Michael Rasmussen

Next-Generation Policy Management: Collaborative Accountability

Policy & Training Management Solutions, The GRC Pundit BlogPublished onUpdated on4 Comments on Next-Generation Policy Management: Collaborative Accountability

Policy management is a critical issue for organizations across industries and geographies and various sizes. In a time of chaos and change, organizations must get control of an enterprise’s perspective and control of what policies they have and how they are communicated.

In 2020, I am finding organizations have realized what a mess policies are in their environment. They are out of date, scattered on different portals, sites, and file shares. Policies are in different templates with different writing styles. Most organizations could not even produce a list of what all the official policies are in their organization. In a time of crisis and change, organizations are scrambling to provide consistent policies in a singular portal the reflect the brand and reinforce the culture of the organization. A culture that needs policies and assures individuals that the company is in control and is part of a broader organization when working from home or an office.

One of the key elements I see in RFPs and inquiries for policy management software, particularly among large global organizations, is the need for collaborative accountability in policy authoring, approvals, and maintenance. Let’s break this apart into the two components:

  1. Collaborative. Policy management needs to be collaborative. Multiple authors and subject matter experts provide input into policies and various regional/jurisdictional impacts of policies. Organizations want a collaborative policy authoring environment where multiple people can be working on the same policy at the same time. I can be writing the new conduct policy here in the USA, and someone else can be making edits, contributions, and comments in Singapore, and someone else can in London . . . all at the same time. What no longer works for organizations is document check-in and check-out where new or updated policies take 6 months to write and get approvals. In a time of continuous business, risk, and regulatory change, this needs to be brought to a few weeks to keep the organization agile, in control, and out of the hot waters of regulatory and legal actions. One business case I was recently advising on found that one recent policy went through 70 different reviewers, subject matter experts, and approvers. This took months and months to complete in a linear document check-in and check-out approach. Their business case is collapse this to weeks with a collaborative approach where everyone can access, comment, and edit the policy simultaneously.
  2. Accountability. Policy management needs accountability. There needs to be a complete system of record and audit trail on who did what and when to a policy. Not at the document level, but down to the section, paragraph, clause, or event word level. Full traceability of who authored, who edited, what was modified. This is supported by workflow and task to that same section or clause level, not just the document level. Perhaps I am the primary policy author of the new anti-money laundering policy. But I want to assign a task and action item to someone in Australia to review a specific wording and paragraph to ensure it meets local regulatory requirements there. I need to assign that task not just to the document, but to the exact portion of the policy I need them to look at and approve. There needs to full accountability and traceability of policy authoring, edits, comments, and actions.

Collaborative accountability in policy management goes hand in hand. They are a symbiotic relationship that supports each other. Greater collaboration requires greater accountability.

This is causing a lot of change in the policy management technology world. Many older legacy solutions allow you only to attach policy documents. Some allow for a policy authoring environment but limit you to a linear approach with document check-in and check-out that takes months to write or update a policy. Newer solutions enable collaborative accountability authoring environments that bring policy development from several months to less than a month. Collaborative accountability delivers greater efficiency (e.g., time), effectiveness, and agility to policy management.

However, the handful of solutions that are offering collaborative accountability are not all created equal. Some do this natively with the most robust features and value. Others are parading an integration with other platforms such as Office365 or GoogleDocs that limit the collaborative accountability benefits, particularly as they are not purpose-built for policy management.

Some important things to consider are:

