GRC Journal - (Page 84) Hand In Hand FEATURE SCHEDULING REUSE OF INFORMATION DEFINITION Ability to schedule and track risk and control assessments Governance, risk & Compliance Features that support the reuse of information already gathered through previous assessment to relieve the burden on the business Capability to notify individuals when they have assessment tasks Defined abilities to manage the status and progress of assessments Automation of control status information and enforcement directly into IT systems and business processes Direct links into audit management systems to support the role of audit and audit findings within the system Source: Forrester research COMMUNICATION WORKFLOW & PROCESS MGMT. BUSINESS RULES AUDIT MANAGEMENT systems to integrate more intelligence capabilities to monitor new developments. In the compliance world, this means profiling the regulatory/legal environment and tapping into legal intelligence services to identify new court rulings, laws, and regulatory changes. Shifts in risk and new regulations will kick off a process to review the impact on the organization and propose potential changes of controls; in the risk world, firms will need GRC software platforms that help them identify economic, environmental, or political events that may affect business processes. Risk analytics and visualization – The majority of the vendors in the GRC market have not focused on the mathematical models and engines that can do complex risk simulation. Thus, they’ll need to acquire specialist vendors. Financial services customers will be first to demand sophisticated risk analytics, but others will follow. Risk visualization and dashboarding technologies are also hot areas that will differentiate vendors over the next few years. Business rules engines – Successful GRC requires integration into business processes. For the next five years, customers will want risk and compliance features incorporated into business logic/rules engines to enforce controls and route process events given specific risk and compliance scenarios. Both business process management and business rule engine vendors will profit as the market moves in this direction starting in 2007. Enterprise integration – Finally, the GRC software platform needs to extend to enterprise systems and applications. Enterprise vendors like SAP and Oracle are seeing this trend and are defining their GRC strategies. Because enterprise applications drive business processes, GRC software must integrate with these systems so that it can collect information and automate GRC controls and processes. GRC Software Platform Revenues Will Rise to $1.3 Billion in 2011 The primary drivers for GRC software growth have been SarbanesOxley, Basel II and other regulations, as well as firms’ focus on developing enterprise risk management programs to deal with diversified and distributed business risks. The GRC software platform market will continue to grow steadily over the next four years in further response to risk and compliance pressures around the world. Forrester expects the market for GRC software platforms to climb to $590 million in 2006, and we predict that it will reach $1.3 billion in 2011. If enterprise risk and compliance management becomes a defined business process within most firms, this estimate will prove conservative. We will see high growth in 2007 and 2008. As companies put in place their long-term GRC solutions, Basel II kicks in and risk management really starts to take hold in large enterprises. The GRC market will grow explosively in 2007 and 2008 and will start to plateau around 2010. Future growth will hinge on firms migrating to integrated views of risk and compliance. The early years of this market focused on a single point of pain such as environmental health and safety, but the aggressive growth will come from enterprise risk and compliance. Average deal sizes will continue to grow as organizations expand their implementations to cover broader risk and compliance domains. The broader risk and compliance market is huge. This forecast focuses on the GRC software platform market that we defined in this document. However, there are many other areas of risk and compliance. Overall risk and compliance spending on software is several factors greater than what is measured for GRC software platforms alone. Risk management – if done right – relates closely with business performance. Further, compliance is really about selecting the right level of controls, not just to meet requirements, but also to manage business operations. As GRC takes hold in organizations, there is a potential trend for greater GRC software platform growth if it delivers on the business performance message. The net effect of this would be to increase the growth rate for GRC software platforms and keep the curve from flattening in 2010. michael rasmussen forrester research MICHAEL RASMUSSEN is a Vice President and Analyst in Forrester’s Security & Risk Management research group. With more than 12 years of experience, he is considered one of the foremost authorities in understanding the broad view and impact of risk and compliance standards, regulations, and legislation. He advises clients around the globe on issues pertaining to enterprise risk and compliance management in distributed and dynamic business environments. 6 Business Trends Quarterly Technology Solutions. Business Strategy.
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.