The GRC Pundit

2013 GRC Value Award: Compliance Management

The GRC Pundit BlogPublished onLeave a Comment on 2013 GRC Value Award: Compliance Management

GRC 20/20 Research awarded The Hartford its 2013 GRC Value award in the Compliance Management category. The Hartford, a leader in property and casualty insurance, group benefits and mutual funds, uses the RSA Archer GRC Platform to support over 80 GRC processes including a New York State Labor regulation instituted in 2012.  By building a solution on the RSA Archer eGRC platform the company avoided tens of thousands of dollars in expenses, and brought The Company into compliance one month ahead of schedule. 

The Hartford, a leader in property and casualty insurance, group benefits and mutual funds, was given a short period of time to comply with the State of New York Wage Theft Prevention Act, which required employers to give an annual written notice of wages to all new hires and other employees. The employees are required to return a form acknowledging receipt of that notice, and records of the notice and the responses must be tracked to evidence compliance.

This new regulation required a new HR process, which represented a challenge for the Hartford because:

  • The short turn-around time required to develop a new process and design a new solution to address that process
  • The compliance date differed from The Hartford’s annual merit cycle but needed to use annual wage information
  • The solution had to be user friendly to address The Hartford’s diverse employee base of 20,000+
  • Other states were expected to adopt similar — but possibly not identical — regulations, so the solution had to be flexible and repeatable
  • Forms had to be available in multiple languages
  • The Hartford had limited budget and resources to build the solution

The Hartford evaluated several options including its existing payroll systems, manual mailings, or using its operation risk management (ORM) system  (RSA Archer)..  Building a custom solution on the RSA Archer Platformoffered an affordable end-to-end solution. Other optionswere estimated to cost in excess of $70,000, and still involved manual processes.

The Hartford’s HR compliance and payroll departments partnered with the ORM team and developed a solution to automate state-specific annual employee notices, monitor employee responses, automate any follow up notices to employees and management, maintain historical evidence, provide the appropriate oversight to ensure the company complied with the law, was intuitive and end-user friendly and it was completed in three months — one month ahead of schedule.

Easy migration to a new, effective solution

Using a data import feature within the RSA Archer GRC Platform, the HR data is loaded from the external data file and populated into an employee information application. Importing data through this feature saves a great deal of time and is completed quickly and easily.

The RSA Archer Platform uses a campaign feature to set a date on which acknowledgement forms are automatically created. The form contains employee geographical and wage information along with instructions to complete the form, explanation of the requirements, due date and a selection for the employee to respond. An email notification is automatically generated once the acknowledgement form is created, which contains a brief description of the process, instructions, obligations and a link to the acknowledgement form. The employee clicks on the link to access their record, review wage information and select the appropriate radio button (to acknowledge or request a notice in a language other than English, which is a NY state requirement). As soon as the employee saves the record, their response is electronically recorded, the acknowledgement stored and the process is completed for the year.

The Hartford’s first campaign touched 1,461 employees. It took just 37 minutes to create the acknowledgement forms and emails. Within the first six minutes of the launch, they had received a 32 percent response rate. If employees do not respond within given deadlines, the system automatically escalates and notifies HR employees who can help. In the two years since the process was implemented, HR received fewer than 10 questions from users about completing the process.

The Hartford estimates that with the old processes, completing the requirement would draw resources from multiple organizations and could take more than 100 hours. With the automated process, it takes about six to 10 hours over six to eight weeks.

THE NEW SOLUTION

Companies must be diligent with the ever changing regulatory environment. While a poster in the break room used to be the norm, the explosion of remote work has legislatures looking for additional ways to ensure that employees receive notice. States are more frequently requiring that records be kept to make sure employees receive and understand legal notices. The RSA Archer solution puts The Hartford in a position to easily address any new state labor requirements with little to no cost and with minimal effort, and to address regulatory inquiries through existing automated reporting.

Since the passage of the New York state regulation, the state of California now requires commissioned employees to receive an annual notice, and the state of New Jersey will soon also require employees to sign an acknowledgement form that they have read a gender-equality notice. The Hartford’s RSA Archer solution will help the company quickly come up to speed with new requirements for employees in those states. Leveraging the existing workflow and structure for new states does not require a new license and only requires approximately 10 to 15 resource hours to add the new requirements to the solution.

To learn more about the GRC 20/20 2013 GRC Value Awards and other recipients, please visit this post: GRC 20/20 Announces 2013 GRC Value Award Recipients

GRC 20/20 Announces 2013 GRC Value Award Recipients

The GRC Pundit BlogPublished onLeave a Comment on GRC 20/20 Announces 2013 GRC Value Award Recipients

GRC 20/20 today announced the launch of its inaugural GRC Value Awards program. Fifteen leaders in GRC were honored for real-world implementations of Governance, Risk Management and Compliance programs and processes that have returned significant and measurable value to an organization. 

Nominations from GRC solution providers as well as internal GRC programs within organizations were evaluated and vetted from a pool of 87 total nominations. Nominations were evaluated for depth of quantitative facts and each final selection was validated by GRC 20/20 and the specific implementation to attest to accuracy (even the anonymous entries below were vetted with direct contact with the specific implementation). Fifteen are recognized across the following categories (in alphabetical order):