  • Policy specific workflows and tasks. You want a solution that automates notifications that engage stakeholders to perform required tasks, actions, reviews, edits, comments, contributions, and approvals to the actual section, paragraph, or clause level. To point where they need to focus in the document with audit trails down to that level.
  • Full audit and versioning. You want to see all collaboration across the entire history of versions of the same document down to that section and clause level. Some jimmy-rigged solutions that integrate with Office365 do not give you full visibility into the audit trail unless you download a local copy to your locally installed software, causing issues.
  • Gap analysis. You want to ensure that the entire organization has a full view of policies and evidence of policies for compliance to provide assurances that policies are sufficient, non-contradicting, and integrate and are mapped to processes.
  • Mapping. Part of this requires that the organization can map documents and even sections/clauses of policies to other policies as well as to regulations. When one changes, it can trigger changes and review in related items.
  • Master language. You also should look for the capability to define master language elements. So if I have a clause in a policy, and I edit it, it can be reflected in other documents that reference or use that same language. Consider a Code of Conduct. You may have a statement on discrimination/racism that appears in the Code of Conduct, and if you change it you want that language changed in any associated policies that use that same language such as the discrimination policy itself, as well as procedures, manuals, and such.
  • Security. Another important consideration is the security of your environment. One global firm that I helped with their RFP left a solution leveraging Office365/Sharepoint as they found security bugs that exposed their data and users in the integration with the policy management software leveraging it.

These are some considerations among many features and requirements I am advising on in enterprise policy management RFPs. I will be talking in detail on these and other elements of policy and compliance management in these upcoming webinars:

October 6 @ 10:00 am – 11:00 am CDT  – THE FUTURE OF COMPLIANCE IS DIGITAL, CONNECTED & AUTOMATED

  • Industry experts come together online for a 30mins discussion on the future of compliance Between March and April 2020, businesses had 3,000 regulatory updates to deal with. But the compliance workload was huge even before the Covid-19 pandemic. In 2019, businesses received 200 regulatory updates a day, compared to just 10 a day in 2004. […]THU15

October 15 @ 10:00 am – 11:00 am CDT – DOJ GUIDANCE AND THE COMPELLING NEED FOR AN INTEGRATED COMPLIANCE PROGRAM

  • Compliance and ethics programs are rapidly evolving. Organizations are required to have a structured and functional compliance and ethics program that monitors compliance continuously in the context of operations, transactions, and people. A program that is no longer bound by manual processes and point in time evaluations, but one that is built on a common strategy, […]

Managing Integrity Through GRC Engagement of Employees

The GRC Pundit BlogPublished onUpdated on1 Comment on Managing Integrity Through GRC Engagement of Employees

Organizations are caught in a swirling vortex of uncertainty in risk and compliance as they strive to be bastions of integrity in the center of chaos. In the midst of a global pandemic, economic uncertainty, racial justice tensions, and employee concerns, organizations are trying to hold fast to, as well as enhance, their corporate culture. They seek to achieve corporate integrity by fostering a culture of accountability, social responsibility, and employee engagement of values from the top of the organization hierarchy down into the front lines of the organization.

“We are what we repeatedly do. Excellence then, is not an act, but a habit.” Integrity itself is not something that is written on paper, but something that is lived and breathed in the organization. 

Aristotle

Integrity is a mirror reflecting what the organization truly is. Does the mirror show an organization that . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE CONVERCENT BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]

READ MORE

How to Tie a Compliance & Ethics Bow Tie

The GRC Pundit BlogPublished onUpdated on2 Comments on How to Tie a Compliance & Ethics Bow Tie

Compliance and ethics are a growing challenge and concern in organizations.

Faced with increasing regulatory change, enforcement actions, audits and exams, and liability and exposure, compliance and ethics is in the midst of evolution and maturing. Compliance and ethics is moving from the stigma of being ‘the corporate cop’ to being the bastion of the integrity of the organization as it aims to guide culture and conduct in the context of the obligations and values. I have stated for fifteen years that the Chief Compliance (CCO)/Chief Ethics & Compliance Officer (CECO) is really the Chief Integrity Officer of the organization.

Compliance and ethics is becoming more established as its own function, with its own budget, and direct reporting to senior executives and boards of directors. In many organizations across industries, compliance and ethics is being moved out of the bowels of the legal department to operate independently, but collaboratively, with legal.

As part of this process of growing and maturing, we are seeing an increased focus on what constitutes an effective compliance and ethics program. One element that is getting a lot of attention, but also produces a lot of confusion, is the requirement to take a risk-based approach to compliance and ethics. Most compliance professionals have a history of focusing on check-lists and requirements and are unfamiliar with how to do a risk assessment.

