The Board’s Role in Leading and Enabling GRC
Gone are the years of simplicity in business operations. Exponential growth and changes in risks, regulations, globalization, distributed operations, competitive velocity, technology, and business data encumber organizations of all sizes. Keeping business strategy, performance, uncertainty, complexity, and change in sync is a significant challenge for boards and executives, as well as management professionals throughout all levels of the business.
GRC (governance, risk management, and compliance) by definition starts with the G for governance. Because of the board’s role in corporate governance, one would think that GRC is a board-driven strategy and initiative. However, the opposite is most often the case. It is the R for risk management and C for compliance that drive most GRC initiatives – and fail to engage senior executives and the board who ultimately have fiduciary obligations for all aspects of GRC.
Understanding GRC in Context
Let’s unpack GRC to provide context to what it truly is. GRC as detailed in the OCEG GRC Capability Model drives Principled Performance. It is a capability to reliably achieve objectives [GOVERNANCE], while addressing uncertainty [RISK MANAGEMENT], and act with integrity [COMPLIANCE].1 The flow starts with governance which provides context for risk management and compliance:
- Governance – reliably achieve objectives. This is the governance function of . . .
[THE REST OF THIS ARTICLE CAN BE FOUND ON THE DILIGENT BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]