  • 3rd Party GRC: GRC 20/20 Research awarded Hiperos 3PM its 2013 GRC Value award in the Third-Party GRC category for their implementation at a regional bank holding company.  The client specifics are anonymous in this publication, but GRC 20/20 has verified the factual accuracy with the bank.  After the implementation of Hiperos 3PM solution at the bank, it was able to triple the number of its third-party investigations without any increase in headcount. The number of days needed to assess the inherent risk of a third party also dropped dramatically — from 7.55 in 2011 to 5.22 in 2012 to 3.95 in 2013. Hiperos continues to deliver efficiencies. 
  • Audit Management: GRC 20/20 Research awarded ACL GRC and their client Traina & Associates its 2013 GRC Value award in the Audit Management category. ACL is an all-in-one cloud-based GRC process management solution. Since ACL GRC’s implementation at the Traina & Associates CPA firm two years ago, the average audit time went from 60 days to 30 days; audit management efficiency increased by 25 percent; and audit revenues increased by 10 percent without increasing staffing.
  • Business Continuity Management: GRC 20/20 Research awarded RSA® and Equifax its 2013 GRC Value award in the Business Continuity Management category. After implementing RSA Archer’s Business Continuity Management solution, U.S. consumer credit reporting agency Equifax experienced an immediate 60 percent reduction in time to create business continuity and disaster recovery plans, and a 20 percent OPEX savings for 2013.
  • Compliance Management: GRC 20/20 Research awarded The Hartford its 2013 GRC Value award in the Compliance Management category. The Hartford, a leader in property and casualty insurance, group benefits and mutual funds, uses the RSA Archer GRC Platform to support over 80 GRC processes including a New York State Labor  regulation instituted in 2012.  By building a solution on the RSA Archer eGRC platform the company avoided tens of thousands of dollars in expenses, and brought The Company into compliance one month ahead of schedule. 
  • Control Monitoring & Assurance: GRC 20/20 Research awarded SAP its 2013 GRC Value award in the Control Monitoring/Assurance category. When SAP Access Control was implemented at a large multinational beverage corporation, during the first year, the company was able to remove more than 4,000 invalid system IDs, implement a process to automatically remove roles from individual profiles if the role is not used within 120 days, and decrease license overall maintenance costs.
  • Enterprise GRC: GRC 20/20 Research awarded MetricStream and Sterling Bank its 2013 GRC Value award in the Enterprise GRC category. MetricStream Enterprise GRC Solution Suite allowed Sterling Bank to transition to an automated and integrated GRC program — from hundreds of spreadsheets to track audits, credit reviews and risk assessments, as well as hundreds of documents used to report findings and risk summaries. Today’s single-source GRC solution integrates functions and brings Sterling Bank strong scores from regulators. 
  • Environmental, Health & Safety: GRC 20/20 Research awarded CMO COMPLIANCE its 2013 GRC Value award in the Environmental Health and Safety category. The CMO COMPLIANCE HSEQ solution was implemented for a contractor, which reports an ROI of $2 million and growing. The solution replaced 20-internal solutions, streamlining ISO certification, and saving them at least one month additional FTE dedicated to ISO management and they continue to find new ways to streamline and save with the solution.
  • Identity & Access GRC: GRC 20/20 Research awarded AlertEnterprise, Inc. its 2013 GRC Value award in the Identity and Access category. Enterprise Guardian™ from AlertEnterprise was deployed at a large utility corporation. The implementation provided the utility insight into its identity repository and multiple IT systems to identify risks and eliminate threats, while meeting NERC and NERC CIP compliance. AlertEnterprise estimates the utility sees annual benefits of $1 million perhaps greater as a direct result of the implementation.
  • Information & Data Governance: GRC 20/20 Research awarded ClusterSeven ESM its 2013 GRC Value award in Information and Data Governance. With the help of the ClusterSeven Enterprise Spreadsheet Manager (ESM) solution, a global European banking and financial services company was able to meet regulatory demands to demonstrate control over its core financial operations. In the process, the bank projects a 3.5x ROI on ClusterSeven ESM based on risk avoidance.
  • Insurance & Claims Management: GRC 20/20 Research awarded Riskonnect RMIS and the State of Utah its 2013 GRC Value award in the Insurance & Claims Management category. Riskonnect RMIS’s fully automated insurance risk management software platform addresses insurance claims, litigation, exposure, and policy management. Within one year of implementation the Utah Division of Risk Management estimates it saved $1 million on reconciliation of insurance premium billing, and saw an 82 percent increase in efficiency in processing high dollar payments.
  • Investigations Management: GRC 20/20 Research awarded SAI Global and HealthPlus its 2013 GRC Value award in the Investigations Management category. With the help of the SAI Global solution called Compliance 360®, HealthPlus, a Michigan health and wellness organization, reduced its average days to complete investigations cases by 56 percent. Average days to complete cases has been reduced from nine days to four days. In spite of ever-rising caseload numbers, the SAI Global
    team was able to complete the implementation two months ahead of schedule. 
  • IT & Information Risk, Security & Compliance: GRC 20/20 Research awarded LockPath its 2013 GRC Value award in the IT & Information Risk, Security, and Compliance category. A leading manufacturer of medical devices recently extended its use of LockPath’s Keylight platform, including several modules. During the first year, the implementation has meant an 80 percent reduction in IT audit preparation time with five weeks of work reduced to one week, improved clarity and efficiency related to security functions, and improved insight companywide through dashboards and reports. 
  • Legal GRC: GRC 20/20 Research awarded Datacert Passport® and Marsh & McLennan Companies its 2013 GRC Value award in the Legal GRC category. Datacert’s Passport technology platform provides an integrated legal and GRC ecosystem that allows organizations to respond to the cost of compliance and non-compliance. The Passport implementation at financial leader Marsh & McLennan Companies helped reduced its outside counsel fees by 56 percent, its lowest spend since 2007, among other savings.
  • Policy Management: GRC 20/20 Research awarded Hitec Laboratories Ltd and Markel International its 2013 GRC Value award in the Policy Management category for its PolicyHub® solution. Markel International’s implementation of PolicyHub impressed them with its enhanced ability to demonstrate compliance to regulators. Markel International can demonstrate a 100 percent compliance rate for relevant staff, and can take action on noncompliant areas of the organization, which was previously not possible.
  • Risk Management: GRC 20/20 Research awarded Modulo Risk Manager its 2013 GRC Value award in the Enterprise Risk Management (ERM) category. A large regional financial services company used Modulo Risk Manager to help it comply with HIPAA, PCI and SOX; as well as its consolidation of 350 independently chartered bank branches, with 6,700 employees and a heterogeneous environment spanning a variety of operating systems, servers, application platforms and legacy systems for each back-end core banking platform.

"We are extremely pleased with the response and the quality of submissions for the first year of the GRC Value Awards, which reflects strong market demand and growth across all GRC segments," said Michael Rasmussen, Chief GRC Pundit for GRC 20/20 and internationally recognized expert. "These are awards play an important role in recognizing today's successes as a milestone toward advancing GRC maturity. In achieving maturity, GRC is part of the organization's strategy and operations and supported by a range of technology, knowledge and services – enabling the organization to achieve greater efficiency, effectiveness, and agility in GRC processes and broader business operations."

About GRC 20/20

GRC 20/20 is the authority in understanding how organizations implement GRC practices that are effective, efficient and agile. Through independent research and industry interaction, GRC 20/20 advises the entire ecosystem of GRC roles within organizations, technology and knowledge solution providers, and professional service firms. Organizations engage GRC 20/20 when they need insight, guidance and advice in dealing with a dizzying array of disruptive issues, challenges, processes, information and technologies while trying to maintain control of a distributed and dynamic business environment. Visit GRC 20/20 at http://www.grc2020.com/ and follow on Twitter at @GRCPundit.

