Blog

The 3 Lifecycle Stages of Vendor Security Risk Management: Onboarding

The GRC Pundit BlogPublished onUpdated onLeave a Comment on The 3 Lifecycle Stages of Vendor Security Risk Management: Onboarding

This is the first of a three-part series on vendor risk management through the lifecycle of the relationship. Today, we focus on steps to achieve a proper and friction-free onboarding process.

The Vendor Relationship: Stages in the Lifecycle

Traditional brick and mortar business is a thing of the past: physical buildings and conventional employees no longer define organizations. The modern organization is an interconnected mess of relationships and connections that span traditional business boundaries. Complexity grows as these interconnected relationships, processes, and systems nest themselves in intricacy. Today, business is interconnected in a flat world in which over half of the organization’s ‘insiders’ are no longer traditional employees, but are third parties such as contractors, consultants, temporary workers, outsourcers, service providers, and vendors.

An organization can face disruption and disaster by establishing or maintaining the wrong business relationships. Third party security problems are the organizations problems that directly impact the brand and reputation while increasing exposure to risk and compliance matters. When questions of security arise, the organization is held accountable, and it must ensure that third party partners behave appropriately. 

Today’s organization requires complete situational and holistic awareness of third party security and its connection to and impact on operations, processes, transactions, and data. It has become essential that organizations govern third party relationships throughout the lifecycle of the relationship:

  1. Onboarding
  2. Ongoing monitoring
  3. Offboarding

Today we will look at the first stage of onboarding a third party relationship, ensuring the organization is doing business with the right third parties as they are brought onboard before network connections are established and data shared. 

Approaches to Onboarding

There are a variety of approaches to onboarding as part of . . .

[this is a guest blog authored by Michael Rasmussen of GRC 20/20 that can be found at Panorays site, follow the link below to read more]

READ MORE

Compliance Disclosure Solutions: Separating the Simple from the Advanced

Compliance Management Solutions, The GRC Pundit BlogPublished onUpdated onLeave a Comment on Compliance Disclosure Solutions: Separating the Simple from the Advanced

GRC 20/20 is seeing a growing demand for compliance management technologies from the Corporate Compliance and Ethics department (e.g., Chief Ethics and Compliance Officer, Chief Compliance Officer). This demand spans from a broad compliance management platform to manage the range of compliance tasks and activities, to focused solutions in areas such as policy management, third party GRC (e.g., vendor/supplier), issue reporting and case management, and the area of compliance disclosures management.

The inquiries on Compliance Disclosure Management solutions is increasing as organizations look to get a handle on areas such as Conflicts of Interest; Gifts, Entertainment and Hospitality; Political Contributions; and other areas compliance disclosure.

While there are several dozen solutions available in the market that do Compliance Disclosure Management, they are not all created equal. One differentiator is the focus. Some are purpose-built for a specific disclosure area such as Conflicts of Interest, and not to be a platform to address a range of compliance disclosure areas. Others are broad disclosure platforms that are highly agile where the organization can adapt fields and customize forms, workflow, tasks, and reporting to meet a range of compliance disclosure areas. While some compliance disclosure solutions operate in a module in a broader compliance management platform (or GRC platform) where disclosure can be managed and cross-referenced to policies, regulations, risks, assessments, and cases.

GRC 20/20 separates Compliance Disclosure Management solutions in the market into basic and competitive solutions, but then also distinguishes advanced capabilities that separate competitive solutions in the market.

