| Part of a series on |
| Governance |
|---|
Governance, risk, and compliance (GRC) is the term covering an organization's approach across these three practices: governance, risk management, and compliance amongst other disciplines. [1] [2] [3] [4] They are goals that are structured by an organization to ensure it meets up the industry and government regulations [5]
GRC was established through high-profile corporate scandals, such as Enron Corporation which led to the need for GRC practices. Enron misrepresented its income and hid the status of the company's debt from the public. "Enron was a company where... it was OK to cheat as long as you were making money for the company" but the victims and the employees who were effected by this lost their future, their health insurance plans, retirement plans and so on. [6]
In response to this event, regulations like the U.S. Sarbanes-Oxley Act of 2002 were enhanced to ensure strict internal controls and financial reporting standards. Sarbanes-Oxley Act ensured to improve auditing and disclosure for public corporations, which is today known as one of the "most impactful regulation". [7]
The early 2000's marked the beginning of GRC as a cohesive framework. Organizations began to recognize the interconnectedness of governance, risk management, and compliance. This realizations led to the development of software that allows for more efficient management of these functions. For example, in 2002, Symbiant, a UK software development company created the first GRC software that let teams work together online, combing risk registers, evaluations and audit tracking all in one system. [8]
The first scholarly research on GRC was published in 2007 [9] by the Open Compliance and Ethics Group (OCEG) [10] by the [11] founder Scott Mitchell where GRC was formally defined as "the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity" aka Principled Performance®. [12] The research referred to common "keep the company on track" activities conducted in departments such as internal audit, compliance, risk, legal, finance, IT, HR as well as the lines of business, executive suite and the board itself.
Today, GRC is seen as very important for organizations to succeed in running business. Companies use GRC to make better decisions, manage risks, follow rules, and protect their reputation.
Governance, risk, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with integrity. [13] Governance is the combination of processes established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and led toward achieving goals. Risk management is predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and regulations) and voluntary boundaries (company's policies, procedures, etc.). [14] [15]
Governance, risk and compliance (GRC) is a discipline that aims to synchronize information and activity across governance, and compliance in order to operate more efficiently, enable effective information sharing, more effectively report activities and avoid wasteful overlaps. It also helps to improve an organization to make better decisions and perform better by following the GRC set of practices. Although interpreted differently in various organizations, GRC typically encompasses activities such as corporate governance, enterprise risk management (ERM) and corporate compliance with applicable laws and regulations.
Organizations reach a size where coordinated control over GRC activities is required to operate effectively. Each of these three disciplines creates information of value to the other two, and all three impact the same technologies, people, processes and information.
Substantial duplication of tasks evolves when governance, risk management and compliance are managed independently. Overlapping and duplicated GRC activities negatively impact both operational costs and GRC matrices. For example, each internal service might be audited and assessed by multiple groups on an annual basis, creating enormous cost and disconnected results. A disconnected GRC approach will also prevent an organization from providing real-time GRC executive reports. GRC supposes that this approach, like a badly planned transport system, every individual route will operate, but the network will lack the qualities that allow them to work together effectively. [16]
If not integrated, if tackled in a traditional "silo" approach, most organizations must sustain unmanageable numbers of GRC-related requirements due to changes in technology, increasing data storage, market globalization and increased regulation.
GRC often requires reviewing an organization's current processes and systems. Each part of an organization usually has its own way to handle risks and compliances. However, if the organization uses one specific approach to implement on GRC, it helps everyone work towards the same goal. Here are 5 steps to implement GRC.
Having GRC all in one system gives leaders a clear understanding of what's needed to achieve the organization's goals and to know the risks and compliance factors that may impact them [19] . This alignment ensures that decisions are supported by the organization's goals and regulatory obligations.
Risk management is an ongoing process that constantly needs to be reviewed to ensure that the company is following all the regulations. This allows the company to perform well while ensuring it can "identify, assess, manage, and monitor risks comprehensively" to detect any risks that the company may face in the future. [19]
If your team has limited time or resources, GRC can help by automating many manual tasks. This lets your staff focus on what is important, keeping the organization safe and following the rules while cutting out unnecessary work so that time can be used more wisely.