 

The Rise of GRC Architecture in GRC 3.0

The GRC Pundit BlogPublished onLeave a Comment on The Rise of GRC Architecture in GRC 3.0

Moving Beyond the GRC Platform to GRC Architecture

Business is complex.  Gone are the years of simplicity in business operations.  Exponential growth and change in regulations, globalization, distributed operations, changing processes, competitive velocity, business relationships, disruptive technology, legacy technology, and business data encumbers organizations of all sizes. Keeping this complexity and change in sync is a significant challenge for boards, executives, as well as governance, risk management, and compliance professionals (GRC) throughout the business.

GRC cannot be managed in isolation.  That is what fails.  The decentralized and disconnected distributed systems of the past catch the organization off guard to risk and expose the organization.  Complexity of business and intricacy and interconnectedness of GRC data requires that we have an integrated approach to business systems, data, and GRC. 

The Bottom Line: The organization requires complete situational and holistic awareness of GRC across operations, processes, relationships, systems, and data to see the big picture or risk and its impact on organization performance and strategy.   Distributed, dynamic, and disrupted business requires the organization to take a strategic approach to GRC architecture.  GRC fails when risk issues are addressed as a system of parts that do not integrate and work as a collective whole.  GRC also fails when it is thought of as a single platform to manage workflow and tasks.  GRC is about the interactions and relationships of cause and effect across strategy, process, transactions, information, and technology supporting the business and requires a GRC architecture approach.

Why not see BOTH the forest and the trees?

The individual components of GRC — governance, risk management, and compliance — are a necessary and intricate challenge to business.  GRC is not optional: every organization has some approach to GRC from the ad hoc to the agile.   The primary directive of a mature GRC program is to deliver effectiveness, efficiency, and agility to the business in managing the interrelationship of performance, risk, and compliance.  This requires a strategic approach that connects the enterprise, business units, processes, transactions, and information to enable transparency, discipline, and control of the ecosystem of business and operational activities. Doing this is not easy as all of these elements are in a constant state of change.

GRC maturity increases as the ability to connect, understand, analyze, and monitor interrelationships and underlying patterns of performance, risk, compliance across the business grows.  Various systems and processes interrelate in apparent and not so apparent interactions that can surprise the organization and catch it off guard.  When risk is understood and compartmented in silos the organization fails to see the web of risk interconnectedness and its impact on performance and strategy leading to greater exposure than any individual silo understood. 

To maintain integrity, and execute on strategy, the organization has to be able to see the individual area of risk (the tree) as well as the interconnectedness of risks (the forest). 

GRC relationships are non-linear.  They are not a simple equation of 1 + 1 = 2.  They are a mesh of exponential relationship and impact in which 1 + 1 = 3 or 30 or 300.  What seems like a small disruption or risk exposure may have a massive effect or no effect at all.  In a linear system effect is proportional with cause, in the non-linear world of business and GRC it is exponential. Business is chaos theory realized.  The small flutter of risk can bring down the organization. If we fail to see the interconnections of risk on the non-linear world of business the result is often exponential to unpredictable.

GRC 3.0 – Moving Beyond the GRC Platform to GRC Architecture

The core of GRC 3.0 is operationalizing GRC across the fabric of business strategy and operations – seamlessly, agilely and non-invasively.  This involves bringing GRC to the ‘coal-face’[1] of the organization through employee engagement in GRC with systems that are simple, mobile, and easy to use at the frontline of the business. It is about leveraging and harmonizing existing data and systems that deliver results in focused areas but now need to feed into the bigger picture of enterprise transparency in the context of distributed and dynamic business.

The challenge is how to reconcile business agility with GRC strategy and architecture?  Most GRC decisions were considered as a base reaction to the newest regulatory demand. This resulted in billions of dollars spent in GRC with a limited understanding alignment to the business. GRC was approached tactically and not strategically. Organizations have ended up with topography of GRC projects individually focused on risk at department or regulatory/risk issues that have often failed to deliver cross-enterprise insight needed. To use an analogy from anatomy, the enterprise GRC body has functioning heart, kidney’s, limbs, lungs, and other organs that operate as separate entities and not as part of a unified body. What is often missing is a level of integration that provides a central nervous system that connects everything and makes it operate as a body.  This is more than a GRC platform as it has been understood for the past decade.

GRC Platforms: Problem or Cure?

In GRC 2.0 organizations approached GRC as a platform to document and manage content related to risks, policies, and controls, enhanced with workflow to manage assessments, issues, and reporting.  There was limited integration and correlation of GRC information and analytics and reporting was on fairly static information collected over time. Organizations suffered when GRC did not connect all the dots and provide context to business analytics, performance, objectives and strategy in the real-time business operates in.  GRC delivers limited value to the organization when it simplifies risk management to being just surveys and forms that lead to subjective analysis.  GRC has been tactical and focused on putting out fires, particularly compliance fires.   GRC platforms have been primarily workflow, task management, and content systems to document controls and compliance and provide some subjective reporting on risk.  GRC in 1.0 and 2.0 has not delivered on a true integrated understanding of risk and performance. Organizations often have a diverse set of independent and disconnected systems to address a range of credit, market, interest, operational, strategic, reputation, capital, and regulatory risks with no integrated view across these systems.  It is not uncommon for an organization to have six different GRC platforms from different solution providers and a dozen or more other risk and compliance solutions scattered across the organization.

Organizations need to move beyond the concept of a GRC platform as it only addresses part of the challenge and focus on an integrated view of GRC data and systems through a GRC architecture that is a cohesive part of the broader business fabric of the organization. GRC technology is not about a single GRC platform that promises to be all things and fails to deliver them.

The goal of GRC 3.0 is to enable a GRC architecture that effectively reconciles organization strategy, process, information, and technology into a federated architecture model.  There still can be a central core system for GRC, but GRC is not defined as this one central system (or platform) but the integrated whole.  

GRC 3.0 is: an architecture that is enterprise wide; delivers consistent and uniform value from the boardroom to the ‘coal-face’ of the front office
; focused at value protection and creation; and is proactive in measurement, management and interdiction.  GRC 3.0 provides an integrated GRC architecture that connects the fabric of the business together across the organization and its disparate systems, processes, and information. 