Consider the following . . .

  • Principles/Outcome-Based Regulation. What started years ago in the UK FSA moved to the EU with their Better Regulatory Policy to strive for principle/outcome-based regulation. An approach that does not focus on prescriptive checklists of requirements but outcomes. The way one organization approaches compliance may be different from another, but it is the outcome that matters. This requires a risk-based approach to compliance, to identify, analyze, and manage the compliance risk.
  • ISO 19600:2014 – Compliance Management Systems. The international standard for compliance takes a risk-based approach to compliance and requires a compliance risk assessment to identify, analyze, evaluate, and treat compliance risks.
  • U.S.S.C. Sentencing of Organizations. The United States Sentencing Commission in their Organizational Sentencing guidelines lays out the elements of an effective compliance program for courts to use to measure the culpability and therefore penalties on an organization. It requires that “the organization shall periodically assess the risk of criminal conduct and shall take appropriate steps to design, implement, or modify each requirement set forth in subsection (b) to reduce the risk of criminal conduct identified through this process.”
  • U.S. DoJ Evaluation of Compliance Programs. The most recent update to the U.S. Department of Justice guidance on the Evaluation of Compliance Programs keeps a risk-based approach to compliance front and center. Risk is mentioned 53 times in this guidance. Specifically, “Risk Management Process – What methodology has the company used to identify, analyze, and address the particular risks it faces? What information or metrics has the company collected and used to help detect the type of misconduct in question? How have the information or metrics informed the company’s compliance program?”

In my Compliance Management by Design Workshops as well as inquiries, I am frequently asked by compliance and ethics professionals how they should manage and assess risk. Most of these professionals have a legal background and have not been trained in how to do a risk assessment. My recommendation, and an exercise I work on with attendees in workshops, is to do a bow-tie risk assessment.

I love bow-ties: both the kind you wear and the ones you use to assess risk. When most people think of risk management they think of numbers and complex models, and those are good and important. Myself, I am a visual person. My father was an accountant, my brother is an accountant, I went to law school. I like words and pictures over math. A bow-tie risk assessment provides a visual picture and assessment of risk that helps organizations think outside the box and engages both the left and right-brains. I am not downplaying the numbers side, that is still important and bow-ties can and do tie in the quantified analysis.

A bow-tie risk assessment gets its name as it takes the shape of a bow-tie:

  • The knot is the risk. The center of the bow tie is the knot which is the risk you are evaluating. From a compliance and ethics point of view, this can be many things, so before you do a bow-tie you have to identify your risks (knots) that need to be evaluated. You can have separate knots for bribery/corruption, fraud, anti-trust, harassment, discrimination, privacy, money-laundering, and many more. The knot can be very specific, if you would like, such as the risk of bribery/corruption in a specific project or geography or it can be more general.
  • The left-side of the tie is the source of the risk. Stemming off of the knot to the left you focus on the source of the risk or the causes. What can cause bribery/corruption? What could cause harassment/discrimination? You label each cause and connect it to the knot (risk). Then you identify detective and preventive controls to place between the cause and the knot that mitigate the exposure from that event happening.
  • The right-side of the tie is the consequences of the risk. On this side, you identify the consequences/outcomes from an actual event happening. These can be regulatory fines, civil action, brand/reputation, loss of revenue, loss of employees, morale, and more. After identifying the consequences you then place detective and responsive controls to mitigate the damage and exposure of those outcomes to the risk.

There is a lot more detail I can go into here on how to do this, but it would go beyond the length of a blog to fully summarize. I am delighted to interact and discuss the benefits and use of bow-tie risk assessments. There are a range of technology solutions I cover in the market as part of my research and analysis that facilitate this format and approach to risk assessment.

