GRC Journal - (Page 83) Governance, risk & Compliance Enterprise Risk Management Dashboards mfg. Finance/ Acct. human resources Supply Chain eCm BPm Bi erP Governance, Risk and Software Compliance Platforms Policies, Procedures and Controls risk and Control Assessment risk Analytics Loss, event, and investigations mgmt. Financial Risk Software Credit Capital Allocation insurance/ Underwriting market employment Legal and Litigation Operational Risk and Control Software marketing/ Comm. Tech/ Systems Financial Assurance Product/ Svc. Quality Corporate Governance health and Safety information mgmt. Sales/ ethics Business Continuity other Trading/ Transaction other Supporting Technology Infrastructure identity mgmt., change mgmt., eLearning, storage, automated/continuous controls, security, content mgmt. Source: Forrester research What can a GRC Software Platform Do? The GRC software platform is the technology heart of the GRC architecture. It provides a single system of record for defining, maintaining and monitoring governance, risk and compliance. A GRC software platform is also the “heart” that connects complex risk and compliance processes across the organization. GRC platforms create centralized systems of record for the entire business in four areas: (see chart above) 1. Policy, procedure and control documentation, maintenance and communication. Policies and controls are central to operational risk and compliance. The first thing a regulator or auditor wants to see is how the organization has defined its adherence to external requirements. 2. Risk and control assessment processes. Documentation and communication of policies and controls mean nothing if the controls are not in place and functioning – this requires workflow and collection capabilities to assess the state of controls. GRC software platforms support the gathering of information for the assessment process of risk, controls and compliance. Assessment functionality allows the organization the ability to manage control evaluation not just for a single purpose like SOX, but for other compliance purposes as well. (See Figure 2) 3. Risk analytics, modeling and reporting. Next, organizations need to analyze and report on the state of risk and controls. This allows executives, business managers, auditors and regulators to assess the state of risk and compliance. If an executive has a question about the state of risk around supply chain and logistic operations, they can use the system to view the aggregate measure of controls and incidents surrounding these processes. GRC software platforms have risk modeling, charting, graphing and dashboarding capabilities to visualize and measure risk and compliance across the organization. 4. Loss, event collection and investigations management. History repeats itself, whether as tragedy or farce, because unaided institutional memories are extremely short. To mitigate future mishaps, organizations must centrally manage investigations and aggregate corporate loss and event information. GRC platforms manage the business process of investigations and collect loss/event metrics across lines of business and corporate processes. The loss functionality allows managers to monitor the losses around and then assign appropriate and cost-effective controls to mitigate future losses. GRC Software Platform Growth Drivers Through 2011 The following four areas will be critical as GRC software technology continues to evolve and expand as the market matures: Risk and regulatory intelligence – GRC systems have the content and processes to manage current compliance requirements and today’s defined risk metrics. However, customers will need www.BTQuarterly.com Business Trends Quarterly 5 http://www.BTQuarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.