[1] The ‘Coal-Face’ is a term originated in the United Kingdom referring to the miners deep in the shafts extracting coal for the business.  Every organization has a ‘coal-face.’  These are the front-line employees that make decisions every day impacting GRC and business performance. 

Where does conflict minerals fit into your broader 3rd party GRC strategy?

The GRC Pundit BlogPublished onLeave a Comment on Where does conflict minerals fit into your broader 3rd party GRC strategy?

The 3rd Party GRC market is the fastest growing segment of the GRC market.  The pressures are many: social accounability/international labor standards, quality, environmental, health and safety, privacy, informaiton security, credentialing, code of conduct, geo-political and operational risk.  An organization's vendors, suppliers, outsourcers, agents, service providers, contractors, consultants, temporary workers . . . it is hard to understand where the organization starts and stops.  The extended enterprise of today is a complex, distributed, diverse, and dynamic organizations that requires risk and complaince oversight.

One of the most significant challenges bearing down on many organizations is conflict minernal compliance.

Organizations approaching conflict mineral compliance can take several paths leading to varying degrees of program maturity.  Mature conflict mineral compliance is an integrated part of a broader governance, risk management, and compliance strategy. It requires a top-down view of conflict mineral risk that is understood in context of enterprise risks. It also means bottom-up participation where business functions identify and monitor risk and suppliers that expose the organization. GRC 20/20 has developed the third Party GRC Maturity Model to articulate maturity in conflict mineral compliance processes in context of broader third party governance, risk management, and compliance. 

  1. Ad hoc and document centric approach. Organizaitons at this level of maturity do not understand risk and exposure to conflict mineral issues.  The organization addresses conflict mineral compliance in a reactive mode and does not invest in technology for compliance and utlizes documents and emails by the thousands to get the job done.  This leads to a mountain of information requiring significant time to reconcile and report while introducing errors and omissions.  It never produces a defensible audit trail or chain of evidence of how assessments and documents were completed and reported upon.  This leaves the organization into exposure as their compliance program is riddled with flaws waiting for the auditor or regulator to pounce upon. There is limited ownership or monitoring of conflict mineral compliance, and certainly no integration of compliance information and processes. 
  2. Fragmented approach focused only on conflict minerals. Here the organization is fragemented.  Conflit mineral compliance is a defined program but operates independently of other programs monitoring risk and compliance across third party relationships.  The organization most likely has seen the value of technology and utlizes it to address conflict mineral compliance. In the broader scope of things conflict minerals is a siloed initiative operating indepentely of others such as social accountabiltiy, quality, environmental, health and safety, and anti-bribery and corruption across the supply chain.  The requirements are being met and the reports made but the organization is inefficient, ineffective, and certainly not agile as it has redundancy in approaches to third party oversight as information and processes are highly redundant and lack integration. 
  3. Integrated approach to conflict minerals as part of social accountability. The integrated stage of conflict mineral maturity is when it is understood in the context of social accountability.  The goal of conflict minerals is to address human rights violations.  This stage of maturity sees conflict mineral compliance moving beyond a compliance initiative to being an integrated part of the values and ethics of the organization and is lived out actively through the code of conduct throughout the organization and its third party relationships.  The organization has an integrated approach to not only address conflict mineral compliance but also child labor, forced labor, working hours, wage/hour, health & safety across its supply chain. The organization has developed consistent and integrated processes to manage assessments, audits, communicate policies, deliver training, report, and remediate.  Technology enables this and ensures that items are done and that the integirty of the organization is protected. 
  4. Aligned third party governance, risk management, and compliance program. In the aligned stage the organization has a cross-department strategy for managing third party GRC.  Here the organization is thinking holistically across governance, risk management, and compliance issues impacting third party relationships.  As the integrated stage sees conflict minerals in the context of social accountability, both are now managed consistently across other third party GRC areas such as anti-bribery & corruption, quality, environmental, health & safety, security, and privacy in third party relationships. The organizaiton has an integrated third party GRC platform to manage the range of these topics while delivering consistency in policy communication, training, assessment, audit, and remediation in third party relationships.  Suppliers and other third parties are relieved as there is a consistent approach and the burden of responding to multiple items in different formats goes away.  The organization benefits from removing the cost of redundant processes, forms, assessments, and approach but also gains the value of an integrated view of the integrity and health of thrid party relationships in the context of performance.
  5. Optimized as part of  an enterprise GRC architecture. At the optimized stage, the third party risk program – and with that conflict minerals – is part of the fabric of a broader enterprise GRC architecture.  As the Aligned stage brought the value of understanding third party risk and compliance in context across third party risk and compliance domains, the organization at the Optimized stage sees and understands third party risk in context of enterprise risk.  This allows for a holistic approach to a 360º conextual awareness.  The organization understands its risk and compliance posture in the context of business objectives, values, risk boundaries, and strategy.  The intricacies of third party risk and how they impact other risks such as financial, reputational, strategic, and operational are understood and managed accordingly.

How Do I Achieve Effective, Efficient, & Agile Conflict Mineral Compliance?

The GRC Pundit BlogPublished onLeave a Comment on How Do I Achieve Effective, Efficient, & Agile Conflict Mineral Compliance?

The specific obligation of the Conflict Mineral Rule is to gather information about the use and source of 3TG in products and report to the SEC (and on the organization's website). As with other significant regulations with a far reach (e.g., Sarbanes Oxley), there is a lot of confusion out of the gates. This includes misconceptions and failure to scope a program that will stand the test of time.
Organizations are best served to define a supplier GRC program and framework to address Conflict Mineral Rule requirements that will be effective today and into the future. The goal is to establish a process that meets or exceeds requirements and reduces risk exposure in a dynamic and distributed business environment. A successful supplier GRC program that addresses conflict mineral requirements is:

  • Effective. Organizations need the program to be effective in meeting requirements as well as reduce risk exposure to the organization.
  • Efficient. Developing processes that are efficient reduces both financial and human capital costs in meeting requirements and governing supplier relationships.
  • Agile. Organizations require agility in supplier governance as it operates in an ever-changing business environment – regulations and requirements change, the business itself changes and new products are developed, and the supply chain is in a constant state of change.