Agile and Integrated Compliance: Managing Compliance in Dynamic Business

The GRC Pundit BlogPublished onUpdated on2 Comments on Agile and Integrated Compliance: Managing Compliance in Dynamic Business

Compliance is Not Easy

Organizations across industries have global clients, partners, and business operations. Adding to the complexity of global business, today’s organization is dynamic and constantly changing. New employees come, others leave, roles change. New business partner relationships are established, others terminated. The business enters new markets, opens new facilities, contracts with agents, or introduces new products. New laws are introduced, regulations change, the risk environment shifts (e.g., economic, geo-political, operational), impacting how business is conducted. As organizations expand operations and business relationships (e.g., vendors, supply chain, consultants, and staffing) their compliance risk profile grows exponentially.

The dynamic and global nature of business is challenging for managing compliance. Compliance activities managed in silos often lead to the inevitable failure of an organization’s and compliance program. Reactive, document-centric, siloed information and processes fail to manage compliance, leaving stakeholders blind to the intricate relationships of compliance risk across the business. Management is not thinking about how compliance management processes can provide greater insight. This ad hoc approach results in poor visibility across the organization and its environment.

Compliance obligations and ethical risk is like the hydra in mythology—organizations combat . . .

[the rest of this blog can be found on the CURA website where GRC 20/20’s Michael Rasmussen is a guest author]

READ MORE

The GRC Pundit Podcast: Toni Villanen of Majid Al Futtaim

The GRC Pundit BlogPublished onUpdated on1 Comment on The GRC Pundit Podcast: Toni Villanen of Majid Al Futtaim

In this podcast The GRC Pundit of GRC 20/20 Research, LLC interviews Toni Villanen of Majid Al Futtaim to discuss #riskmanagement #ERM #ORM #GRC – where it has been, where it is now, and where it is going. 

In this podcast, we discuss the challenges today in risk management, how COVID-19 is changing risk management, and how organizations need to engage the front-office (first-line) of the organization in risk management. We also interact on the need for greater risk integration, aggregation, reporting, and the use of bow-tie risk assessments. 

Policy Management and Remote Work: Adapting to the New Normal

The GRC Pundit BlogPublished onUpdated onLeave a Comment on Policy Management and Remote Work: Adapting to the New Normal

The COVID-19 pandemic has changed everything. What started as a health and safety risk has had a domino impact of other risks that have resulted in changed business practices, processes, objectives, and expectations.

One critical area of impact is the proliferation and support of remote workers. Coming out of the pandemic, it is safe to say that working from home is going to remain a common practice for most organizations, and for some, a primary practice.

For me, this does not change much. I have been working from a remote home office for going on 25 years. I work best from home, but, this is not the case for everyone—for many, remote working is very new and confusing.

Corporate policy confusion

One area of confusion is corporate policies. Over the past three months of quarantine, I have talked to dozens of organizations that are struggling with policy management. As they aim to . . .

[The rest of this blog can be found on the Workvia blog where GRC 20/20’s Michael Rasmussen is a guest blogger]

READ MORE

GRC Pundit Podcast: ING GRC Orchestrate Project

The GRC Pundit BlogPublished onUpdated onLeave a Comment on GRC Pundit Podcast: ING GRC Orchestrate Project

In this podcast The GRC Pundit interviews Ian Hollowbread and Mukund Umalkar of ING to discuss the future of GRC technology and their GRC Orchestrate Project.

I have a dream. It is futuristic, but realistic. It involves a Star Trek chair and a bank of monitors. It would involve tracking the global flow of funds in close to real time, in much the same way as happens with global weather systems and global internet traffic. Its centerpiece would be a global map of financial flows, charting spill overs and correlations.

Andy Haldane, Bank of England Chief Economist

Take this quote from Andy Haldane of the Bank of England and replace ‘flow of funds’ with ‘risk and compliance’ and you have the exact concept of what ING Labs is architecting with their GRC Orchestrate Project led by Ian Hollowbread and Mukund Umalkar.

Orchestrate is intended to operated as a new entity, offering the market a RegTech platform similar to an ‘App Store’ to both find and consume pre-validated RegTech solutions; in addition providing a technology framework for these solutions to connect seamlessly across each other and alongside existing legacy architecture. Orchestrate aims to remove unnecessary complexity in a world of constant change, support digital transformation and help deliver ‘end-to-end’ enterprise compliance.

