The GRC Pundit

GRC 20/20’s Michael Rasmussen will explore the following challenges, trends, and best practices in the upcoming webinar: Navigating Uncertainty and Chaos: Key Trends in Risk and Resilience Management

In today’s rapidly evolving business landscape, organizations face an array of complex challenges. They operate in environments that are inherently complex, dynamic, distributed, and frequently disrupted by various internal and external factors. Amidst this uncertainty, effectively managing risk and building resilience has become imperative for organizational success.

As defined by ISO 31000, risk is the effect of uncertainty on objectives. To manage risk effectively, organizations must adopt a holistic approach encompassing a top-down strategic view aligned with objectives and a bottom-up operational perspective embedded within processes and activities. This aligns with the OCEG definition of GRC where GRC is a capability to reliably achieve objectives [GOVERNANCE], address uncertainty [RISK MANAGEMENT], and act with integrity [COMPLIANCE].

Today’s organization needs to be agile in managing risk and its impact on the organization’s objectives from the moment it is developing on the horizon, as well as resilient in recovering from risk events when they materialize.

However, the modern organization faces many challenges in addressing an integrated risk and resilience management approach. These include:

1. Lack of Risk Agility. Organizations often struggle to respond promptly to emerging risks due to rigid processes and hierarchies. Failure to adapt quickly to changing circumstances can lead to missed opportunities or unanticipated threats.
2. Fragmented & Inaccurate Risk Data. Siloed data across disparate systems makes it challenging to obtain a comprehensive view of risks. Inaccurate or outdated data undermines the reliability of risk assessments and decision-making processes.
3. Limited Visibility. Limited visibility into interconnected risks and dependencies hampers the ability to anticipate and mitigate potential impacts. Organizations are vulnerable to cascading failures without a clear understanding of the full risk landscape.
4. Inefficient Risk Manual Processes. Manual and disjointed risk management processes result in inefficiencies and delays. Hundreds or thousands of out-of-sync documents, spreadsheets, and emails encumber these. The lack of automation and standardized workflows impedes timely identification and response to risks.
5. Inadequate Risk Reporting. Traditional risk reporting methods often fail to provide actionable insights or meaningful context. Poorly structured reports obscure critical risk information and hinder informed decision-making.
6. Limited Scalability. Scalability challenges arise when existing risk management practices cannot accommodate growth or organizational changes. Scaling risk management efforts across multiple business units or geographies becomes increasingly complex.
7. Resource Intensiveness. Resource constraints, both in terms of personnel and technology, hinder effective risk management efforts. Limited resources result in suboptimal risk mitigation strategies and increased vulnerability.
8. Ineffective Collaboration. Siloed organizational structures and cultural barriers inhibit collaboration and information sharing. Lack of cross-functional collaboration undermines the ability to identify and address systemic risks.
9. Resilience Planning Gaps. Inadequate focus on resilience planning leaves organizations vulnerable to disruptions. Failure to anticipate and prepare for potential risk events can lead to significant operational disruptions and financial losses.
10. Difficulties in Business Change Management. Resistance to change and organizational inertia pose challenges to keeping risk current as the business evolves..

To address these challenges, organizations must transition to bring risk and resilience management together in an integrated function as part of a broader GRC strategy. This function should be focused on enabling the organization to reliably achieve objectives in the midst of risk and uncertainty.

This requires a unified view of risk information and processes that deliver greater efficiency, effectiveness, resilience, and agility. By centralizing risk management functions and integrating risk accountability throughout all levels of the organization, organizations can achieve a more holistic understanding of risks and opportunities.

Leveraging technology solutions such as advanced analytics, artificial intelligence, and automation can enhance risk agility and enable proactive risk management strategies. Ultimately, a comprehensive risk and resilience management approach empowers organizations to navigate uncertainty with confidence, proactively prepare for potential risks, and effectively respond to disruptions when they occur.

GRC 20/20’s Michael Rasmussen will explore the following challenges, trends, and best practices in the upcoming webinar: Navigating Uncertainty and Chaos: Key Trends in Risk and Resilience Management

Before COVID, I ran several Spartan races. The challenge of being outdoors and running down the trail while overcoming obstacles to finish the race . . . what a rush! The final accomplishment of achieving the objective of the finish line by leaping over the fire is an accomplishment.

In the ever-evolving landscape of uncertainty in achieving business objectives, organizations are like endurance athletes on a rugged trail encountering obstacles. Each turn and dip holds potential risks—yet also opportunities. The athlete’s dual objectives of maintaining speed while avoiding missteps mirror the organizational imperative of risk agility and resilience. This analogy paints a vivid picture of the strategic approach necessary for navigating today’s business environment to achieve objectives and sets the stage for a deeper understanding of integrating resilience (formerly business continuity) into risk management as part of a broader integrated GRC (governance, risk management, and compliance) strategy.