To be effective, efficient, and agile in supplier governance with a focus on conflict mineral compliance program requires a framework that has the following elements supported by process and technology:

  1. Ownership. At the end of the day someone needs responsibility to ensure that the conflict mineral compliance program is functioning and meeting the obligations and reducing risk exposure. This role needs executive sponsorship, as the organization will have to certify the reports it submits putting the executives and board on the line in regards to their fiduciary responsibilities.
  2. Collaboration. While the organization needs someone to lead the conflict mineral compliance program to ensure that it is both designed and operating properly, there are many departments and roles that need to be involved in the program. This includes supply-chain management, procurement, corporate compliance & ethics, legal, risk management, business operations, and audit. A cross-functional committee of roles and departments involved should be established to ensure that everyone is on board and working as a team.
  3. Policies, Procedures, & Training. The cornerstone of any compliance program is policy. In the case of conflict minerals this starts with the organizations code of conduct with a statement regarding the organization's ethics and values in relation to human rights within its operations and across supply-chain and third party relationships. This gets reflected in the supply-chain code of conduct that suppliers have to acknowledge and adhere to. Further detail on expectations, boundaries, and responsibilities is spelled out in related policies and procedures. Training is critical both internally to the organization as well as with the supply-chain so that everyone is on board and understands what is expected of them. Suppliers need to be informed of expectations and obligations as well as understand the process for compliance.
  4. Understand the organization's products. Product filtering is the cornerstone task for making conflict mineral compliance effective, efficient, and agile. The organization needs to catalog its products and the materials used and determine which ones contain 3TG. This is done to define the scope of the detailed assessment and reporting requirements. Proper scoping of products impacts the effectiveness and efficiency of the program as the organization has to track down the source of 3TG that are used in them. Scoping products correctly directly impacts the organization and suppliers burden in compliance.
  5. Assessment. The majority of conflict mineral compliance work is in the assessment process. Here the organization compiles self-assessment surveys/questionnaires to send to its suppliers. Each supplier that is involved with 3TG minerals in products needs to be sent a self-assessment survey to attest to the use and source of 3TG in those products. The challenge for organizations is to drill down deep into the supply-chain to get to the smelter and mine that the minerals came from. Organizations can send self-assessments to their direct suppliers and then require that these suppliers send self-assessments to their downstream suppliers until the original country and source of the mineral is discovered. Or the organization can insist that their suppliers inform the organization of their downstream suppliers and the organization can send assessments itself down into the depths of the supply chain. This becomes a tricky area to navigate: at many points the organization may have to rely on the attestation and information provided by suppliers finding it difficult to navigate past them to the source of the minerals. The key is to keep a watch for inaccurate and misleading information. Intelligence, intuition, and insight are needed to ensure that the organization has taken 'reasonable' steps to identify the source of conflict minerals.
  6. Due Diligence. If the organizations determines that 3TG in products is sourced from DCR or adjoining countries the next step is due diligence. The due diligence expectation is to determine if the minerals sourced from these countries are connected with armed militias. The organization needs to determine how the minerals are moved and controlled. It is expected that the organization will have to put greater oversight and control over the logistics of minerals from these countries to ensure that these groups do not profit militias known for crimes against humanity.
  7. Audit. An important element of conflict mineral compliance is the requirement to have the Conflict Mineral Report audited. Organizations need to leverage their own internal audit staff to ensure the integrity of the report, information collected, and the process for compliance. However, the requirement is to have the report audited by an external auditor. The goal of internal audit is to provide assurance and find issues for the organization to resolve before it gets to the external auditor. Both internal and external audit will need complete access to assessments and due diligence efforts to conduct their audits. Onsite inspections of suppliers should also be expected.
  8. Reporting. The primary deliverable of conflict mineral compliance is the disclosure forms that are reported to the SEC and put on the organizations website. At a minimum organizations have to file a Form SD. Organizations that have to go further and develop a Conflict Mineral Report to accompany Form SD are those that cannot provide reasonable assurance that 3TG is conflict free and have to go beyond reasonable inquiry to suppliers to a structured due diligence process that is audited. This requires the integration and analysis of all the previous collected information so that the organization can build these reports and executives can attest to accuracy.
  9. Remediation. The end game of conflict mineral regulation is to reduce the use of 3TG sourced from facilities connected to human rights violations and bring greater awareness to human rights violations connected to the militias involved with mines and smelters in the region. When issues are found, the organization is to work through the supply chain to remove these facilities and cut off funds to militia groups in the region of the DRC and their crimes against humanity.

Growing Risk Exposure in Business Relationships

The GRC Pundit BlogPublished onLeave a Comment on Growing Risk Exposure in Business Relationships
This is part 1 in GRC 20/20's series of posts on Conflict Mineral Compliance and broader 3rd Party GRC . . . 

No company is an island unto itself: organizations are a complex and diverse system of business relationships. Governance, risk management and compliance (GRC) challenges do not stop at traditional organizational boundaries. Organizations today struggle to identify, manage, and govern risk and compliance in extended business relationships as they stand in the shoes of their vendors, partners, suppliers, and other third parties. Business partner problems are the organizations problems that directly impact the organization’s brand, reputation, and increase exposure to compliance matters. When questions of business practice, ethics, safety, human rights, corruption and the environment arise, the organization is held accountable, and it must ensure that business partners behave appropriately. 

Organizations need to understand business relationships in the context of the risk and compliance  issues that impact operations and the brand. The challenge before organizations is: “Can you attest to the status of risk and compliance across the organization’s extended business relationships?”  The head of procurement, for example, is often left considering supplier risk during on-boarding of a relationship but has inadequate resources and experience to effectively monitor risk ongoing.

Managing risk across third party relationships is particularly cumbersome in the context of constantly changing regulations, relationships, employees, processes, suppliers, strategy, and more.  Risk, regulatory, and business environments are in a constant state of change. The business needs to be consistent in its GRC processes across business relationships as well. Manual spreadsheet and document centric processes are prone to failure, as they bury procurement and other areas of third party business relationship management, in mountains of data that is difficult to maintain, aggregate, and report on.  This consumes valuable resources trying to figure things out instead of actively understanding and managing third party risk and compliance exposure.  

Third party relationships — supply chain, value chain, vendors, service providers, outsourcers, agents, and contractors — cannot be left to themselves. Risk across these relationships must be monitored and managed. Business relationships must comply with regulatory requirements, corporate and regional cultures, codes of conduct, statements of social responsibility and sustainability, policies, risk limits, controls, and other business practices. Organizations need to actively demonstrate an in-compliance status throughout their extended business environment.

