GRC Journal - (Page 26) GRC: GET IT RIGHT! Governance, Risk & Compliance What is the definition of CCM? What is the role that enterprise software has in CCM? Continuous Controls Monitoring (CCM) is a “solution” that automatically monitors the effectiveness of internal controls within business processes, but I don’t think CCM does enough to address the true needs of organizations today. Companies are first trying to automate their controls, but CCM seems to assume that the company already has automated controls. And quite often companies do have automated controls – within financial ERP applications there are control settings that should be monitored to make sure they remain set properly. But there are still many companies that have financial processes extending well beyond the ERP system, and wish to automate the controls associated with these processes. This method is more or less “continuous compliance,” rather than CCM. I don’t think CCM, in and of itself, is adequate. Companies like Oracle, SAP, Approva, Oversight Systems, and others are closing the gap. However, vendors of business applications have shifted to service-oriented architectures, which represent a new challenge to compliance – and an opportunity. Any vendor designing SOA-based applications should be monitoring controls for the services at the same time they design the service. I expect SAP, Oracle, and other SOA vendors to follow this principle: no services should be designed without its control. Companies do not want to have to worry about searching for extra solutions to fix the things that are left broken by business application vendors who build applications without considering compliance in the architecture. How is the increasing focus on GRC affecting the selling and delivery strategies of these technology providers? What’s interesting in the market today is that every category of software is screaming, “We support compliance!” And to some extent, they do; we see a lot of reporting capabilities being added to software today. For example, many of the configuration monitoring and network monitoring vendors have existed for a long time, pre-SOX; but since SOX, these vendors have improved their reporting capability to stay ahead of the market. There are still only very few categories that are driven primarily by the compliance market: the finance GRCM software vendors; continuous compliance vendors; and small, niche-vendors specializing in spreadsheet management being primarily driven by concerns regarding compliance. Although there is certainly interest in things like configuration monitoring, network monitoring, business intelligence, ERP, etc. from a compliance standpoint, these components all existed pre-SOX and those markets are not being driven solely by compliance concerns. The true GRC market is composed of GRCM software, continuous compliance, and a little bit of audit and spreadsheet management. Get more insight from French Caldwell and other acclaimed Gartner analysts at the 2007 Gartner Compliance and Risk Management Summit, May 9-11, 2007 in New Orleans, LA. Visit www.gartner.com/us/risk. French Caldwell is a VP in Gartner Research, leading the compliance, governance, and risk management practice. He also writes and presents on knowledge management. His research includes analysis of the impact of regulatory developments on IT, compliance technologies, corporate governance and knowledge management. Prior to joining Gartner, French was the Director of Knowledge Services in a global consulting practice. 0 BTQ Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.gartner.com/us/risk http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.