The Trail Ahead: Navigating with Agility

Imagine an athlete traversing a complex trail network with obstacles. Their success hinges on their ability to quickly perceive changes in the terrain and adjust their path accordingly. Similarly, organizations must cultivate risk agility: the capability to rapidly identify and react to risks as they arise on the horizon and plan on the best approach. This agility is crucial in avoiding potential pitfalls and capitalizing on opportunities swiftly. What is developing on the horizon may very well be a hazard, or it could be an opportunity, and perhaps both.

The foundation of risk agility lies in the organization’s ability to gain a holistic view of its risk landscape and understand scenarios on what is developing on the horizon. Modern businesses operate in a dynamic environment where risks such as market volatility, technological disruptions, economic uncertainty, and geopolitical shifts can arise suddenly and with little warning. Organizations that continuously monitor these horizon risks and opportunities can adapt their strategies proactively rather than reactively to achieve their objectives. For instance, a company might use predictive analytics to detect emerging market trends and technological innovations, allowing it to pivot its operations to exploit new market opportunities or mitigate potential disruptions from competitors. Scenario analysis, simulations, and table-top exercises are critical to navigating uncertainty/risk.

Staying the Course: The Resilience to Recover

No matter how agile an athlete—or an organization—might be, missteps are inevitable. Resilience is the ability to recover quickly from these setbacks, whether they are minor or catastrophic. For businesses, this means having systems and processes that can absorb the impact of a risk event and quickly return to normal operations or, in some cases, a new, more effective operational state. Organizations need strategic and operational intelligence on how the business operates and recovers.

Resilience in business is multifaceted, involving financial stability, operational redundancy, and a strong organizational culture that can withstand and adapt to challenges. For example, a multinational corporation might have backup supply chains to ensure continuity in the face of regional disruptions, such as what we are seeing on the Eastern seaboard of the USA with the bridge collapse in Maryland. Similarly, fostering a culture that encourages rapid problem-solving and adaptation among employees can enhance an organization’s ability to stabilize operations during and after a crisis.

From Continuity to Resilience: The Evolution of Strategy

The evolution from business continuity planning to operational resilience marks a significant shift in organizational strategy. Traditional business continuity focuses on recovery and restoration of operations post-disruption. In contrast, operational resilience is an ongoing strategy that integrates risk and resilience management into the very fabric of business operations, aiming not just for recovery but for continuous operation under adverse conditions.

This strategic shift requires organizations to rethink their approach to risk. It involves integrating risk management with strategic planning processes, ensuring that potential risks are considered in decision-making at all levels. It also means investing in technology that can provide comprehensive risk intelligence, such as systems that offer real-time insights into global operations, supply chains, and market conditions.

Implementing a Holistic Approach: Strategy, Process, Intelligence, and Technology

Achieving risk agility and resilience necessitates a concerted effort across four domains: strategy, process, intelligence, and technology.

1. Risk & Resilience Management Strategy. First, the strategy must align with the organization’s long-term goals and include a clear framework for risk and resilience management. This strategic alignment ensures that every part of the organization understands its role in mitigating risks.
2. Risk & Resilience Management Processes. Second, processes must be designed to support agile and resilient operations. This involves creating standard operating procedures that include risk assessments, scenario analysis, response protocols, and continuous learning cycles where insights from past incidents are used to strengthen future resilience.
3. Risk & Resilience Management Intelligence/Information. Third, strong risk and resilience intelligence enables the strategy and process. The ability to take in feeds of information on geo-political risk, market/economic risks, uncertainty, supplier and vendor alerts, and more. The organization needs complete 360° situational awareness, which requires intelligence feeds.
4. Risk & Resilience Management Technology. Finally, technology is crucial in enabling risk agility and resilience management. Advanced data analytics, artificial intelligence, and machine learning can provide organizations with the tools to predict, detect, and respond to risks in real-time. These technologies also support decision-making processes, ensuring that data-driven insights are available to guide strategic choices and provide structured workflow, accountability, reporting, and dashboards.

Conclusion: Leading the Race with Agility and Resilience

Just as an endurance athlete relies on both agility to navigate the trail ahead and resilience to overcome the inevitable falls, modern organizations must integrate these capabilities into their GRC strategies to integrate resilience into enterprise risk management strategies. The journey from traditional business continuity to operational resilience is complex and challenging but ultimately rewarding and becomes part of enterprise risk management that flows into the broader GRC, which enables an organization “to reliably achieve objectives [governance], address uncertainty [risk management], and act with integrity [compliance].” By fostering a culture of continuous adaptation and learning, organizations can not only survive but thrive in the face of uncertainty; to thrive on risk. This requires a comprehensive approach that blends strategic foresight with robust processes and cutting-edge technology, ensuring that the organization remains competitive and capable of overcoming any obstacle in its path.