Managing 3rd party risk is a particular challenge in the context of conflict mineral compliance requirements across the organization’s supply chain.  Organizations need an integrated approach to manage the entire supply chain exposure to conflict minerals.  This requires a framework to manage supplier risk, conduct assessments, gather supporting information, report and analyze, resolve issues, and monitor a supply chain that is constantly changing.

In the next few weeks GRC 20/20 will post more articles in the Conflict Mineral series. . . 

 

 

About GRC 20/20

UncategorizedPublished onLeave a Comment on About GRC 20/20

About GRC 20/20 Research, LLC

20/20 vision is perfect clarity in sight: clarity to see and process surrounding context and achieve situational awareness — to observe the world around you, be aware of risks, and react accordingly.

Clarity of Governance, Risk Management & Compliance

GRC 20/20 Research, LLC (GRC 20/20) provides clarity of insight into governance, risk management, and compliance (GRC)  solutions and strategies through objective market research, benchmarking, training, and analysis. We provide independent and objective insight into leading GRC practices and processes, including market dynamics and intelligence; risk, regulatory and technology trends; competitive landscapes; market sizing; expenditure priorities; and mergers and acquisitions.

GRC 20/20 advises the entire ecosystem of GRC solution purchasers within organizations, professional service firms, and solution providers.  We serve the needs of organizations that seek clarity, guidance and advice in dealing with a dizzying array of disruptive issues, processes, information and technologies while trying to maintain control of a distributed and dynamic business environment.  Whether focused on a specific risk, regulation, department, or enterprise GRC strategy, organizations seek clarity through GRC 20/20.  This clarity is delivered through analysts with real-world expertise, independence, creativity, and objectivity that understand GRC challenges and how to solve them practically and not just theoretically.  Our clients include Fortune 1000 companies, major professional service firms, and an array of GRC solution providers who require our research and advise to apply strategies and technology to meet the GRC challenges they face. 

GRC 20/20 is a:

  1. Buyer advocate.  We assist those purchasing GRC solutions  to help them navigate hyperbole to select solutions that are practical and deliver on requirements.  

    Simply, we help buyers select the right solution(s) for their needs and get the most out of their investment.

  2. Solution strategist.  We guide GRC solution providers in understanding the demand and needs of buyers and improve product, marketing, competitive, sales, partner, content, and growth strategies.  

    Simply, we make good GRC solutions into great GRC solutions.

  3. Market evangelist.  We educate and evangelize GRC strategies that deliver value and results through advocacy of technology, content, and services in making GRC processes efficient, effective and agile.

    Simply, we define the future of GRC and understand where it is headed.

Research Terms & Conditions

UncategorizedPublished onLeave a Comment on Research Terms & Conditions

These terms and conditions  govern the use of  GRC 20/20 Content (content includes, but is not limited to: website, research, intellectual property, and information in all forms).  If you have any questions please email [email protected].

Intellectual Property

You agree and acknowledge that all Intellectual Property Rights in all GRC 20/20 website, research, intellectual property, content, and all material and information contained within belongs to GRC 20/20. You shall not obtain any Intellectual Property Rights in GRC 20/20 content. You may not publicly use any GRC 20/20 content without GRC 20/20’s prior written permission.  GRC 20/20 content is for internal use only to your organization.

Licence of GRC 20/20 Content

GRC 20/20 licence’s its content as follows:

  • If GRC 20/20 content has been ordered on a single user basis then it may only be used by the  person whose name is identified on the Order; and
  • If GRC 20/20 content has been ordered on a corporate basis then it may only be used by the employees of the one entity whose company name is identified on the Order. For the avoidance of doubt the company name identified on the Order shall not include Affiliates.
  • All Licences to GRC 20/20 content is granted, subject to these Terms and Conditions, for the purchaser’s sole use and benefit on a non-exclusive and non-transferable basis.
  • All Licences of GRC 20/20 conet permits the purchaser, for internal business purposes only, to retrieve and display the content on a computer screen and print individual pages on paper and store such pages in electronic form on disk and on personal computer (but not on any other server or other storage device connected to an external network).
  • Purchaser may not (without contacting GRC 20/20 to obtain prior written permission):
    • Sell, market or redistribute any GRC 20/20 content or any material contained within GRC 20/20 contetn and the GRC 20/20 website (including by using it as part of any library, archive or similar service);
    • Remove the copyright or trademark notice from GRC 20/20 content;
    • Create a database in electronic or structured manual form by systematically downloading and storing all or any of GRC 20/20 content;
    • Extract any content from GRC 20/20 research and website including text, charts and figures; or
    • Modify, reproduce, develop or in any way commercially exploit any of our Reports and Website content or any material contained within our Reports and Website.
  • The Licences of GRC 20/20 content is  subject to any guidelines that GRC 20/20 may from time to time issue with to GRC 20/20 content.
  • The Licences of GRC 20/20 content shall continue indefinitely.
  • Where a Licence of GRC 20/20 content is granted on a corporate basis purchaser shall make reasonable endeavours to ensure that all your employees, members, directors, partners, whatever the case may be, comply with these Terms and Conditions.
  • If purchaser becomes aware of any potential or actual infringement or misuse of GRC 20/20 content and Intellectual Property Rights, purchaser shall promptly notify that to GRC 20/20.

Consequences of breach of licence

GRC 20/20 takes the protection of its Intellectual Property Rights seriously. If proceedings were to become necessary, for example, because of a breach of the Licence of any of our Reports, the remedies available to us include an injunction, damages or an account of profits, legal costs and interest. Damages may be in the region of a minimum of $50,000 for each breach.

Citation Terms

All external or commercial citation of GRC 20/20 content is prohibited without GRC 20/20’s express written permission. This includes, but is not limited to, uses of GRC 20/20 content in advertisements, press releases, analyst briefings and any sales collateral in any and all types of media.

All citation requests are reviewed by GRC 20/20 on a case-by-case basis.

To seek GRC 20/20 approval relating to any permission contact [email protected] providing full citation and context for request. Please include a draft copy of any press releases and other marketing material such as newsletters, email campaigns, direct mail, etc. GRC 20/20 may charge an administration fee for reviewing citation requests. This fee will reflect the time required to check accuracy and legal impact of the use of GRC 20/20 content. The administration fee will be communicated within two business days of the citation request and before the start of the approval process.

