GRC Journal - (Page 71) Governance, risk & Compliance building the best brakes, steering and suspension possible for a car. Group 2 is tasked with building a racecar. Which group will develop the better brakes, steering and suspension? By pushing the performance of the vehicle, the engineering team developing the racecar will undoubtedly be forced to create controls that can handle the extreme conditions of racing. Almost all innovation in the auto industry comes from the racing programs and this is no surprise. They also excel at continuous monitoring. They know everything about what is going on at all times in these machines. It is important to note that their primary objective in this monitoring process is to be able to improve performance, not detect failure. What objectives have your teams been given? Have they been sent to design new brakes or make the car run faster or more efficiently? All of this is why some process experts don’t like COBiT. It sets out the control objectives but does not deal with performance, which is the wrong place to start. This is probably a reason why ITIL is gaining prominence. In a performance-based approach, reducing compliance costs requires taking a broader view, not narrower! Reducing the scope of compliance does not depend upon current efforts to reduce the scope of financial controls by adherence to a risk-based approach. This will definitely reduce the scope of work required to deal with internal control over financial reporting (ICFR) requirement of SOX. It will not help you deal with your broader GRC challenge. Integrating to your accounting processes through a continuous monitoring solution will also only provide a partial gain since the benefits will be limited to the financial controls. A broader view of the GRC challenge requires a broader view of where efficiency and performance gains can be found. When we take this broader view, we find that the answer lies in the business processes themselves – not just the accounting processes, but in the very processes upon which the business runs. To go back to our car analogy, a great design team will never start by trying to limit the scope of where they can improve the car. They will look for every possible nook and cranny to make improvements, and the controls will emerge naturally from that process. So narrowing scope is not the silver bullet it is currently made out to be. As a result, business process management (BPM) will play an increasingly prominent role in the GRC equation. When processes are automated, the business creates an opportunity to automate larger swaths of the business landscape and thereby create significant gains. In an August 2006 paper on GRC, Michael Rasmussen from Forrester called BPM a “sleeping giant” for GRC: “GRC platform buyers will realize the importance of BPM capabilities. As firms define their GRC organizational structures and processes, BPM vendors can capitalize on the opportunity to integrate and manage GRC within business processes…. As organizations invest in GRC software in the next few years, they will look for further capabilities to directly integrate, monitor, and enforce controls within business systems and processes.” Forrester Research, 2006 Gartner also sees the emerging importance of the BPM capability. In Gartner’s July 2006, “Hype Cycle,” BPM is positioned firmly in the “Slope of Enlightenment” phase of the cycle. “BPM takes advantage of a set of services and tools that provide for explicit process management, including process analysis, definition, execution, monitoring and administration.” Gartner Research, 2006 Many companies have implemented a solution to handle the ongoing requirement to document, test and remediate risks and controls. There is no question that in doing this, they have made improvements to these processes. The more advanced have expanded beyond the ICFR and have begun to consolidate a broader set of policies, regulations and governance frameworks. The next step will be to create a mind shift. This mind shift will force them to think about OTHER processes that can be tackled and improved to make the company better. They will look to embrace more and not less. They will realize that the best way to deal with compliance is to set out to build a world class business. The leaders of these companies will be sending their teams out to build racecars, not design brakes. steve taylor resolver STEVE TAYLOR, CEO of Resolver, has over 10 years of senior management experience in running technology firms. For the past four years, he has been instrumental in leading the risk management arena. He speaks and writes extensively on the subject of risk management, both from a strategic and an IT perspective. Prior to Resolver, Steve was the North American Vice President of Sales and Client Services for Cyberplex, a publicly traded technology firm on the Toronto Stock Exchange. www.BTQuarterly.com Business Trends Quarterly 33 http://www.BTQuarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.