GRC 20/20 Risk & Resilience Events & Resources

Upcoming Webinars

• May 1 @ 9:00 am – 10:00 am CDT, Navigating Uncertainty and Chaos: Key Trends in Risk and Resilience Management
• April 30 @ 8:00 am – 9:00 am PDT, Modern Enterprise Risk Management 
• May 1 @ 4:00 pm – 5:00 pm BST, Building a Robust and Resilient Supply Chain through Third-Party Risk Management
• May 2 @ 10:00 am – 11:00 am EDT, Compliance Countdown: Accelerating Cyber Resilience Initiatives

Illustration

• Risk & Resilience Management Technology Illustrated

Research Briefing

• April 29 @ 10:00 am – 11:30 am CDT, 2024 Buyers Guide: Risk & Resilience Management Solutions

Research Papers

• Risk & Resilience Management by Design

• Risk & Resilience Management Maturity Model

Upcoming Workshop

• April 24 @ 9:00 am – 6:30 pm BST, Risk & Resilience Management by Design Workshop, LONDON

In the ever-shifting terrain of the business world, where unpredictability, risk, and disruption are the only constants, organizations are pushed to find stability and success in achieving their objectives. It’s a high-stakes game of chess where unseen forces can influence every move. Governance, Risk Management, and Compliance (GRC), done properly, is an integrated capability that guides organizations to reliably achieve objectives, navigate the volatility of uncertainty, and act with integrity.

The Open Compliance and Ethics Group (OCEG) has crafted a definition of GRC that succinctly encapsulates this mission: “GRC is a capability to reliably achieve objectives [governance], address uncertainty [risk management], and act with integrity [compliance].” This definition resonates with ISO 31000’s description of risk management: “Risk is the effect of uncertainty on objectives.”

However, in the past, too often, GRC has been more CRG, or just CR, or just C. Organizations focus on compliance and not what true GRC, as it has been defined for the past 22 years, aims for: a better-run business.

This backdrop sets the stage for what we know as “GRC 6.0: Business Integrated & Aligned GRC”—the enablement of an organization’s capability to absorb shock and drive performance. This approach isn’t just about meeting compliance requirements but embedding the essence of GRC into the very fabric of business processes, thus enabling an organization to dance in rhythm with the dynamic beat of the market.

Business Integrated GRC draws its lineage from GRC 4.0 Agile GRC—characterized by its adaptable low-code/no-code GRC solutions—and the analytical prowess of GRC 5.0 Cognitive GRC, which extends Agile GRC with artificial intelligence. With the dawn of the 6th generation, we are witnessing an era where GRC is no longer an add-on but a core aspect of business strategy and execution.

Consider the analogy of a symphony orchestra I have used before, where each section—strings, brass, woodwinds, and percussion—plays a vital role in a harmonious performance. Strategy, objectives, and performance management form the conductor, orchestrating the overall vision, aligning risks with organizational goals, and monitoring performance while ensuring each plays their part to act with integrity/compliance. This is coordinated across departments but also involves a GRC architecture (GRC 3.) that can have a central platform but integrates and allows best of breed point GRC solutions to provide their deeper value.

The woodwinds—an organization’s subtle yet crucial tones—are akin to Business Process Modeling & Enterprise Architecture, which are critical for understanding the business and, in that context, how the business operates. These are essential components of GRC that enable greater risk agility and resilience. Here, we define and construct the processes, ensuring they are robust yet flexible enough to incorporate risk and controls elegantly.

Business Management Platforms are the strings section, the foundation that allows complex compositions to be executed seamlessly, ensuring that GRC is woven into the notes composing the business’s daily operations, activities, transactions, and relationships. GRC should be baked into business processes and activities.

And what about the percussion—the heartbeat of the orchestra? This represents our Top-Down and Bottom-Up Risk Alignment, ensuring that every beat resonates from the boardroom to the front lines, each thump echoing the organization’s risk profile. This brings rhythm to the organization, like ancient war galleys beating the drum to keep the rowers of the boat synchronized and moving forward.

The automation of business controls enhances this into and within business processes, introducing the precise tempo, like a metronome, maintaining the cadence of compliance and integrated controls without missing a beat.

Risk quantification, aggregation, and visualization in the context of the organization’s objectives become the meticulous tuner of the orchestra, ensuring each note played aligns with the key. It offers an objective measure of the impact of risk on performance and objectives.

This enables the organization to achieve greater levels of risk agility and resilience. It’s the organization’s ability to improvise when a surprise solo breaks in or when the composition changes mid-performance. It’s the agility to keep playing, to adjust and adapt, ensuring the music doesn’t stop, and the resilience to recover and bring it all back together.

Finally, engaging the right brain, not just the left brain, not GRC, and particularly risk management means engaging the creative maestro within, calling forth innovation in risk thinking, and weaving the artistic with the analytic to master the performance in the grand theatre of business objectives, strategy, and performance.

As we delve deeper into the 6th generation of GRC, we are not just integrating GRC into the business; we are making it the very essence of how business is conducted, ensuring that with every twist and turn, with every rise and fall, the organization not only survives but thrives, playing its symphony of success amidst the cacophony of the market.

