Tag: GRC Innovation Awards

2014 GRC Technology Innovation Award: MetricStream Offers Capability to Actively Deliver GRC Content from Multiple Sources

The GRC Pundit BlogPublished on1 Comment on 2014 GRC Technology Innovation Award: MetricStream Offers Capability to Actively Deliver GRC Content from Multiple Sources

The 2014 GRC Technology Innovation Awards was filled with competition.   Nominations increased to 62 over last year’s awards, and fifteen winners were selected.  GRC 20/20 looked through all of the submissions, asked for clarification where needed, and selected15 recipients that demonstrated outside the box thinking in taking GRC in new directions to receive this year’s award.

MetricStream Offers Capability to Actively Deliver GRC Content from Multiple Sources

MetricStream’s GRCIntelligence.com is an innovative cloud-based content portal that enables GRC professionals to access and integrate the latest GRC content from a variety of knowledge providers and information sources through a single online content store – GRCIntelligence.com.  GRCIntelligence.com makes curated intelligence available to all users within the enterprise adding significant value and increasing the effectiveness of the GRC program within the organization. The portal is integrated with MetricStream GRC Platform, thus providing subscribers with content updates and notifications directly within the MetricStream GRC application.

GRCIntelligence includes:

  • Curated content store. The GRCIntelligence.com portal serves as a one-stop shop for curated intelligence sources from partners and domain experts across industries for all GRC needs.
  • Direct delivery model. Automatically delivers subscribed content from the GRCIntelligence.com content store into the subscriber’s MetricStream GRC application through the GRCIntelligence application.
  • Content recommendations engine. Content recommendations engine within the MetricStream application based on user activity and social profiles.

GRCIntelligence.com enables GRC practitioners across the enterprise to purchase contextually relevant GRC content via credit card or purchase orders and have the content delivered automatically into their MetricStream GRC application for immediate use. This paradigm shift enables organizations to source and integrate GRC content from multiple sources across risk, compliance and audit with their MetricStream GRC applications in real-time. It also allows content updates to be notified to end-users via RSS feeds, system alerts or email.

The GRCIntelligence.com portal currently offers content from more than 50 content partners and sources including Unified Compliance Framework (UCF), Risk Spotlight, Shared Assessments, Code of Federal Regulations (CFR), and Clear Market Practices, and is adding new content partners and sources to its portfolio. A subscriber can choose from a range of content sources including regulatory updates, risk and control libraries, policy updates, market intelligence, and news feeds to receive periodic updates. The portal allows users to identify relevant content by leveraging features such as capability to filter results by content type, industry, role, and function with an intuitive and user-friendly interface.

The content is delivered into the subscriber’s MetricStream GRC application through channels that are setup in the GRCIntelligence application layer within the client installation of MetricStream. Once the content is in, MetricStream users have the capability to review the content, identify internal action items, log issues, trigger workflows, and notify users. The incoming content is stored in the Big Data store within the MetricStream client application and it can be selectively pushed into operational data store within MetricStream applications.

To learn more about the GRC 20/20 2014 GRC Innovation Awards and other recipients, please visit this post: GRC 20/20 Announces 2014 GRC Innovation Award Recipients

2014 GRC Technology Innovation Award: ngCompliance’s Sherlock Makes Regulatory Change and Policy Management ‘Elementary and Deductive’

The GRC Pundit BlogPublished onLeave a Comment on 2014 GRC Technology Innovation Award: ngCompliance’s Sherlock Makes Regulatory Change and Policy Management ‘Elementary and Deductive’

The 2014 GRC Technology Innovation Awards was filled with competition.   Nominations increased to 62 over last year’s awards, and fifteen winners were selected.  GRC 20/20 looked through all of the submissions, asked for clarification where needed, and selected 15 recipients that demonstrated outside the box thinking in taking GRC in new directions to receive this year’s award.

ngCompliance’s Sherlock Makes Regulatory Change and Policy Management ‘Elementary and Deductive’

ngCompliance’s innovation is the ability to automate the analysis of regulatory changes against the organizations policies and procedures. The solution is called Sherlock and it makes regulatory change management and mapping elementary and deductive.  Sherlock has a rule-mapping module that allows the organization to create a mapping between applicable laws and regulations on one hand, with the organizations policies, processes and procedures on the other hand. This mapping can be used to demonstrate whether the organization operates in line with regulatory requirements and it can disclose gaps. Whenever there is a regulatory change, it can be used to quickly identify the impact on business areas, policies and procedures and initiate a change management process to timely realign. Amazingly, the system does so cross lingual that allows the organizations to map and analyze policies written in other languages, for example Chinese against regulations written in English.

