GRC Journal - (Page 25) Governance, Risk & Compliance What is the role of IT in GRC today? Most regulated processes are enabled by IT, so IT controls become very important to the overall control environment around these processes within an organization. On top of all of these processes that are enabled by IT, there are still a plethora of labor-intensive manual process controls that, as they are automated, are being pushed over to IT departments – so the IT organization’s role becomes evermore complex as it assumes responsibility for more and more of the company’s compliance burdens. There are three large components of compliance costs for any organization: 1) internal labor costs; 2) consulting labor costs; and 3) auditor labor costs. With IT’s help in automating controls, organizations are able to bring down all three of these costs; increased controls automation is synonymous with decreased labor costs since there is less to go through and check manually. When you look at the role of IT, overall, it is beginning to automate the compliance process and control environment in order to lower the cost of compliance. However, for IT to be effective, control environment complexities must be reduced through standardizing and rationalizing controls. It is impossible to reduce the cost and complexity of the compliance process without IT. Within the organization, is there a chain of command responsible for managing governance, risk, and compliance? Who’s on top? In industries like financial services and pharmaceuticals, where larger organizations have mature structures, there are specific positions that are dedicated to governance, risk, and compliance. But in mid-sized companies and industries like retail or manufacturing, with less mature organizational structures, GRC may be a double-hatted function or may be done in business unit silos with no central support. Today, however, there is a sweeping trend towards hiring a pinpoint person who is only responsible for the organization’s governance, risk, and compliance needs. There are many new regulations being passed as of late. Inherent in achieving compliance is being able to point to the single person responsible and accountable for a company’s adherence to a given rule, policy, or regulation. That person is typically a CxO or a business unit manager, but they should not have to manage both operations and compliance – they need help from someone who is an expert at compliance. So, if you are still unable to pinpoint the person who is responsible for your organization’s compliance efforts, your company may be at serious risk; but I find this situation to be very rare today. We have reached a point where companies of all sizes in all industries are realizing the absolute need for someone to focus on GRC within the organization. Companies hire IT Compliance Managers, IT Risk Managers, IT Governance Managers, Directors, etc. to be responsible for governance, risk, and compliance. And although it is still a bit fuzzy as to who is on “top” because business units are still very siloed; companies know that it costs a lot of money to be without core accountability, and are taking steady measures to make sure there is someone assisting the accountable managers and executives with all of their GRC requirements and goals. What are the areas that GRC Management software should ideally cover? The core of GRCM software should help organize the content and workload associated with compliance processes. Typically, the functionality that GRCM software should give are: document/records management capability, reasonable workflow capability, and flexible reporting capability. Companies should be especially careful when evaluating the reporting capability; companies are certainly looking for standardized reports, but they also want to be able to generate reports based on queries or even modify some of the standardized reports. All in all, the very basics of GRCM software should include role-based reporting and dash-forwarding, document management, and good workflow. In my opinion, many of the GRCM solutions available today are missing good business process modeling capabilities. This capability is very important, because in a multi-regulatory environment, controlling the complex mapping is crucial. If there is a change in corporate policy, the organization must make sure that they are still in compliance with regulations; and similarly, if there is a change in an application, the organization must be able to see which controls are affected and all the regulations and policies that are supported by those controls. Most GRCM software focuses on managing compliance processes, but more and more companies today are looking for solution software packages that provide not just compliance and risk management, but also audit management. Internal audit wants the capability to manage the audit process, not just the compliance process. A lot of the same core technologies are needed for audit management – like good document management, good workflow, and good reporting – but it’s a different view for the audit processes. Q1 2007 | www.btquarterly.com BTQ Business Trends Quarterly 59 http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.