Their key design principles of Orchestrate are:

  • Customers – open and accessible, client centric design principals
  • Culture – user experience first, agile and change resistant
  • Connection – modular thinking, simple and homogenous, ecosystem agnostic

Want to learn more? Listen to this episode of The GRC Pundit Podcast as The GRC Pundit interviews Ian Hollowbread and Mukund Umalkar on this fascinating project . . .

LISTEN TO PODCAST

Next Generation Corporate Compliance & Ethics Architecture

The GRC Pundit BlogPublished onUpdated on3 Comments on Next Generation Corporate Compliance & Ethics Architecture

Compliance and ethics have become a critical challenge in organizations around the world. Faced with growing regulatory change increased enforcement actions, and a greater focused on the social responsibility and accountability of organizations, compliance and ethics management has become a front and center issue. Compliance and ethics departments are grappling with the challenges of conduct, bribery and corruption, insider trading, anti-trust, harassment, discrimination, privacy, and more. They need a coordinated strategy and process supported by an integrated information and technology architecture.

Recent developments, such as last month’s Department of Justice Evaluation of Compliance Program Guidelines, are putting greater emphasis on having robust insight, reporting, and analytics of compliance. Compliance and ethics departments have been plagued with manual processes encumbered by documents, spreadsheets, and emails. One organization that GRC 20/20 talked to was spending 200 employee hours to build an annual report on compliance. That is not managing compliance, that is reacting. Compliance and ethics issues that started eleven months back did not get contained and the organization was not aware of the issue for months later.

The other challenge is that too many compliance and ethics departments are buying point solutions that focus just on one small problem and do not integrate to manage an overall compliance and ethics program. It is not uncommon to see an organization with manual processes as well as a range of point solutions deployed for managing niche aspects of compliance such as conflicts of interest, gifts and hospitality, and more. Having a bunch of software solutions that do not integrate leaves the organizations blind to insights and interrelationships of compliance risk and exposure.

Organizations need to start approaching corporate compliance and ethics through a strategy that delivers an integrated information and technology architecture of compliance. Where the organization can mine and report and see relationships between hotlines, cases, policies, assessments, forms, approvals, training, and due diligence. If these activities are siloed and manned in manual processes or point solutions that do not integrate the organization is going to be blind-sided with issues, never find and get to root problems, or spend a massive amount of employee time trying to manually reconcile information to uncover relationships and root causes to be addressed.

Today’s compliance and ethics program needs a next generation information and technology architecture that delivers:

  • Engagement. Compliance is not about the back office of corporate compliance and ethics, but it is about the front-office. The organization needs a strong compliance and ethics portal, a singular portal, that delivers policies, training, issue reporting, compliance-related forms, communications, and reminders to employees (and relevant third parties). There should be one view for individuals to access all of this and not scattered point solutions.
  • Obligation management. The organization needs a systemized and organized way to define, manage, and monitor all of their compliance and ethics obligations. This includes laws, regulations, contractual commitments, ethical principles, social accountability, and more. Consider that global financial services firms alone are dealing with over 200 regulatory change events every business day. Organizations need a way to document new and existing obligations and manage those as they impact policies, training, assessments, cases, and more.
  • Assessments. Organizations need a streamlined approach to manage compliance and ethics assessments. This includes self-assessments, checklists, quizzes, surveys, workpapers, and questionnaires. These are used by both the back-office of compliance and ethics management as well as the gathering information from all levels of the organization to assess compliance.
  • Compliance risk management. There is greater pressure on organizations to show how they have identified, analyzed, addressed, and monitored compliance risk. The organization today needs compliance risk technology to identify and assess risk. There needs to be a central inventory of compliance risks and detailed assessments and analysis of these risks. The best risk management methodology for compliance risk assessments are bow-tie risk assessments (I will be blogging on How to Tie a Compliance Bow-Tie in the next few weeks).
  • Policy management. Policies are the center of compliance and ethics. Everything relates back to policies. In the new DoJ guidance, policies were referenced over 30 times throughout the document. Organizations have to have structured approaches to inventory, develop, manage, monitor, communicate, and maintain policies. This requires defined workflows and notification capabilities. Many organizations are looking for collaborative policy authoring technologies to allow multiple roles to work on the same policy at the same time and see changes and comments in real-time without document checkin and checkout. These policies need to be accessible to individuals in a portal (back to engagement above). Many compliance and ethics departments are now leading a cross-organization strategy in enterprise policy management to ensure every policy is managed and maintained consistently.
  • Training management. Linked to policies is training management. Training is done on policies. I do not think you will find any compliance and ethics training that is disconnected from a policy. As a result, organizations are looking for solutions that integrate policy and training management into the same portal. Where employees can read a policy and take the training in the same portal and interface without jumping to different systems. There is also a need to be able to manage compliance communications and campaigns that might bundle elements together, and manage the communications and activities over the calendar year.
  • Compliance forms and disclosure management. Compliance has tons of forms. Forms that have to be filled out by individuals and routed for review and approval/disapproval. Forms such as conflicts of interest, gifts and entertainment, and more. These are often referred to as disclosures, but forms can be more than that. This is an area where organizations make mistakes and purchase siloed solutions. They should be looking for an overall integrated solution that allows for the creation and management of the range of compliance forms and disclosures. These also connect with policies and training, as well as hotlines and issue reporting.
  • Issue intake. The organization has to have the ability to intake and process compliance and ethics issues. This is a range of intake from hotlines, anonymous web reporting, customer complaints (and other complaints), and management reports. The organizations needs structured forms and processes to intake issues and filter these into a review and triage process to identify cases that need to be responeded to.
  • Case management. Investigations are a key function of compliance and ethics professionals. The organization has to have structured and documented investigations on how a case was reported, investigated, and resolved. This is a critical piece of a strong compliance and ethics architecture, and information from cases should cross-reference and identify where assessments were missed, policies were violated, training not effective. Insight into issues and cases provides critical information to address the whole compliance and ethics program.
  • Third party management. The modern organization is not-defined by brick and mortar business and traditional employees. It is a complex web of supplier, vendor, outsourcer, service provider, consultants, contractors, temporary workers, brokers, agents, dealers, and intermediaries. Compliance and ethics issues within third parties are the issues of the organization. This requires structured compliance and ethics process from onboarding, ongoing monitoring, and offboarding of third parties with due diligence, assessments, policy attestations, training, and issue reporting.
  • Regulatory exam and audit management. Compliance regularly comes under the scrutiny of external audits and regulatory exams. A key piece of a compliance information and technology architecture is the management and documentation of audits and exams.
  • Reporting, analytics, and dashboards. The key focus for many right now is the ability to have real-time insight and reporting into compliance and ethics management. The recent DoJ Guidance specifically challenges organizations on this capability. Strong reporting and analytics requires an integrated information archicture that can see across all of these areas listed here and see the complex relationships between them. Organizations need 360° situational awareness of compliance and ethics across all of these areas. This cannot be achieved with manual processes or siloed applidaitons for compliance.
  • Compliance program and project management. Compliance and ethics is challenging. There are a lot of assessments, changes, and things to monitor. The compliance and ethics department needs an overall command and control center to see all the compliance projects, tasks, assessments, and activities. To manage compliance personnel and see their workload and specialities. Identify who can address a new development or issue. When the organization is in the midst of significant change, such as mergers and acquisition, to be able to manage this change as an overall project with tasks, activities, deadlines, and overall dependencies.
  • Evidence trail. Compliance today has to be more that well written policies and fiction. Compliance and ethics needs to be a reality. Regulators, law enforcement, opposing counsel in a lawsuit, auditors . . . they want you to demonstrate compliance. Organizations need structured and defensible records of all compliance activities and interactions. Documents, spreadsheets, and emails do not deliver this – you can manufacture records with documents, spreadsheets, and emails. Defensible audit trails and system of record that can stand up in court wint non-repudiation are what is needed today.
  • Mobility. We started with engagement, we will end with engagement. Mobility is a key aspect to all of this. Compliance interfaces for policies, training, forms/disclosures, issue reporting are all needed on smartphone and tablet interfaces to engage employees wherever and whenever they are at.