GRC 20/20 reserves the right to change these citation terms at any time, without notice.

Fees

The fee for  provision of GRC 20/20 content (“Fee”) is priced in accordance with the Order and payable immediately.

If purchaser fails to pay any amount due to GRC 20/20 under these Terms and Conditions, then GRC 20/20 shall be entitled but not obliged to charge interest (both before as well as after judgment) at the rate of 4% per annum above the base rate. Such interest shall accrue on a daily basis and be compounded quarterly.

The Fee for GRC 20/20 content does not include any updates to the report. If you wish to receive any updated report which we may publish from time to time then you will be required to purchase such updated GRC 20/20 content as a new order and pay the then published rate.

All payments to be made by purchaser to us under these Terms and Conditions shall be paid without deduction set-off, counter-claim or other withholding.

Purchaser Acknowledgements and Obligations

Purchaser acknowledges that GRC 20/20 is an independent research, publishing and advisory firm. As such the views expressed in GRC 20/20 content will reflect GRC 20/20 analysts’ views. Opinions and recommendations contained in such GRC 20/20 content is submitted solely for advisory and information purposes and is not intended as an offering or a solicitation to buy or sell any securities mentioned.

GRC 20/20 content is issued in good faith but without legal responsibility and is subject to change or withdrawal without notice. GRC 20/20 does not warrant the accuracy, completeness or adequacy of our advice or the contents of our Reports and Website for any purpose or that GRC 20/20 advice and content will meet with your requirements. We do not guarantee that our content will result in the identification of all matters which may be of interest to you.

GRC 20/20 content and website must not be accessed or used in any way that would be illegal in any jurisdiction.

Purchaser acknowledges that it holds adequate and suitable professional indemnity insurance in relation to any professional service that you provide.

Purchaser shall not disclose any of the Reports or divulge their contents to any third party without GRC 20/20 prior written consent (which we may withhold or grant subject to conditions, at our complete discretion). Irrespective of whether GRC 20/20 provides any consent for purchaser to disclose GRC 20/20 content to a third party, GRC 20/20 shall never assume any responsibility to any third party to which GRC 20/20 content is disclosed or otherwise made available.

Purchaser shall keep GRC 20/20 content on a strictly confidential basis, and it is purchaser’s responsibility to ensure that no unauthorized third party gains access to GRC 20/20 content or website.

Purchaser warrants that it has the full power and authority to comply with these Terms and Conditions.

Purchaser shall comply with all applicable laws in performing  obligations and exercising  rights under these Terms and Conditions.

Liability

Nothing in these Terms and Conditions shall operate to exclude or limit GRC 20
/20 liability for:

  • death or personal injury caused by our negligence; or
  • fraud; or
  • any other liability which cannot be excluded or limited under applicable law.

 

GRC 20/20 shall not be liable to purchaser for any loss of profit, anticipated profits, revenues, anticipated savings, goodwill or business opportunity, or for any indirect or consequential loss or damage.

GRC 20/20 aggregate liability in respect of any claims arising out of or in connection with any Licence of any of our Reports and Website, whether in contract or tort (including negligence) or otherwise, shall in no circumstances exceed the total Fee payable (and paid) by the you in respect of that Report.

Purchaser shall indemnify and keep GRC 20/20 indemnified against all liabilities, losses, proceedings, claims and demands brought or threatened against GRC 20/20 by any party other than Purchaser and any reasonable costs and expenses relating thereto, arising out of or in connection with Purchaser breach of any of these Terms and Conditions, regardless of whether such breach is later remedied and regardless of whether or not we have been negligent.

Purchaer shall indemnify and keep GRC 20/20 indemnified against all liabilities, losses, proceedings, claims and demands and any reasonable costs and expenses relating thereto, arising out of or in connection with Purchaser breach of any of these Terms and Conditions.

Termination

The Licence of any GRC 20/20 content purchaser has ordered shall continue indefinitely.

The Licence to use GRC 20/20 content may be terminated by written notice if Purchaser is in material breach of these Terms and Conditions and the breach is not remedied within the period of 14 days after written notice of the breach has been given to Purchaser. If GRC 20/20 reasonably believes you are in breach of the Licence GRC 20/20 may suspend your right to use GRC 20/20 content at any time.

On termination of a Licence to use our Reports:

  • all provisions of the Licence shall cease to have effect, except that any provision which can be reasonably inferred as continuing, or is expressly stated to continue, shall continue in full force and effect; and
  • Purchaser shall promptly return to GRC 20/20, or certify the destruction of the Report.

Privacy Policy

The information that Purchaser provides about itself to GRC 20/20 will only be used by us in accordance with our Privacy policy. Please read the Privacy policy carefully and if you have any questions please email [email protected]

Non-Solicitation of Personnel

In order to protect GRC 20/20 confidential information and business connections Purchaser covenants with us that Purchaser shall not directly or indirectly and either on Purchaser’s own behalf or on behalf of or in conjunction with, any firm, company or person, for 6 months after the date of the Order, offer to employ or engage or otherwise endeavour to entice away from GRC 20/20 any person who is employed or engaged by us in the preparation of GRC 20/20 content contained in the Order.

Notices

All notices shall be given to GRC 20/20 via email at [email protected] or by post at the address referred to at the top of these Terms and Conditions; or to Purchaser at either the email or postal address provides during any ordering process.

Notice will be deemed received when an email is received (or else on the next business day if it is received on a weekend or a public holiday in the place of receipt) or 3 days after the date of posting.

