Substantial duplication of tasks evolve when governance, risk management and compliance are managed independently from each other. Overlapping and duplicated GRC activities negatively impact both (i) operational costs and (ii) GRC metrics. For example, each internal service might be audited and assessed by multiple groups on an annual basis, creating enormous cost and disconnected results.

A disconnected GRC approach will also manifest as an inability for the organization to provide real-time GRC executive reports. Like a badly planned transport system, every individual route will operate, but the network will not have the qualities that allows it to work effectively together.

If not integrated, if tackled in a traditional 'silo' approach most organizations must sustain unmanageable numbers of GRC related requirements due to changes in technology, increasing data storage, market globalization and increased regulation

GRC topics

Basic concepts

GRC market segmentation

A GRC program can be instituted to focus on any individual area within the enterprise, or a fully integrated GRC is able to work across all areas of the enterprise, using a single framework.

A fully integrated GRC uses a single core set of control material, mapped to all of the primary governance factors being monitored. The use of a single framework also has the benefit of reducing the possibility of duplicated remedial actions.

When reviewed as individual GRC areas, the three most common individual headings are considered to be Financial GRC, IT GRC, and Legal GRC.

Analysts disagree on how these aspects of GRC are defined as market categories. Gartner has stated that the broad GRC market includes the following areas:

They further divide the IT GRC management market into these key capabilities. Although this list relates to IT GRC, a similar list of capabilities would be suitable for other areas of GRC.

GRC product vendors

The distinctions between the sub-segments of the broad GRC market are often not clear. With a large number of vendors entering this market recently, determining the best product for a given business problem can be challenging. Given that the analysts don’t fully agree on the market segmentation, vendor positioning can increase the confusion.

Due to the dynamic nature of this market, any vendor analysis is often out of date relatively soon after its publication.

Broadly, the vendor market can be considered to exist in 3 segments:

Integrated GRC solutions attempt to unify the management of these areas, rather than treat them as separate entities. An integrated solution is able to administer one central library of compliance controls, but manage, monitor and present them against every governance factor. For example, in a domain specific approach, three or more findings could be generated against a single broken activity. The integrated solution recognizes this as one break relating to the mapped governance factors.

Domain specific GRC vendors understand the cyclical connection between governance, risk and compliance within a particular area of governance. For example, within financial processing — that a risk will either relate to the absence of a control (need to update governance) and/or the lack of adherence to (or poor quality of) an existing control. An initial goal of splitting out GRC into a separate market has left some vendors confused about the lack of movement. It is thought that a lack of deep education within a domain on the audit side, coupled with a mistrust of audit in general causes a rift in a corporate environment. However, there are vendors in the marketplace that, while remaining domain-specific, have begun marketing their product to end users and departments that, while either tangential or overlapping, have expanded to include the internal corporate internal audit (CIA) and external audit teams (tier 1 big four AND tier two and below, information security and operations/production as the target audience. This approach provides a more 'open book' approach into the process. If the production team will be audited by CIA using an application that production also has access to, is thought to reduce risk more quickly as the end goal is not to be 'compliant' but to be 'secure,' or as secure as possible.

Point solutions to GRC are marked by their focus on addressing only one of its areas. In some cases of limited requirements, these solutions can serve a viable purpose. However, because they tend to have been designed to solve domain specific problems in great depth, they generally do not take a unified approach and are not tolerant of integrated governance requirements. Information systems will address these matters better if the requirements for GRC management are incorporated at the design stage, as part of a coherent framework.[6]

GRC data warehousing and business intelligence

GRC vendors with an integrated data framework are now able to offer custom built GRC data warehouse and business intelligence solutions. This allows high value data from any number of existing GRC applications to be collated and analysed.

The aggregation of GRC data using this approach adds significant benefit in the early identification of risk and business process (and business control) improvement.