  • Basic compliance disclosure management solutions. These are solutions, and there are many of them, that address the basic forms, workflow, and task management of compliance disclosures management with some basic reporting capabilities. They can present a disclosure form, capture attestations, and route the form through a workflow for review and approval/denial. Most often, but not always, they focus on a single compliance disclosure areas such as Conflicts of Interest.
  • Competitive compliance disclosure solutions. These are the solutions that most often come up in RFPs regularly and have stronger capabilities to manage a breadth of compliance disclosures in the organization. They have more advanced reporting capabilities and provide a stronger portal for the configuration and customization of disclosures. Some key capabilities of competitive solutions are:
    • The ability to manage a breadth of disclosure types
    • Configurable and adaptable to organizations specific needs down to the field and value level
    • Strong graphical workflow builder and task management that allows for parallel as well as linear workflows
    • The breadth of templates for forms and reports on disclosures
    • Strong dashboard and reporting engine with pre-built reports as well as the ability to do custom reports
    • The ability to present the relevant policy, gather attestation to the policy and provide the training with the disclosure
    • Provide for regularly scheduled/periodic disclosure campaigns as well as the ad hoc/triggered disclosures when they arise
    • Ability to manage and document disclosures that are exceptions/exemptions to the defined policy and regularly track and monitor them
    • Provide a robust and legally defensible audit trail/system of record of disclosure related activities
    • Allow for attachments, such as documents/evidence, to disclosures

However, what really separates Compliance Disclosure Management solutions in the market are the advanced capabilities. These include:

  • Disclosure forms and workflow that are highly configurable by the average business user (e.g., citizen developer) without extensive IT knowledge
  • Advanced workflow based on disclosure type and role (e.g, hierarchical workflows)
  • Integration with other business systems, such as HR management systems, to populate information and provide information consistency between systems, or to integrate with ERP systems to pull up transaction history for disclosures related to gifts and entertainment to a particular entity in the past
  • Advanced reporting capabilities, including regulatory reporting in which reports are automatically generated in the format specific regulators are looking for (e.g., securities industry reporting for COI)
  • The ability to define and manage disclosure campaigns to broad and specific employee audiences
  • Integration with policy and training so the disclosure form also includes the written policy as well as training on the policy
  • The ability to provide anonymous reporting on issues related to compliance disclosure
  • Risk management capabilities to measure risk and track key risk indicators (KRIs) related to disclosures
  • Mobile interface/application where disclosures can be reported on smartphones and tablets
  • Collaborative engagement that allows disclosure reviewers and disclosures to communicate and interact back and forth to ask questions and provide more information
  • The ability to provide confidential notes that are encrypted and protected by the disclosure reviewer(s)
  • Provide for follow-up tasks and action items that may be scheduled out in advance to follow-up on disclosures that were approved but needs closer monitoring or other activities

These are some of the advanced capabilities that I am encountering regularly. If you are looking for or evaluating Compliance Disclosure Management solutions, feel free to ask an inquiry of GRC 20/20 . . .

ASK AN INQUIRY

Here are some compliance disclosure and policy management resources and events you should be aware of:

Seminars

Policy Management by Design Workshops

Published/Recorded GRC 20/20 Research

Understanding Third Party GRC Maturity: Defined Stage

The GRC Pundit Blog, UncategorizedPublished onUpdated onLeave a Comment on Understanding Third Party GRC Maturity: Defined Stage

A haphazard department and document centric approach for third party GRC compounds the problem and does not solve it. It is time for organizations to step back and mature their third party GRC approaches with a cross-functional and coordinated strategy and team to define and govern third party relationships. Organizations need to mature their third party governance with an integrated strategy, process, and architecture to manage the ecosystem of third party relationships with real-time information about third party performance, risk, and compliance, as well as how it impacts the organization.

GRC 20/20 has developed the Third Party GRC Maturity Model to articulate maturity in the Third Party GRC processes and provide organizations with a roadmap to support acceleration through their maturity journey.

There are five stages to the model:

  1. Ad Hoc
  2. Fragmented
  3. Defined
  4. Integrated
  5. Agile

Today we look at Stage 3, the Defined level of Third Party GRC

The Defined stage suggests that the organization has some areas of third-party GRC that are managed well at a department level, but it lacks . . .