This automates what has historically been a manual process of cross-referencing policies to regulations within GRC solutions or within documents and spreadsheets to prove to regulators that all policies and procedures are in line with rules and regulations. ngCompliance’s innovation significantly reduces the manual work as initial mapping is generated by their Sherlock system. The mapping should be reviewed by subject matter experts, but it significantly reduces the work of building mappings manually.

Organizations that adopt this innovation, no longer need to allocate this task to a big workforce. This allows for reduced cost and time spent in administrative activities of compliance, regulatory change, and policy maintenance. Once Sherlock creates a mapping, it allows the user to evaluate the mapping and confirm correctness or make adjustments. Any time there is a regulatory change, the system submits to the user an impact analysis on which policies or steps in procedures are impacted. Because the user sees both the policy text as the related legislation or regulation changes, the user can immediately give the appropriate advice on the required changes and start necessary change management workflows.

As the regulatory mapping functionality can also be used to verify norms against contracts, the system can also be used to identify the most high risk contracts and pull those up, in combination with analytics analyzing the risk in third party relationships, it will alert on high risk third parties that need review and facilitate mitigating controls on the relationship (e.g. change management on the contract).

The system reads the regulation and analyzes the text. Based on text-analytics, definitions based on financial and legal terms are extracted from the article and converted into a tree representation. The same is done on paragraphs of policies and steps of procedures. Because they are converted back to a definitions structure it takes into account synonyms and differences in languages. A mapping engine compares the definition trees and builds appropriate connections between legislation/regulation text and policy/procedure text. When employees look at policies they are able to also see the related regulations. The context that is built during analysis of texts is used to make sure the connections match the contexts, e.g. articles applicable to organizations with a banking license are only shown once the process is within the organization of a bank.

Sherlock keeps track of all history that can be used to look back in time and verify alignment of organizational procedures with applicable legislation and regulation. In this way it is easy to demonstrate the level of compliance of the organization at any given moment in the past. Sherlock comes with a unique feature that can create the initial mapping from rules to internal policies and procedures, regardless of the number of jurisdictions it has to take into account or the number of languages it has to deal with. This way Sherlock contributes to a significant decrease of the organizations administrative burden.

The Sherlock solution allows for adding web locations that are used by regulators or other organizations that publish regulatory information, in addition to your normal regulatory feeds. The synchronization functionality ensures that the regulatory information stored in the database is always accurate without the need to maintain this manually. In addition, a historical trail on the regulatory developments is maintained. Any information that is found on the web and seems to be of relevance for Compliance can be included in the legal framework, either by means of the synchronization functionality or the quick-browse-and-add feature of Sherlock. When any regulatory change enters the legal framework in Sherlock, or when the legal framework detects a change from a regulator’s site it is monitoring, the solution will notify this to the user according to specified needs on the dashboard, in the task inbox, by email or compliance wiki. The solution can filter and sort on relevance, and can even distribute to different users based on jurisdiction, language, topic or expertise.

To learn more about the GRC 20/20 2014 GRC Innovation Awards and other recipients, please visit this post: GRC 20/20 Announces 2014 GRC Innovation Award Recipients

2014 GRC Technology Innovation Award: True Office Engages Employees Through Interactive GRC Learning Experience

The GRC Pundit BlogPublished onLeave a Comment on 2014 GRC Technology Innovation Award: True Office Engages Employees Through Interactive GRC Learning Experience

The 2014 GRC Technology Innovation Awards was filled with competition.   Nominations increased to 62 over last year’s awards, and fifteen winners were selected.  GRC 20/20 looked through all of the submissions, asked for clarification where needed, and selected15 recipients that demonstrated outside the box thinking in taking GRC in new directions to receive this year’s award.

True Office Engages Employees Through Interactive GRC Learning Experiences

Impacting and driving true learning to the employees/consultants/partners of major firms around compliance and risk management is the “last mile” of GRC. The missing link in organizational training is two-fold: 1), are people truly learning, and 2), how do you measure not only the learning, but the potential risk to the organization if complex policies are not understood. After considerable investment is made in managing risks and controls, it is important that an organization’s work force — the front line of the business — is able to learn the policy and its effect on the company’s business outcomes in order to ‘walk the walk’ on a daily basis.

