GRC Journal - (Page 61) Governance, risk & Compliance Automation of process saves money, time and resources; meanwhile, assuring that compliance standards are being met is a major concern. How can organizations find a balance between optimizing their processes and complying with regulations? Organizations should not have to choose between driving efficiency and effectiveness of compliance process and maintaining compliance with required policies and regulations. Two of the most significant areas for organizations to address in order to achieve this balance are to take a top-down, riskbased approach to their GRC initiatives and to eliminate redundant work caused by organizational silos and disparate GRC solutions. The first significant step in achieving a balanced approach to GRC is to identify the material rules, regulations and compliance activities that the organization must address. By taking a topdown, risk-based approach to the allocation of GRC resources, organizations can provide greater assurance that they are investing in those GRC initiatives that may drive the most significant loss events or costs of failure. Many organizations have been taking this path as they evolved their Sarbanes-Oxley (SOX) compliance processes. By focusing on the most material processes, risks and controls, organizations have been able to eliminate much of the busy work and costs involved in SOX compliance. By focusing resources on the compliance policies and programs that drive the most significant risks, companies are able to get the most out of their GRC resource investments. For many organizations, the most significant inefficiencies are the direct result of approaching GRC from separate organizational silos. By maximizing coordination and leverage, GRC professionals are able to limit assessment duplication and promote process, data and technology platform consistency. The technological advancements of GRC suppliers have become extremely advanced. Is there a shortage of qualified operators who can maintain the GRC platforms? Do automatic upgrades provide users with the ability to maintain their systems internally? The availability and cost of trained resources is a critical question that needs to be addressed when selecting GRC technology. Software functionality that solves GRC business problems should not require an army of trained internal resources and outside consultants to manage. In evaluating GRC solution providers, it is imperative that organizations evaluate the longterm total cost of ownership of the solution and factor in the costs of both departmental and IT administration, software and hardware costs, and the costs of maintenance and upgrades. Automatic upgrades may ease the burden of support for users to maintain their systems. However, all software that is installed on-site and that utilizes other elements in the IT infrastructure (databases, servers, operating systems) will require a certain level of IT skill and expertise to manage. Many organizations are looking for an alternative method of delivery for their GRC software and are migrating toward solutions that are delivered via the software as a service (SaaS) model. In SaaS delivery, an organization pays a monthly subscription to access software delivered over the Internet from a single application instance that is managed in a central datacenter. The SaaS delivery model has many advantages over traditional software delivery, including the freedom of no software to purchase or install and a minimization of IT hassles. Other benefits include reduced implementation times, more frequent upgrades, reduced support costs, reliable and secure delivery, and minimized up-front capital costs through subscription-based delivery. Paisley delivers holistic GRC solutions via both the traditional on-site install and SaaS delivery models. Organizations can maintain internal control while remaining susceptible to variables which are outside their realm of management. What external factors can play a role in the direction of an organization with regards to GRC practices? A common theme we hear from GRC executives is that the risks that keep them up at night are the ones that they do not know of yet. Unfortunately, there are many external factors and risks that can impact complex, global organizations ranging from geo-political, regulatory, industry or country specific policies, regulations or risks. To combat these uncertainties, companies should look for processes and solutions to support multiple regulations and compliance issues across multiple business units. Because of the dynamic nature of external factors, sustainable GRC practices will be achieved only by consolidating compliance efforts through a programmatic, rather than a project-oriented approach. A programmatic approach means that GRC practices are not treated as one discrete project after another, but rather as a sustained ongoing effort across multiple regulations and business units. Outlining the framework for a GRC system allows an organization to ensure ethical, legal and governmental standards. What are some factors that every organization should keep in mind when selecting a GRC platform? There are many factors an organization must look at when selecting a GRC platform. Companies should look for solutions to support multiple regulations. A system that provides enterprise class scalability should support multiple business units and GRC initiatives. One area that many organizations overlook in a GRC solution is a feature set that enables an effective level of oversight and assurance. The oversight and assurance role for most organizations is the accountability of the internal audit department. By selecting a comprehensive GRC solution that includes pervasive features for internal audit, companies will drive significant efficiencies and confidence that the appropriate levels of oversight and assurance are occurring. Another factor to consider is how well the GRC solution fits in the organization’s existing IT infrastructure and the willingness and ability of the organization to allocate the appropriate IT resources to support the GRC platform. Companies looking to install software on-site should look for solutions that support multiple platforms and technologies to leverage their current IT infrastructure and skill sets. Organizations that are resourceconstrained or are reluctant to redeploy existing IT resources to manage new technology should look for solutions that offer either a hosted application or SaaS delivery. www.BTQuarterly.com Business Trends Quarterly 23 http://www.BTQuarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.