[this is a guest blog authored by Michael Rasmussen of GRC 20/20 that can be found at Aravo site, follow the link below to read more]

READ MORE

Policy & Training Engagement in a Millennial Generation

The GRC Pundit BlogPublished onUpdated onLeave a Comment on Policy & Training Engagement in a Millennial Generation

As the only analyst covering the range of policy and training management solutions as its own segment of the Governance, Risk Management, and Compliance (GRC) market, I am asked several times a month on who is providing the next generation portal that integrated into one portal both policy communication and training related to the policy. The answer is very few.

Organizations need to rethink how they are managing and communicating policies in their environment. Haphazard approaches that scatter policies across different internal websites and portals in different formats is not relevant to today’s workforce and handicaps the organization in managing policy communication and awareness in an era that requires complete visibility and operational effectiveness and understanding of policies. This is particularly true of the millennial generation.

The young and advancing workforce are highly reliant on mobile technologies, and with integrated experiences. You go out to Facebook and you can watch a YouTube video right there in Facebook. You do not need to click on a link and bounce out to a completely different site to watch the video. Organizations need to integrate policy and training into one portal to engage the front lines of the organization. This portal needs to be interactive, mobile, and highly engaging in bringing policies and training together in an integrated experience. As regulators and law enforcement advance the focus on policies and training as the measurement of an operationally effective compliance program this is not a nice to have, but an essential.

The pillars of an engaging and integrated policy and training portal are that it is:

  • Unified. Employees come to one policy and training portal to find everything needed. Policies are not just documents but integrated resources & tools. Video and resources are integrated alongside written policy.
  • Relevant. The policy portal reflects changes in employee role and context. The most critical “need to know” policies are easy to find. Users can customize and organize the policy portal to their needs.
  • Interactive. Understanding is increased through embedded media. Games, scenarios and interactive content is used to reinforce key points within policies. Pop-ups provide access to definitions & resources in written policies.
  • Social and Personable. Employees can share policies and provide comment and interaction on policies. The portal makes it is easy for employees to get questions answered. The employee has an corporate avatar that is linked to badges and progress in policy and training tasks.

I am presenting a webinar tomorrow, Wednesday, August 28th, on this very topic:

Next week, on August 4th, I am presenting on best practices in policy management:

The GRC 20/20 Policy Management by Design Workshops that dive deep into an interactive and engaging workshop on policy and training management are scheduled for the following cities and dates:

I have two roundtables coming up specifically for financial services on policy management:

GRC 20/20’s flagship research piece on effective, efficient, and agile policy management is:

Please share your thoughts and experiences on engaging employees on policy and training management . . .

The Rhythm of Risk: Managing Risk Throughout the Context of Business

The GRC Pundit Blog, UncategorizedPublished onUpdated onLeave a Comment on The Rhythm of Risk: Managing Risk Throughout the Context of Business

Writing about risk management is like trying to have an intelligent conversation today about religion or politics.

Individuals in the risk management community have polarized views and if someone does not agree with you 100% you end up in the crosshairs of an attack. It is sad. Instead of intelligent discussion where we can come together and learn, there are many ready to pounce if you do not express their exact ideology. Some view risk management as purely top-down from objectives and strategy, others are risk professionals down in the bowels of the organization looking bottom-up. Some feel that risk registers, risk appetite, and other aspects of traditional risk management are meaningless, others see this as the core part of how they have managed risk. Some hate heat maps and qualitative approaches, others live by them. Some, I feel, are simply trying to relabel corporate performance management to be risk management, instead of seeing that risk management is a part of performance management.

While I feel there is objective truth when it comes to matters of religion/theology . . . what if that was not the case for risk management?

  • What if the best approach to risk management brought together the top-down and the bottom-up?
  • Used both quantitative and qualitative methods?
  • Leverages risk registers but does not get locked into thinking only in their context?
  • Knew the weaknesses of a heatmap and how to overcome them while still using them as a visualization tool?

My view of risk management is that all sides of the debate have something valid to bring to the table. To truly do enterprise risk management requires a 360° contextual awareness of risk in the context of performance, objectives, and strategy as well as day to day operations and hazards of the business. Organizations need both a top-down view of risk management in the context of strategy and objectives as well as a bottom-up view of risk down in the weeds of operations and hazards. Good risk management requires both.