The organization will not face any penalties, fines or problems that may arise from not following government regulations and rules. The organization will stay up to date if there are any new regulations created which helps to avoid any future consequences.
Following the regulations of GRC and staying up to date also increases stakeholder's trust to the organization, allowing the reputation of the company to stay trustworthy and responsible. This helps to build confidence with clients, partners, and stakeholders, making the organization to grow and achieve more opportunities.
Managing GRC separately is hard to keep up with especially when an organization is growing rapidly or rules change. A GRC system helps an organization grow smoothly without facing any problems by keeping compliance and risk management organized and easier to handle.
A GRC program can be instituted to focus on any individual area within the enterprise, or a fully integrated GRC is able to work across all areas of the enterprise, using a single framework.
A fully integrated GRC uses a single core set of control material, mapped to all of the primary governance factors being monitored. The use of a single framework also has the benefit of reducing the possibility of duplicated remedial actions.
When reviewed as individual GRC areas, the most common individual headings are considered to be Financial GRC, Operational GRC, WHS GRC, IT GRC, and Legal GRC.
The distinctions between the sub-segments of the broad GRC market are often not clear. With a large number of vendors entering this market recently, determining the best product for a given business problem can be challenging. Given that the analysts do not fully agree on the market segmentation, vendor positioning can increase the confusion.
Owing to the dynamic nature of this market, any vendor analysis is often out of date relatively soon after its publication.
Broadly, the vendor market can be considered to exist in three segments:
Integrated GRC solutions attempt to unify the management of these areas, rather than treat them as separate entities. An integrated solution is able to administer one central library of compliance controls, but manage, monitor and present them against every governance factor. For example, in a domain specific approach, three or more findings could be generated against a single broken activity. The integrated solution recognizes this as one break relating to the mapped governance factors.
Domain specific GRC vendors understand the cyclical connection between governance, risk and compliance within a particular area of governance. For example, within financial processing — that a risk will either relate to the absence of a control (need to update governance) and/or the lack of adherence to (or poor quality of) an existing control. An initial goal of splitting out GRC into a separate market has left some vendors confused about the lack of movement. It is thought that a lack of deep education within a domain on the audit side, coupled with a mistrust of audit in general causes a rift in a corporate environment. However, there are vendors in the marketplace that, while remaining domain-specific, have begun marketing their product to end users and departments that, while either tangential or overlapping, have expanded to include the internal corporate internal audit (CIA) and external audit teams (tier 1 big four AND tier two and below), information security and operations/production as the target audience. This approach provides a more 'open book' approach into the process. If the production team will be audited by CIA using an application that production also has access to, is thought to reduce risk more quickly as the end goal is not to be 'compliant' but to be 'secure,' or as secure as possible. You can also try the various GRC Tools available in market which are based on automation and can reduce your work load.
Point solutions to GRC are marked by their focus on addressing only one of its areas. In some cases of limited requirements, these solutions can serve a viable purpose. However, because they tend to have been designed to solve domain specific problems in great depth, they generally do not take a unified approach and are not tolerant of integrated governance requirements. Information systems will address these matters better if the requirements for GRC management are incorporated at the design stage, as part of a coherent framework. [20]
GRC vendors with an integrated data framework are now able to offer custom built GRC data warehouse and business intelligence solutions. This allows high value data from any number of existing GRC applications to be collated and analyzed.
The aggregation of GRC data using this approach adds significant benefit in the early identification of risk and business process (and business control) improvement.
Further benefits to this approach include (i) it allows existing, specialist and high value applications to continue without impact (ii) organizations can manage an easier transition into an integrated GRC approach because the initial change is only adding to the reporting layer and (iii) it provides a real-time ability to compare and contrast data value across systems that previously had no common data scheme.'
Each of the core disciplines – Governance, Risk Management and Compliance – consists of the four basic components: strategy, processes, technology and people. The organization's risk appetite, its internal policies and external regulations constitute the rules of GRC. The disciplines, their components and rules are now to be merged in an integrated, holistic and organization-wide (the three main characteristics of GRC) manner – aligned with the (business) operations that are managed and supported through GRC. In applying this approach, organizations long to achieve the objectives: ethically correct behavior, and improved efficiency and effectiveness of any of the elements involved. [21]