In a world reminiscent of the Wild West, where Artificial Intelligence (AI) roamed free and unbridled, businesses and organizations for the past few years have harnessed its power, at times haphazardly, to propel themselves into a future filled with promise and potential. 

However, the flip side of this unchecked freedom was a landscape riddled with risks – data privacy breaches, bias, opaque decision-making, and more. As the dust settles, a new sheriff has arrived – the EU AI Act, heralding an era of strict AI governance, what GRC 20/20 calls AI GRC (AI Governance, AI Risk Management, and AI Compliance), that requires extensive testing of AI systems, especially those considered high-risk.

OCEG defines GRC as “a capability to reliably achieve objectives, address uncertainty, and act with integrity.” Adapting this definition of GRC to address the specifics of AI GRC, AI GRC is the capability to reliably achieve the objectives of AI models and their use, address uncertainty and risk in the use of AI, and act with integrity in the ethical, legal, and regulatory use of AI in the organization’s context. 

The EU AI Act, much like the mythical lawmen of the 1800s, seeks to bring order to a chaotic frontier of AI use within organizations. Its scope extends beyond the borders of Europe, influencing global businesses that must respond to it. The implications are monumental, with the act imposing obligations on any entity operating within or dealing with the EU’s member states and its citizens. The most alarming of these is the potential fine for non-compliance, which can reach up to 35 million euros or 7% of global turnover, underscoring the act’s seriousness in enforcing responsible AI usage.

The EU AI Act categorizes AI systems based on the level of risk they pose, with “high-risk” AI systems receiving particular attention due to their potential impact on safety and fundamental rights. 

For these high-stake scenarios, organizations must now ensure data quality, enhanced protection measures, and adherence to ethical standards. The act also bans specific uses of AI that are considered harmful, such as certain types of biometric identification and social scoring systems, bringing a more humane and ethical approach to AI development and deployment.

AI systems classified as high-risk encompass technologies used in various critical sectors:

• Critical Infrastructures. Such as transport systems, where AI can significantly impact citizens’ safety and health.
• Education and Vocational Training. For instance, AI that scores exams, potentially influencing educational paths and career trajectories.
• Product Safety Components. For example, AI applications in robot-assisted surgery and medical devices.
• Employment and Worker Management. Including CV-sorting software for recruitment, which can affect employment and self-employment opportunities.
• Essential Services. Examples include AI in credit scoring that could deny loans to individuals.
• Law Enforcement. AI systems that might infringe upon fundamental rights, such as tools evaluating evidence reliability.
• Migration, Asylum, and Border Control. This covers AI tools like automated visa application processing.
• Justice and Democratic Processes. AI systems used in searching for court rulings are examples here.

These high-risk AI systems are subject to stringent conditions before market release/use. This includes rigorous data management and documentation processes, high levels of transparency, and accountability to ensure that risks are managed effectively. The aim is to prevent or mitigate potential harms or violations of individual rights and freedoms arising from using AI in these critical areas. It reminds me of the testing and validation that has to be done in FDA-validated systems in life sciences. Organizations operating high-risk AI systems need to address:

• Thorough AI risk assessment and mitigation strategies.
• Assurance of high-quality datasets to minimize risk and avoid biased outcomes.
• Comprehensive activity logs for result traceability and AI usage.
• In-depth documentation for AI assessment and validation by authorities.
• Clear, detailed information for AI users.
• Measures for adequate human oversight of AI to reduce risk.
• Exceptional robustness, security, and accuracy controls built into AI.

Then, there are limited-risk AI systems. The term “limited risk” in AI mainly pertains to transparency issues. The AI Act mandates explicit transparency obligations to ensure users are informed when interacting with AI systems, like chatbots, so they can make knowledgeable decisions. Moreover, providers must label AI-generated content, including texts, audio, and video (especially deep fakes), particularly when intended to inform the public on significant issues, indicating their artificial origin.

Finally, there are minimal or no-risk AI systems. The AI Act permits the unrestricted usage of AI systems posing minimal risk, such as AI-enhanced video games or spam filters. Most AI systems currently used in the EU are categorized within this minimal-risk bracket.

The EU AI Act isn’t merely a set of prohibitions; it’s a comprehensive framework demanding a paradigm shift in how organizations develop, deploy, and manage AI. Transparency becomes paramount, particularly for high-risk AI systems, where developers must provide detailed information about their functioning, data usage, and human oversight mechanisms. This level of transparency aims to mitigate the risks associated with the ‘black box’ nature of advanced AI algorithms.

