Employee Engagement in the Context of GRC: Bringing GRC to the Coal-Face
Governance, risk management and compliance (GRC) are a part of everyone’s job. Too often we shovel GRC into the bowels of the organization thinking it is the responsibility of the obscure and behind-the-scenes individuals in the back office of the organization. This misperception is a critical issue organizations must address. The most significant exposures to risk and compliance issues are not in the bowels of the organization, they are at the front lines. They are at all levels of management and business operations. They cross partner, vendor and supplier relationships throughout the extended enterprise.
The user experience for GRC has been typically poor in most organizations, resulting in time-consuming and redundant processes, a check-box mentality and lack of central coordinated efforts for GRC communications. Organizations have ended up with multiple sources of policy, training, surveys, assessments and issue reporting hotlines. Interaction with these systems has consumed human and financial capital. Interaction is often inconsistently logged in documents and spreadsheets, if they are logged at all. There is no coordination of GRC communication and no way to prioritize messages and employee tasks. The result is emails and documents that fly about, slip through cracks, are never responded to, or are simply forgotten.
GRC is not just for back-office risk experts. For GRC to be successful, organizations must engage employees. It is no longer good enough to just have well documented policies and controls. Organizations must demonstrate GRC is active and operational across the organization.
GRC processes and technology can be contrasted with the past experience of employees to the present needs that build the future of GRC:
- Past GRC approaches offered disconnected systems where an employee gets an email about a new policy, clicks on a link to go to the policy and read it in a text-heavy interface, then has to click on a link to take training on another system, and then has to link to a survey to test their understanding, and in all of this there are no places provided to ask questions or find other relevant resources. GRC for the average employee of the organization has been confusing and disconnected from what they do.
- Present into the future of GRC is about integrating technologies and content to deliver an engaging experience that is interactive and connected. Where an employee clicks on the new policy and the training is delivered right in the same interface with the policy actually embedded into the same page as the policy flows around it. Other interactive content is delivered such as games that illustrate the policy.
The bottom line: GRC is only as good as your front-line understanding, participation and alignment with GRC. It is no longer enough to have the right GRC documentation; you have to show it is operationally effective. This requires employee engagement in GRC. This involves bringing GRC to the coal-face. The term coal-face is a term the British use to define frontline operations of the organization. It comes from miners deep in mineshafts at the coal-face harvesting coal. Every organization has a coal-face — the front line employees engaged in business operations. To maintain integrity and execute on strategy, the organization must be able to engage GRC in the context of its coal-face.
GRC solutions in the enterprise should deliver an exceptional end-user experience: getting employees involved by providing intuitive interfaces into GRC that are interactive, engaging and social. GRC solutions need to instruct, inform and be easy to use at all levels. It engages employees in GRC without leaving them overwhelmed and confused. Employee engagement happens through:
- GRC intuitive interface design: GRC is using leading concepts in interface design to make user experience of GRC applications simpler, easy to navigate, aesthetically appealing and minimizing complexity.
- GRC socialization and collaboration: GRC collaboration and socialization is used to conduct risk workshops, understand compliance in the context of business and get individuals involved in GRC at all levels of the organization.
- GRC gamification: GRC gamification is used, where appropriate, through interactive content and incentives to drive the culture of GRC into decision-making.
- GRC mobility: GRC is embracing mobile technology on tablets and other devices to engage employees in their preferred languages and bring GRC to all levels of business operations.
The result: Backend management and oversight of risk and compliance is still needed, however the frontend user experience is dramatically improved to engage employees and stakeholders to ensure they are connected to GRC in the context of their role and responsibilities. For GRC to provide value, employee engagement is critical, not optional.
It has been stated that:
Any intelligent fool can make things bigger, more complex and more violent. It takes a touch of genius – and a lot of courage to move in the opposite direction.[1]
A primary directive of GRC is to provide GRC engagement that is simple yet gets the job done. Like Apple with its innovative technologies, organizations must approach GRC engagement in a way that re-architects the way it works as well as the way it interacts. Simplicity is often equated with minimalism. Yet true simplicity is more than just absence of clutter or removal of embellishment. It’s about offering up the right GRC information, in the right place, when the individual needs it. It’s about bringing interaction and engagement to GRC process and data. GRC interactions should be intuitive.
[1] This quote has been attributed both to Einstein and E.F. Schumacher.