True Office is demonstrating innovation in impactful, gamified training solutions applied to compliance & risk management, professional development and customer proficiency. True Office, because of its ability to bring dry policy to life, engage learners and measure their efficacy through rich, comprehensive analytics, and is paving the way for a new era of Policy & Training Management.

True Office’s current focus enlarges their overall scope to bring greater satisfaction through “content transformation” of existing client content based on four interactive learning frameworks. A customer engagement may consist of training on topics such as Anti-corruption, Workplace Harassment and Data Privacy. However, clients also possess their own unique policies and processes which True Office is able to bring to life, through an impactful experience, in which employees that must execute these policies can truly learn.

The solution offers proof that improved efficacy is actually happening as well as highlight the “hot-spots” requiring additional learning and development.

The True Office solution has already seen a “real-world” application with characteristics of over 90,000 users, 12 languages, and multiple industries. Modules are designed to encompass 10-20 minutes across True Office’s 4 Interactive Learning Frameworks. Based on the learning framework and corresponding business outcome, the learner will be placed in different situations where “they” take an active role in the learning—through dialogue, trend analysis, making decisions, or answering questions. By interacting with the module, the underlying analytics indicate their level of understanding of the policy.

True Office is a cloud-based software solution, compatible with a client’s own Learning Management System (LMS) interfacing with the True Office Analytics server. Individual users are presented a web-based login either on their desktop/laptop computer or through HTML5 via an iOS device (e.g., mobile or tablet).

To learn more about the GRC 20/20 2014 GRC Innovation Awards and other recipients, please visit this post: GRC 20/20 Announces 2014 GRC Innovation Award Recipients

2014 GRC Technology Innovation Award: UCF Demonstrates it is the Science of Compliance Through its Most Recent Patent

The GRC Pundit BlogPublished on1 Comment on 2014 GRC Technology Innovation Award: UCF Demonstrates it is the Science of Compliance Through its Most Recent Patent

The 2014 GRC Technology Innovation Awards was filled with competition.   Nominations increased to 62 over last year’s awards, and fifteen winners were selected.  GRC 20/20 looked through all of the submissions, asked for clarification where needed, and selected 15 recipients that demonstrated outside the box thinking in taking GRC in new directions to receive this year’s award.

UCF Demonstrates it is the Science of Compliance Through its Most Recent Patent.

The Unified Compliance Framework has recently received a patent for its applied technology for the structure, process for interpretation, quality assurance, and most particularly the segmentation and mapping of regulations. The UCF has been around for several years; the innovation recognized is their recent patent, process, and schema for segmenting and mapping regulations that will take the UCF well beyond the focus of IT compliance they have been successful with in the past. The solution will be delivered to vendors and corporate customers in the way of a RESTful API, XML tables, and interactive applications.

The Unified Compliance Framework has received the first ever patent for a compliance requirement segmentation and mapping framework. The patent was granted rapidly as the US Patent and Trademark Office stated that there has been nothing like it filed. This means that the UCF is the only GRC framework that has patented SNED values that can instruct GRC solutions as to which records are the Same, New, Edited, and Deprecated by using a single character to manage regulatory and requirement change.  This is supported by an end to end process that reaches from the Authority Document (AD) on one end, through the Authority Document’s Citations, to harmonized Common Controls, and out to Audit/Assessment Questions with supporting evidence. The UCF has a hierarchical structure wherein a parent and sort value can be assigned to any hierarchical record. This allows GRC solutions to plug into the UCF and automatically be able to display a list in original form, replicating legal or even “book” structures of original regulatory/requirement documents. GRC solutions utilizing UCF will be able to automatically discern how to handle audit questions and the necessary “skip logic” used when presenting hierarchical audits. Further, the schema allows for the breaking down of Citations and Common Controls into primary verb-noun pairs to “prove” the mapping of the Citation to the Common Control.

The business functionality is simple: any organization building out a GRC database or GRC solution can leverage the UCF’s patented structure to jump start their GRC strategy. There are already other firms such as Accenture that are now filing derivative work patents on top of the UCF’s patent.

To learn more about the GRC 20/20 2014 GRC Innovation Awards and other recipients, please visit this post: GRC 20/20 Announces 2014 GRC Innovation Award Recipients