Preparing for the New EU AI Act Frontier – What Organizations Should Do

Organizations must adapt to survive and thrive in this new environment as the AI Act reshapes the landscape. Here’s a roadmap to help navigate these changes:

• AI GRC Oversight. Establish a robust AI governance framework, combining the right policies, roles, and an inventory system that aligns with organizational objectives and values.
• AI GRC Lifecycle Management. Implement a comprehensive lifecycle approach encompassing AI acquisition, development, use, maintenance, and eventual retirement to ensure effective governance across all stages of AI usage.
• Developing and Maintaining an AI Inventory. Undertake a thorough AI discovery process to catalog all AI technologies used within the organization. This inventory should be regularly updated and include details like ownership, development history, and documentation of each AI model.
• Validation and Control. Emphasize the importance of validating AI models for quality and reliability and embed controls throughout the AI components to ensure proper use and prevent misuse.
• Continuous Monitoring and Assurance. Regularly audit and assess AI systems to confirm they function as intended, comply with set standards, and adapt to changes in the business environment.
• Technology and Information Architecture. Build a technology architecture that supports AI GRC management. This includes model management, robust data management capabilities, compliance tracking, and integration with other organizational systems.
• Ethical and Transparent AI Usage. Foster an organizational culture that values ethical AI usage and transparency. Ensure your AI systems are understandable (explainable) and within ethical guidelines and legal boundaries.

The arrival of the EU AI Act marks the end of the AI Wild West. It mandates a structured, responsible approach to AI, emphasizing governance, risk management, and compliance. Organizations worldwide must now saddle up and journey through this new landscape, ensuring their AI initiatives align with this more structured and ethically responsible future. The new law is in town, and it’s reshaping the AI frontier – one regulation at a time. See what GRC 20/20 has to say about this in our research report, A.I. GRC: The Governance, Risk Management & Compliance of A.I.

In today’s rapidly shifting business landscape, where uncertainty seems to be the only constant, Governance, Risk, and Compliance (GRC) strategy, process, and technology are more critical than ever. This era is marked by a kaleidoscope of challenges: geopolitical instabilities, economic volatility, and a relentless pace of technological innovation. In my recent webinar with MetricStream’s Patricia McParland, GRC Trends and Strategies to Accelerate Risk, Compliance, and Audit Programs in 2024 and Beyond, I had the privilege of diving into this whirlpool of change to explore emerging GRC trends and strategies for 2024 and beyond. 

When I reflect on the state of global business today, I see . . .

[The rest of this blog can be read on the MetricStream blog, where GRC 20/20’s Michael Rasmussen is a guest author]

In today’s rapidly evolving corporate landscape, the need for an enterprise view into Governance, Risk Management, and Compliance (GRC) is more pronounced than ever. One that truly addresses the official definition of GRC, found in the OCEG GRC Capability Model, that GRC is a capability to reliably achieve objectives (governance), address uncertainty (risk management), and act with integrity (compliance).

As the industry analyst that first framed and defined GRC and the GRC market for software and services on a cold snowy day in February 2002 (while at Forrester Research, I spent 7 years there and now 17 years competing against Gartner and Forrester), I have seen GRC technology evolve. There are 69 solutions that I cover deeply in my market analysis, and over 200 others that I monitor in the market. While there are some great solutions in the market, many that I deeply admire and recommend, there is no perfect solution that brings it all together.

Too often GRC platforms are either built, or just deployed, backwards. They are CRG platforms, or just CR platforms, or too often C platforms that do not understand the R and the G.

In envisioning the ideal GRC platform, we dream of a platform that not only addresses current needs but also anticipates future challenges, thereby revolutionizing the way organizations address and integrate governance, risk management, and compliance. There will always be a need for GRC architecture where best-of-breed solutions and content can integrate. But the overall command and control center that brings this together still needs some work. Some GRC solution providers are well on their to address this, but no one has arrived. Of course, with technology continuously evolving, will we ever arrive? It is a continuous journey.

Here is my wish list for the Ultimate GRC Platform . . .