General

The following words and expressions shall have the following meaning in these Terms and Conditions:

  • Affiliates: means in relation to the company name you specified on an Order, any company which is for the time being a holding company of that party or a subsidiary of that party or of any such holding company.
  • Force Majeure Event: any event arising that is beyond the reasonable control of the affected party (including any industrial dispute affecting any third party, governmental regulations, fire, flood, disaster, civil riot or war).
  • Intellectual Property Rights: means all intellectual property rights wherever in the world arising, whether registered or unregistered (and including any application) including copyright, know-how, confidential information, trade secrets, business names and domain names, any and all rankings, patents, design rights, database rights and all rights in the nature of unfair competition rights or rights to sue for passing off.
  • Licence: means as the case may be either the single-user licence or a corporate licence (as selected by you at the time of your Order) to any of our Reports subject to these Terms and Conditions.
  • Marks: means any and all of our or our licensor’s trademarks, trade names, service marks, logos, URLs or identifying slogans and whether or not registered.
  • Order: means an order by Purchaser through our Website for any GRC 20/20 content in accordance with these Terms and Conditions.
  • Reports: means any of GRC 20/20 publlished research and articles which GRC 20/20 may from time to time publish.
  • Website: means our website at http://www.grc2020.com

 

In these Terms and Conditions:

  • Clause headings do not affect the interpretation of these Terms and Conditions.
  • References to clauses are (unless otherwise provided) references to the clauses of these Terms and Conditions.
  • Words in the singular include the plural and those in the plural include the singular.
  • References to including and include(s) mean respectively including without limitation and include(s) without limitation.
  • GRC 20/20 may transfer and/or assign GRC 20/20 rights and/or GRC 20/20 obligations under any Licence. This will not affect Purchaser rights under such Licence. Purchaser may not transfer any of Purchaser’s rights or obligations under any Licence.
  • Nothing in these Terms and Conditions shall confer Purchaser rights on any other person.

 

If Purchaser breaches these terms and conditions and GRC 20/20 ignores this, GRC 20/20 will still be entitled to use GRC 20/20 rights and remedies at a later date or in any other situation where you breach these Terms and Conditions.

This agreement, together with the Privacy policy, represents the entire terms agreed between us in relation to its subject matter and may be amended only by our agreement in writing.

If either of us becomes aware of a Force Majeure Event which gives rise to, or which is likely to give rise to, any failure or delay to perform our obligations under any Licence such party shall forthwith notify the other and shall inform the other of the period for which it is estimated that such failure or delay shall continue. The affected party shall take reasonable steps to mitigate the effect of the Force Majeure Event.

All Licences are made solely for Purchaser benefit and they are not intended to benefit, or be enforceable by, any other person.

If any provision (or part of a provision) of these Terms and Conditions is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable or illegal, the other provisions shall remain in force. If any invalid, unenforceable or illegal provision would be valid, enforceable or legal if some part of it were deleted, the provision shall apply with whatever modification is necessary to give effect to the commercial intention of the parties.

These Terms and Conditions shall be governed by the law of the State of Wisconsin

GRC 20/20 will try to solve any disagreements quickly and efficiently. If you want to issue court proceedings in relation to this agreement you must do so in the State of Wisconsin.

Characteristics of GRC 3.0

The GRC Pundit BlogPublished on1 Comment on Characteristics of GRC 3.0

In the previous post I reviewed the history of GRC.  In this post we examine the characteristics of GRC 3.0. REMEMBER:  every organization does GRC.  You may not call it GRC but your organization has some approach to governance, risk management, and compliance.  The question is how mature is the organizations approach.  The definition of GRC is “a capability to reliably achieve objectives [governance] while addressing uncertainty [risk management] and acting with integrity [compliance].”

The Core Characteristic of GRC 3.0 is Architecture

The core of GRC 3.0 is to approach GRC as architecture involving strategy, process, information, and technology working together across the business and its operations.  GRC requires the integration of different types of applications and content across the business to achieve efficiency, effectiveness, and agility in a dynamic and distributed business environment.  This requires that we understand the business and how it operates – and how mature GRC is about integration and not necessarily one platform that tries to be all things.

There are different architecture approaches to GRC – decentralized where everyone does their own thing, centralized where everyone has to use one common GRC platform, or a federated approach.  GRC 3.0 is focused on a federated GRC approach.

A federated GRC architecture allows best of breed solutions to exist where they make sense but has a centralized capability to integrate and manage GRC information.  Instead of “one platform to replace them all” (centralized architecture model) we have the “one platform to integrate them all” (GRC 3.0 federated architecture model).

The truth is – organizations often have multiple GRC solutions in house. Different departments have invested in best of breed solutions that make sense where they are.  Gutting and replacing solutions often means the department loses functionality and we manage GRC to the lowest common denominator. No GRC solution does everything GRC.  GRC involves a range of different roles, processes, technologies, and content.  One platform simply does not do everything – or at least it cannot do everything well.

A federated GRC model allows for consolidation where it makes sense, but also allows for best of breed where it makes sense. GRC 3.0 is about building a federated GRC architecture that centralizes oversight, reporting, accountability, and analytics yet allows for integration with other GRC technologies that do specific things very well. The goal is to let GRC work with and throughout the business and not force parts of the business into a mold that does not fit. It allows for diversity while still providing integration and consistency centrally. It allows an organization to have an ecosystem of process, technology, and content that works together to provide the best alignment and value to the business.

Other characteristics of GRC 3.0 include:

  • Operationalizing GRC. Operationalizing GRC is extending GRC into business applications and processes. It is about enabling GRC across business systems and processes.  It is bringing GRC to the business intelligence, performance, and ERP environment to improve real-time insight into business decisions, operational intelligence, and monitoring.
  • Integration of content.  The integration of content and technology is core to GRC 3.0. GRC strategies are looking to integrate GRC process and technology with content from content providers to rapidly assess changing regulations, risks, industry and geopolitical events, and how they impact strategy, performance, controls, policy and the integrity of the organization.
  • 360º GRC contextual and situational awareness.  Through GRC architecture and extension into business operations the GRC environment gains a complete view of what is happening – situational awareness.  Where risk and compliance is monitored and understood in the course of business operations and transactions.
  • Bringing GRC to the ‘coal-face’.  Organizations are recognizing that effective GRC includes those on the front lines of the business – the “coal-face.” GRC 3.0 is about delivering a better end-user experience: getting employees involved by providing elegant interfaces that are intuitive and social. The goal here is to engage employees and provide them with an interface that allows them to participate in GRC without feeling intimidated and lost.
  • GRC gamification.  GRC 3.0 is focused on GRC gamification, engaging employees – that coal-face – with games and interactive content.  Implementing training and awareness programs that enables employees to earn points or badges – perhaps redeemable for certain things.  To recognize people when they make good risk decisions or alert the organization to a problem.
  • Mobility. There’s an app for GRC! GRC is embracing mobile technology on tablets and other devices.  Issue reporting is readily done through mobile devices.  Tablets can be used to deliver policies, training, and other interactive content to employees, particularly those without desktop workstation access or as a mobile kiosk for a group of employees.  Mobile devices can be used in conducting investigations, audits and compliance assessments.  The ability to record pictures and video right into compliance applications will make these processes more efficient and effective.

What are your thoughts on GRC 3.0 and its characteristics?