My favorite approach to risk management I have encountered in my research was with Microsoft when Brad Jewett was the ERM Director there from 2003 to 2008 (I cannot speak to Microsoft today as I have not interacted with them recently, Brad is now the CFO of Corel Corporation). I have served with Brad as an OCEG Fellow over the years and have a deep respect for him as a risk management professional. Brad defined his approach to risk management at Micorosft as ‘The Rhythm of Risk.’ This he defined by his desire to integrate risk management into daily decision making that would follow the corporate calendar for key processes such as multi-year strategic planning, annual planning, mergers and acquisitions, audit planning, SEC reporting, investor communications, product and service roadmaps, etc. It an aspirational agenda but it set the tone and expectation that risk management was a priority that should Influence and be integrated into the way things get done every day. This included the strategic as well as the operational. The top-down as well as the bottom-up

To maintain the integrity of the organization and execute on strategy, the organization has to be able to see the individual risk (the tree), as well as the interconnectedness of risk to strategy and objecrtives (the forest). Many organizations are asking for this to go even deeper, as they need to see the leaf and branch as it connects to the tree, and how it is part of the forest.

Risk management in business is non-linear. It is not a simple equation of 1 + 1 = 2. It is a mesh of exponential, and sometimes chaotic, relationships and impacts in which 1 + 1 = 3, 30, or 300. What seems like a small disruption or exposure may have a massive effect or no effect at all. In a linear system the effect is proportional with cause, in the non-linear world of business, risks are exponential. Business is chaos theory realized. The small flutter of risk exposure can bring down the organization. If we fail to see the interconnections of risk on the non-linear world of business, the result is often exponential to unpredictable.

Mature risk management enables the organization to understand performance in the context of risk. It can weigh multiple inputs from both top-down view of risk to objectives as well as a bottom-up view of risk within operations and processes. It can integrate internal and external contexts, and use a variety of methods to analyze risk and provide qualitative and quantitative modeling.

Successful risk management requires the organization to provide an integrated process and information architecture. This helps to identify, analyze, manage, and monitor risk, and capture changes in the organization’s risk profile from internal and external events as they occur. Mature risk-management is a seamless part of governance and operations. It requires the organization to take a top-down view of risk, led by the executives and the board that is not an unattached layer of oversight. It also involves bottom-up participation where business functions at all levels identify and monitor uncertainty and the impact of risk down in the depth of the business.

Organizations striving to increase risk management maturity in their organization need to be:

  • Aware. They need to have a finger on the pulse of the business and watch for changes in the internal and external environments that introduce risk. Key to this is the ability to turn data into information that can be, and is, analyzed and shareable in every relevant direction.
  • Aligned. They need to align performance and risk management to support and inform business objectives. This requires continuously aligning objectives and operations of risk management to the objectives and operations of the entity, and to give strategic consideration to information from the risk management capability to affect appropriate change.
  • Responsive. Organizations cannot react to something they do not sense. Mature risk management is focused on gaining greater awareness and understanding of information that drives decisions and actions, improves transparency, but also quickly cuts through the morass of data to what an organization needs to know to make the right decisions. This requires that the organization have a bottoms-up view of risk as well as the top-down.
  • Agile. Stakeholders desire the organization to be more than fast; they require it to be nimble. Being fast isn’t helpful if the organization is headed in the wrong direction. Mature risk management enables decisions and actions that are quick, coordinated, and well thought out. Agility allows an entity to use risk to its advantage, grasp strategic opportunities, and be confident in its ability to stay on course.
  • Resilient. The best-laid plans of mice and men fail. Organizations need to be able to bounce back quickly from changes in context and risks with limited business impact. They desire to have sufficient tolerances to allow for some missteps and have the confidence necessary to rapidly adapt and respond to opportunities.
  • Efficient. They want to build business muscle and trim fat to rid expense from unnecessary duplication, redundancy, and misallocation of resources; to make the organization leaner overall with enhanced capability and related decisions about the application of resources.