• Uniting Board Portal Excellence with Strong Governance. The dream begins with a solution that excels in integrating the board portal with robust governance mechanisms that filter down into strategy, performance, and operations. This system should provide an intuitive interface for board members, ensuring seamless access to vital information, fostering effective decision-making, and promoting transparent governance practices. The ideal platform will serve as a cornerstone for board-related activities, offering a blend of security, user-friendliness, and comprehensive functionality.
  • Currently, there is one primary solution provider in the market that is focused on this and a few others that have some capabilities.
• Strategy, Performance, and Objective Management. Central to this GRC platform and architecture is a deep capability focused on strategy, performance, and objective management. One that enables the organization to define and map corporate strategy, define objectives, and monitor performance against those objectives. Remember that the G in GRC is governance, which is the capability to achieve objectives reliably. Objectives can be entity-level objectives and drill down into division, department, process, project, asset, or even third-party/supplier objectives. Objectives can be financial, performance, operational, ethical/value, compliance, and more. GRC starts with objectives when done correctly. However, most solutions do not cover this. This element ensures that the GRC processes are not just regulatory checkboxes but are intrinsically linked to the organization’s strategic objectives and performance indicators. Doing so aligns GRC activities with the company’s broader goals, creating a cohesive and forward-looking approach.
  • Currently, there are two solutions in the market that I monitor that do this well. Others may have some very rudimentary capabilities, but it is more of an after thought than anything of real value.
  • Also, I get frustrated when I see solutions/modules for ESG that start with ESG risks and not objectives. That is putting the cart before the horse. I DO NOT recommend solutions for ESG (see more below) that start with a risk-centric view.
• Elevating GRC and ESG Reporting. A critical feature of this dream architecture is its prowess in GRC and Environmental, Social, and Governance (ESG) reporting. The number one complaint on nearly all client reference calls of GRC platforms is reporting. Nobody likes the reporting. NOTE: Dashboards are not reports; they are different. Acknowledging the common denominator in client feedback – the need for enhanced reporting capabilities – this solution must offer sophisticated reporting tools. These tools should cater to various stakeholders, including the board, regulators, and internal teams, ensuring clarity, assurance, and alignment with organizational goals.
  • Currently, there is one solution that comes to mind that excels in reporting (again, not dashboards) in the market for GRC, ESG, and compliance reporting.
• Risk Quantification & Visualization. Honestly, this needs A LOT of work. Every platform is marketing risk quantification, but most get it wrong, terribly wrong. And many are very broken when it comes to things like risk normalization and aggregation. Myself, I am a big fan of bow-tie risk assessments and visualizations (I am a right-brain risk thinker), and I respect Monte Carlo analysis and other risk quantification methodologies (but many solutions have a half-baked attempt at Monte Carlo analysis). Solutions that can bring both together excite me, but few do.
  • Currently, there are a handful of solutions that I feel truly do risk quantification and visualization well.
• Addressing Operational Needs in GRC. This dream solution dives deep into the operational aspects of GRC, encompassing enterprise and operational risk management, internal control, compliance, ESG management, audit, policy management, and more. It comprehensively addresses the intricate, day-to-day elements of GRC, ensuring no aspect is left unmanaged.
  • This is an area where many solutions do things well in specific areas. Some are great at EH&S, others great at IT risk management, others at continuity and resilience, others at third-party risk. Some have done very well across these domains in GRC.
• Integration with Specialized GRC Solutions. Understanding the diversity in GRC needs, this platform/architecture would no just stand-alone but would seamlessly integrate with best-of-breed solutions specializing in areas like third-party risk, IT risk, and Environmental Health & Safety (EH&S) when and where it makes sense. This integration ensures that organizations benefit from specialized expertise without sacrificing the cohesion of a unified GRC platform.
  • Some solutions excel at their ease of integration with other systems, whether GRC specialty/domain-specific solutions or broader business systems. Others do not integrate so well.
• Leveraging AI in Cognitive GRC. At the heart of this architecture lies a next-generation, AI-driven #CognitiveGRC platform. This system uses artificial intelligence appropriately and effectively across various GRC processes, enhancing predictive capabilities, automating routine tasks, and providing deeper insights. The platform may also connect with AI best-of-breed solutions that focus on specific GRC areas, such as regulatory change management or third-party risk intelligence, harnessing the power of technology to drive smarter, more efficient compliance and risk management.
  • We are seeing a lot of shifts in the market right now. Some have acquired CognitiveGRC capabilities to extend their GRC platform, others have partnered, and others are building this. Unfortunately, there is a lot of smoke and mirrors regarding AI. There are some great solutions delivering value, but there is also a lot of marketing hype for what may exist and be developed.
• Built on Agile, No-Code, Low-Code Principles. Finally, the foundation of this GRC dream is an #AgileGRC architecture, developed in a true #nocode and #lowcode environment. This approach ensures that the system is not only advanced and robust but also highly configurable and adaptable to an organization’s specific needs. Such flexibility is crucial in a dynamic business environment, allowing companies to respond swiftly to changes without being hindered by their GRC systems.
  • This is a huge frustration for me. Some “low-code” solutions are really hiding behind marketing where they are still “high-code.” Others advertise themselves as “no-code” but are completely rigid and not agile. They may be a beautiful platform, but you cannot adapt it to your business, you have to adapt your business to it.
  • The true “no-code” solution is highly configurable and agile to adapt to the organization’s needs. A handful of solutions in the market are truly addressing this, while others slap these terms on for marketing and not reality.

In conclusion, the envisioned GRC platform of the future is more than just a tool – it’s a strategic partner for organizations, adeptly navigating the complex world of governance, risk, and compliance. With this dream architecture, we are not just solving today’s challenges but are also paving the way for a more adaptable, intelligent, and integrated approach to GRC in the future.

Have a question on GRC solutions in the market that are the best fit for your particularly needs? Ask GRC 20/20 as we offer complimentary inquiry to help you navigate the breadth and depth of solutions available in the market . . .

Check out these upcoming Research Briefings on the market . . .