Further benefits to this approach include (i) it allows existing, specialist and high value applications to continue without impact (ii) organizations can manage an easier transition into an integrated GRC approach because the initial change is only adding to the reporting layer and (iii) it provides a real-time ability to compare and contrast data value across systems that previously had no common data scheme.

Integrated governance, risk and compliancy

An integrated GRC (iGRC) takes information feeds from one or more sources that detect or sense deviations, defects or other patterns from security or business applications. This can include active sensor technologies such as those to protect, monitor and manage information networks and systems. By combining GRC technologies such as web based information security management systems with network security related sensor technologies, it is suggested that defences against cyberattacks are enhanced in real time.

Typical sensor types include:

Cyber crime has taken on such substantial importance in recent years that target organisations for iGRC software are likely to be those supporting critical national infrastructure, e.g. verticals and industries with significant brand/reputation risk. It is suggested that the primary value proposition for iGRC is as follows:

An iGRC configuration is GRC technology coupled to network sensors via the open GRCiP protocol to enable recognition of threats at an early stage through the automatisation of control status and threat level change and then enabling the measures to avoid it, thereby de-risking the enterprise as a whole.

GRC research

A publication review carried out in 2009 found that there was hardly any scientific research on GRC. The authors went on to derive the first GRC short-definition from an extensive literature review. Subsequently the definition was validated in a survey among GRC professionals. "GRC is an integrated, holistic approach to organisation-wide GRC ensuring that an organisation acts ethically correct and in accordance with its risk appetite, internal policies and external regulations through the alignment of strategy, processes, technology and people, thereby improving efficiency and effectiveness."

The authors then translated the definition into a frame of reference for GRC research.

Each of the core disciplines - Governance, Risk Management and Compliance - consists of the four basic components: strategy, processes, technology and people. The organisation's risk appetite, its internal policies and external regulations constitute the rules of GRC. The disciplines, their components and rules are now to be merged in an integrated, holistic and organisation-wide (the three main characteristics of GRC) manner – aligned with the (business) operations that are managed and supported through GRC. In applying this approach, organisations long to achieve the objectives: ethically correct behaviour, and improved efficiency and effectiveness of any of the elements involved.[7]

See also

References

  1. ↑ Anthony Tarantino (2008-02-25), Governance, Risk, and Compliance Handbook, ISBN 978-0-470-09589-8
  2. ↑ Denise Vu Broady, Holly A. Roland (2008-04-25), "The ABCs of GRC", SAP GRC For Dummies, ISBN 978-0-470-33317-4
  3. ↑ Silveira, P., Rodriguez, C., Birukou, A., Casati, F., Daniel, F., D'Andrea, V., Worledge & C., Zouhair, T. (2012), Aiding Compliance Governance in Service-Based Business Processes, IGI Global, pp. 524–548, retrieved 2013-04-06
  4. ↑ Kurt F. Reding, Paul J. Sobel, Urton L. Anderson, Michael J. Head, Sridhar Ramamoorti, Mark Salamasick, Cris Riddle (2013), "Internal Auditing: Assurance & Advisory Services"
  5. ↑ Lamm, Blount, etc., Under Control: Governance Across the Enterprise, retrieved 2013-04-06
  6. ↑ Bonazzi, R., Hussami, L. & Pigneur, Y. (2009), "Compliance Management is Becoming a Major Issue in IS Design", in D'atri, Alessandro; Saccà, Domenico, Information Systems: People, Organizations, Institutions, and Technologies (PDF), Springer, pp. 391–398, doi:10.1007/978-3-7908-2148-2, retrieved 2013-04-06
  7. ↑ Racz, N., Weippl, E. & Seufert, A. (2010), Bart De Decker, Ingrid Schaumüller-Bichl, ed., A frame of reference for research of integrated GRC, Communications and Multimedia Security, 11th IFIP TC 6/TC 11 International Conference, CMS 2010 Proceedings, Berlin: Springer, pp. 106–117, ISBN 978-3-642-13240-7

Further reading