There is a lot more that can be added to this, and each of these areas listed has a whole range of requirements that are needed in today’s compliance and ethics function. This is just a summary to paint the big picture. A big picture that should indicate that compliance and ethics processes need to be approached strategically with an integrated information and technology architecture. The organization approaching this in manual processes or siloed solutions that do not integrate are headed toward the INEVITABILITY OF FAILURE.

GRC 20/20 is a research and analyst organization that specializes in evaluating and understanding the range of governance, risk management, and compliance solutions available in the market. If you have questions on compliance and ethics strategy, process, and technology in your organization . . . use our complimentary inquiry form to ask us your question as we objectively cover what is available across the market and what differentiates different players. Our focus and experience specializes in corporate compliance and ethics. Solution and service providers can request a briefing to update us on their solution.

Upcoming Webinar . . .

July 30 @ 10:00 am – 11:00 am CDT 

Why Policy Management Matters

Online Webinar

Policies set the standard for acceptable and unacceptable conduct by defining boundaries for the behavior of individuals, the operation of business processes, and the establishment of relationships. When an organization fails to establish strong policies, the organization quickly becomes something it never intended. Good policies define the organization’s governance culture and objectives. Without the guidance provided by well-written and effectively managed policies, corporate culture may morph and take […]

At the Cross-roads: A Tale of Four Third Party GRC/Risk Management Roads to Travel

The GRC Pundit BlogPublished onUpdated onLeave a Comment on At the Cross-roads: A Tale of Four Third Party GRC/Risk Management Roads to Travel

The naturalist John Muir stated, “When one tugs at a single thing in nature, he finds it attached to the rest of the world.” This not only applies to nature but also to the reality of the Extended Enterprise in today’s complex and interconnected world. What seems to be one third-party risk cascades and interconnects with a variety of other third-party risks and relationships.

Recently I was talking to a global automobile manufacturer on their third-party risk program. Their challenge was that they need a fully integrated view of third-party risk. Over half of their operations are no longer defined by brick and mortar walls and employees, but is an array of suppliers, vendors, outsourcers, service providers, contractors, consultants, and more. These third parties work on and are part of internal processes and transactions that employees traditionally filled. When it came to governing and managing risk in these relationships, they felt exposed as they did not have a holistic view of third-party risk. Different departments –– IT security, procurement, legal, compliance, and others – each had their individual view of risk, but no one had the complete or aggregate view of risk in any relationship. 

Organizations today need a holistic 360° view into third-party risk to be able to see the aggregate view of risk in any one relationship as well as across relationships. The challenge is they often select the wrong technology architecture to support an integrated view of risk . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE ARAVO BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]

READ MORE

Driving Efficiency into Compliance & Ethics Processes: Time Saved = Money Saved

The GRC Pundit BlogPublished onUpdated onLeave a Comment on Driving Efficiency into Compliance & Ethics Processes: Time Saved = Money Saved

Managing compliance and ethics has become a complex web of processes and information. The modern organization is constantly changing: new employees, shifting employees and responsibilities, evolving business processes, new and changed regulations/obligations, growing ethical concerns, and greater scrutiny from stakeholders, customers, law enforcement, and regulators.

The challenge of compliance and ethics grows more confusing when you look at the scattered approaches and departments. An organization may have a Chief Ethics and Compliance Officer (CECO), but compliance can be scattered. The CECO may be focused on code of conduct, anti-trust, anti-bribery and corruption, conflicts of interest, and more. But other departments have their compliance concerns and approaches such as human resources, information security, privacy, quality, environmental, health and safety, and more.

At the core, there are very similar processes for compliance assessment, issue reporting and hotlines, policy and training management, and case management . . . but each . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE CONVERCENT BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]

READ MORE