April 29 @ 10:00 am – 11:30 am CDT 

• 2024 Buyers Guide: Risk & Resilience Management Solutions

April 8 @ 10:00 am – 12:00 pm CDT 

• 2024: How to Market & Sell GRC Solutions & Services

Here is an on-demand Research Briefings on the market . . .

• 2024 State of the GRC Market

Continuing on my feudal Japan theme on GRC, after my last blog on Who Will be the GRC Platform Shogun? and my excitement for the new miniseries on Disney+/Hulu/FX, here we explore the Samurai art of the sword in the Book of Five Rings and apply it to the world of GRC . . .

In the dynamic, disrupted, and distributed business world, the integrated and interdependent disciplines of Governance, Risk Management, and Compliance (GRC) are akin to an art form – a delicate balance of strategy, foresight, insight, and ethical practice. This complex interplay can be beautifully likened to the wisdom found in Miyamoto Musashi’s revered treatise, “The Book of Five Rings.” Just as Musashi’s text offers guidance in the martial art of the sword, my conceptual framework of “The Book of Five GRC Rings” is a philosophical and practical guide to mastering the essential elements of GRC in today’s corporate world.

At the core of this analogy is the profound definition provided by OCEG, where I serve as an OCEG GRC Fellow. This definition describes GRC as “the capability to reliably achieve objectives (Governance), address uncertainty (Risk Management), and act with integrity (Compliance).” This definition underscores the interconnected nature of these three facets and emphasizes the importance of harmonizing them to create a resilient, agile, and ethical organization of integrity driving what OCEG calls Principled Performance.

In “The Book of Five Rings,” Musashi identifies the elements of ground, water, fire, wind, and the Void as the basis of his strategy. When translated into the context of GRC, these elements become powerful metaphors that encapsulate the essence of each discipline. They serve as a foundation for understanding the nuances and intricacies of navigating modern business’s complex and often turbulent world.

This analogy creating The Book of Five GRC Rings sets the stage for a deeper exploration into how these ancient principles can be applied to modern-day challenges in the corporate sphere. It invites leaders and practitioners alike to embark on a journey of discovery, learning how to meld the timeless wisdom of Musashi’s rings with the practical demands of effective governance, risk management, and uncompromising organization integrity. This journey is about embracing a holistic approach that ensures an organization can achieve objectives and navigate and leverage uncertainty for long-term success with integrity.

Here are the Five GRC Rings . . .

• The First Ring: The Ground – Governance. The ground represents the stable foundation upon which all else is built. In GRC, this is Governance – an organization’s strategy framework and objectives. Like a samurai’s stance, governance must be solid, providing the structure and direction for all organizational activities. It entails defining the mission, setting clear objectives, and establishing the organization’s guidelines. The agility of governance lies in its ability to adapt and evolve with the changing business landscape, ensuring that objectives are consistently met efficiently and effectively.
• The Second Ring: Water – Risk Management. Flowing like water, Risk Management is adaptive, constantly changing to meet the contours of the business terrain. It involves identifying, assessing, and mitigating uncertainty/risks that may hinder the organization’s ability to meet its objectives. Like a warrior who anticipates and counters the moves of an adversary, effective risk management requires an organization to be both reactive and proactive, adapting its strategies to ever-changing risks and uncertainties. An organization’s resilience is tested through its risk management practices, ensuring it can withstand and recover from adversities.
• The Third Ring: Fire – Compliance. Compliance is the fire that fuels integrity within an organization. It is the passionate adherence to values, ethics, ESG commitments, laws, regulations, standards, and industry practices. Compliance should be controlled and monitored like fire, ensuring it does not become destructive. Compliance ensures that an organization acts responsibly, maintaining its reputation and avoiding legal pitfalls. The integrity of an organization is epitomized in its compliance, demonstrating a commitment to lawful and ethical conduct.
• The Fourth Ring: Wind—Agility. Agility is the wind, invisible yet powerful, symbolizing an organization’s ability to respond quickly and effectively to change. In the context of GRC, agility refers to an organization’s nimbleness in adapting its governance, risk management, and compliance strategies to the dynamic business environment. It encompasses the capacity to foresee changes, make informed decisions swiftly, and implement them efficiently to maintain strategic direction and integrity.
• The Fifth Ring: The Void – Resilience and Integrity. The final ring, the Void, represents the unknown, the challenges and opportunities that have yet to emerge. In GRC, this equates to the overarching themes of resilience and integrity. Resilience is an organization’s ability to endure, recover, and grow in the face of uncertainty and change. On the other hand, integrity is the ethical compass that guides every action and decision, ensuring that the organization remains true to its values and objectives in the context of uncertainty and change.

Mastering GRC is akin to the way of the samurai, a path of discipline, strategic thinking, and ethical action. The five rings – Ground, Water, Fire, Wind, and the Void – provide a framework for understanding and excelling in the complex world of governance, risk management, and compliance. By embodying these principles we have explored together, organizations can navigate the ever-changing business landscape with wisdom and strength, much like the legendary samurai masters of old. This is the essence of the Book of Five GRC Rings – a guide for the modern GRC warrior.

