GRC 20/20 has seen many organizations take an enterprise perspective on aspects of GRC, such as Enterprise Policy Management, Enterprise Third Party Management
, and, of course, Enterprise Risk Management
. Over the past 18 months, GRC 20/20 has seen a growing demand for Enterprise Case Management which involves issue reporting (e.g., hotlines, management reports, complaints) and case management (e.g., issues, incidents, cases, investigations). This is a holistic strategy to manage all issues/case types in a federated and collaborative strategy across departments. This is particularly interesting as case/issue information ties closely into and feeds metrics and data into policy management and risk management programs.
Issue reporting and case management has become a moving target which needs a structured approach supported by a strong process, information, and technology architecture. Whether unintentional issues or acts of the malicious miscreant, organizations need to be prepared and have established processes in place to manage issues as they arise in the organization. GRC professionals are challenged to get a big picture point of view of the range of issues being reported across the organization and the management of cases that impact how the organization’s “ability to reliably achieve objectives while addressing uncertainty and acting with integrity.”
The typical organization has a variety of departments managing a diverse range of issues, cases, incidents, and investigations. These issues and cases are often managed in silos of documents, spreadsheets, and emails or in home-grown databases and applications. Different departments often have diverse approaches and the organization does not have insight into the range of issues that are happening across operations. Organizations often lack a central repository for case management and the use of home grown solutions has limitations that make the issue management processes inefficient, ineffective, and burdensome to the organization. Issue reporting and case management is often a tactical and fragmented approach with highly diverse approaches taxing the business.
Issue management across the organization is often scattered across departments, such as
- Corporate security
- Ethics and compliance
- Fraud and corruption
- Health and safety
- Human resources
- Insurance claims
- IT security
- Physical security
- Third party suppliers and vendors
The breadth of silos to issue reporting and case management results in a maze of disconnected processes, reporting, and information. These are redundant, document-centric, and manual approaches that do not integrate and are highly inefficient. Different functions spend more time managing the volume of emails, documents, and spreadsheets than they actually do managing the issues themselves. The line of business is overwhelmed with inconsistent approaches to issue reporting and case management.
This fragmented approach to issue reporting and case management resembles battling the multi-headed Hydra in mythology. As the Hydra grows more heads of risk, regulation, and ethical challenges, issue reporting and case management professionals find that scattered approaches leave them exhausted and overwhelmed as they lose the battle. This results in a reactive fire-fighting approach to issue reporting and case management, with silos of data that professionals struggle to find the time to coordinate and link together manually. This piecemeal approach is inefficient, increases risk exposure, and leads to serious matters that fall through the cracks. Redundant and inefficient processes lead to overwhelming complexity that slows down the business in an environment that actually requires agility.
The document-centric, scattered, and manual processes of the past have impaled case management functions with inefficiency. Process management and reporting is primarily comprised of emails, documents, shared files, homegrown databases, spreadsheets, and manual processes. Case management professionals are spending a disproportionate amount of time collecting data and reporting on data instead of time spent adding strategic value to the business through analyzing and trending the data collected. This antiquated approach leaves teams with flat metrics that lack context and don’t help professionals identify or address problematic processes, culture, or behavioral issues. GRC professionals often express to GRC 20/20 Research their frustration with the:
- Inability to gain a clear view of issue reporting and case management interdependencies
- High costof consolidating silos of GRC and issue management information
- Difficulty maintaining accurate GRC and issue management information
- Failure to trend across issues, departments, and reporting periods
- Incapability of providing GRC and issue intelligence to support business decisions and strategic planning
- Redundant approaches that limit correlation, comparison, and integration of information
- Lack of agility to respond promptly to changing regulations, laws, and business environment
Dynamic & Distributed Business Compounds the Problem
Organizations today are distributed and dynamic. The modern organization is a complex web of employees, suppliers, vendors, contractors, consultants, agents, and third parties. At the same time, organizations are constantly changing: business is dynamic. Employees, relationships, regulations, risks, economies, litigation, regulation, and legislation are constantly changing. These challenges are making organizations rethink their approach to issue reporting and case management. Organizations are looking for greater agility and effectiveness, while achieving greater efficiency with human and financial resources in identifying and resolving issues. The goal is to:
- Align stakeholder demands for transparency and accountability.
- Leverage emerging technologies to improve efficiency, effectiveness, and agility.
- Enable GRC professionals to better target resources where issues identify the greatest exposure.
This trend points in one clear direction: a new issue reporting and case management architecture that is dynamic, predictive, and information-based through the deployment of an integrated information, intelligence, and analytics architecture to overcome the inefficiencies of the manual and document-centric approaches of the past. This approach to issue reporting and case management delivers demonstrable proof of risk and compliance management, discovery and containment of issues, and shifting the focus of efforts from being reactive and “checking the box” to being proactive and forward-looking. Organizations need greater efficiency in processing and managing issues with structured information and process, greater effectiveness in ensuring corporate integrity, and increased agility in addressing rapidly changing business, regulatory, legal, and reputational risks.
The bottom line:
Issue reporting and case management programs have been very tactical and inefficient in the past in collecting issue reports and managing cases. GRC functions across the organization have lacked an overall approach to manage issues, provide reporting and analytics, and the ability to move issue reporting and case management from the tactical approach to an integrated strategic approach that aligns with governance, risk management, and compliance strategy and processes. A centralized issue reporting and case management system saves time and money and creates an environment where the organization can measure the effectiveness and efficiencies of GRC resources.
This is the official definition of GRC as found in the OCEG GRC Capability Model.
For the purpose of this post, the term issues and cases will be used but should be understood to include incidents and investigations.
Upcoming Research Briefing On Issue Reporting & Case Management
Research Paper: Value of Issue Reporting & Case Management
Research Paper: Case Study on Issue Reporting & Case Management
Solution Perspectives: Solution Overviews in Issue Reporting & Case Management
Strategy Perspectives: Strategic Directions in Issue Reporting & Case Management