In 1980, I fell in love with feudal Japan. Why? I was 10 years old and watched the NBC miniseries Shogun with Richard Chamberlain . . . samurais, ninja, everything needed to captivate the imagination of a young boy. I immediately read the huge book Shogun by James Clavell (1300 pages), which I have now read three times. Completing it for the third time a month ago getting ready for the new miniseries of Shogun on Hulu/FX. Yes, I had a watch party in my office on February 27th to watch the new Shogun! And yes, I wore a samurai kimono and zoroye complete with samurai swords to the watch party (reply and ask me for pictures). The watch party had sushi (my oldest son is a master sushi chef in Milwaukee), sake, Japanese whiskey, and Japanese beer).

As the GRC Pundit and market/industry analyst, I often reflect on the dynamism and complexity of the GRC technology market. This market resembles the vivid narrative of James Clavell’s novel Shogun. In this grand tale, just as in the GRC industry, numerous GRC technology/solution players are vying for dominance, alliances are ever-shifting, and strategy is key to survival and triumph.

Imagine the GRC technology solutions as the various feudal lords and samurai depicted in “Shogun.” Some are the daimyos that represent the GRC platforms that try to outmaneuver each other for market dominance. Others are samurai that serve these daimyos that are best-of-breed focused GRC solutions that extend capabilities, but at times shift alliances. Others are ronin, samurais with no masters and alliance.

Each daimyo, with his unique strengths and weaknesses, competes for influence and power in feudal Japan, much like how GRC vendors strive to innovate and differentiate their offerings in the market. The goal for these lords is to become the Shogun, the supreme military dictator, paralleling how GRC vendors aspire to lead the industry, to be GRC Shogun! Success requires great technology, but also alliances with other GRC best-of-breed technology solutions, professional service firms, and GRC content/intelligence providers.

Mergers and acquisitions in the GRC field are akin to the strategic marriages and alliances formed in the book. These unions are about gaining power and acquiring new capabilities, expanding territorial reach, and neutralizing threats, much like how GRC vendors merge with or acquire others to enhance their technological capabilities, expand market presence, and eliminate competition. And 2024 has shown quite a few M&A activities that have already gone public and much more in play yet to be announced that I have interacted on.

Similarly, partnerships in the GRC technology market resemble the shifting alliances between the daimyos (feudal lords) in “Shogun.” These tactical alliances are often formed to gain a strategic advantage over a common foe or enter new domains. In the GRC world, such partnerships might involve collaborating on joint ventures, integrating complementary technologies, or co-developing new solutions to meet emerging market needs.

The intrigues and power struggles within “Shogun” mirror the competitive dynamics in the GRC market. Just as the characters in the novel employ diplomacy, espionage, and warfare to outmaneuver their rivals, GRC vendors use market research, competitive intelligence, and strategic marketing to gain an edge. Something that GRC 20/20 specializes in and is better than any other market research firm on the planet. My very existence.

As in the novel, where the characters must adapt to a rapidly changing environment and unforeseen events, GRC vendors must also be agile, responding swiftly to regulatory changes, evolving risk landscapes, and technological advancements. This agility is crucial to survival and success in the quest to become the GRC Shogun. This is definitely the case with GRC solutions figuring out their artificial intelligence (Cognitive GRC) strategies, which are causing further acquisitions and alliances.

Lastly, the depth and breadth of the characters’ skills and alliances in “Shogun” can be likened to the range of solutions and services offered by GRC vendors. Just as a well-rounded character is more likely to succeed, a vendor that offers a comprehensive suite of solutions and services, which includes professional service and GRC content/intelligence partnerships, tailored to diverse and evolving needs, is more likely to lead in the GRC market.

The quest to become the GRC Shogun is a complex and dynamic journey, much like the intricate plot of “Shogun.” As an analyst, I provide insight into this fascinating market, helping businesses navigate the ever-changing landscape and understand the differentiators that set each vendor apart. Just as in “Shogun,” where strategy, alliances, and adaptability determine the ultimate victor, the same principles apply in the quest for leadership in the GRC technology market.

My role is to provide objective and independent evaluation and insight into the breadth and depth of the players in the GRC market to help organizations select the right solution that fits their specific needs and strategy. It is my job to evaluate and forecast where the market is headed and what differentiates players and to predict who is capable of being the GRC Shogun to dominate this market.

Have a question on GRC solutions (whether broad platform or specific best-of-breed focused solutions), ask an inquiry . . .

As I engage with risk professionals around the world, I can’t help but notice a distinctive shift in risk management thinking and approach that is evolving. I have increased mature interactions, particularly in Europe, where risk management seems to be more intricately aligned with business objectives, transcending the mere compliance exercise often associated with risk management in the USA with Sarbanes Oxley.

The key to this is . . .

[The rest of this blog can be read on the Inclus blog, where GRC 20/20’s Michael Rasmussen is a guest author]