My point is simple, there are many perspectives on risk management that brought together properly and in balance can really build an effective and mature risk management program. While there are issues with qualitative methods, heat maps, and risk registers, that does not mean they are useless. They need to be effectively used and their issues and weaknesses understood. The same goes for a complete top-down view of risk management that only focuses on objectives and misses the hazards and issues that lie in the depths of the weeds of the organization that can cause significant harm. The best world is one that brings the strengths of all of these together and avoided throwing the baby out with the bathwater.

I will be presenting my views on how risk management technology enables and mature risk management capabilities in the webinar tomorrow:

I will be presenting my views on how organizations can mature their risk management capability in the webinar this Wednesday:

GRC 20/20 also has the upcoming Risk Management by Design Workshops:

GRC 20/20 has also just updated it’s flagship research paper on this topic:

Understanding Third Party GRC Maturity: Fragmented Stage

The GRC Pundit BlogPublished onUpdated onLeave a Comment on Understanding Third Party GRC Maturity: Fragmented Stage

A haphazard department and document centric approach for third party GRC compounds the problem and does not solve it. It is time for organizations to step back and mature their third party GRC approaches with a cross-functional and coordinated strategy and team to define and govern third party relationships. Organizations need to mature their third party governance with an integrated strategy, process, and architecture to manage the ecosystem of third party relationships with real-time information about third party performance, risk, and compliance, as well as how it impacts the organization.

GRC 20/20 has developed the Third Party GRC Maturity Model to articulate maturity in the Third Party GRC processes and provide organizations with a roadmap to support acceleration through their maturity journey.

There are five stages to the model:

1. Ad Hoc (click to read previous post)
2. Fragmented
3. Defined
4. Integrated
5. Agile

Today we look at Stage 2, the Fragmented level of Third Party GRC

The Fragmented stage sees departments with . . .

[this is a guest blog authored by Michael Rasmussen of GRC 20/20 that can be found at Aravo site, follow the link below to read more]

READ MORE

Policy Management Tips for Companies in Asia

The GRC Pundit BlogPublished onUpdated onLeave a Comment on Policy Management Tips for Companies in Asia

On 30th July, ClauseMatch hosted a Policy Management Workshop with Governance, Risk & Compliance (GRC) expert Michael Rasmussen in Singapore, the first in our global series that aim to provide a blueprint for attendees on effective policy management in today’s dynamic business, regulatory and risk environment. We caught up with Michael after the workshop to hear his summary of the main event.

ClauseMatch: Firstly, let’s recap on why we’ve decided to host a workshop in Singapore (our first in Asia).

Michael: Singapore is one of Asia’s most important business and financial hubs. There are many multinational companies based here that have operations across the region, which presents a significant challenge for compliance and risk officers in terms of policy management, particularly when you take into account the different jurisdictions and regulations that need to be complied with. 

ClauseMatch: Are there any major regulatory changes on the horizon that companies need to be aware of here in Singapore?

Michael: In April 2018 the . . .

[the rest of this article can be found as a guest blog that GRC 20/20 was part of on www.clausematch.com]

READ MORE

Understanding Third Party GRC Maturity: Ad Hoc Stage

The GRC Pundit Blog, Third Party Management SolutionsPublished onUpdated onLeave a Comment on Understanding Third Party GRC Maturity: Ad Hoc Stage

A haphazard department and document centric approach for third party GRC compounds the problem and does not solve it. It is time for organizations to step back and mature their third party GRC approaches with a cross-functional and coordinated strategy and team to define and govern third party relationships. Organizations need to mature their third party governance with an integrated strategy, process, and architecture to manage the ecosystem of third party relationships with real-time information about third party performance, risk, and compliance, as well as how it impacts the organization.

GRC 20/20 has developed the Third Party GRC Maturity Model to articulate maturity in the Third Party GRC processes and provide organizations with a roadmap to support acceleration through their maturity journey.

There are five stages to the model:

1. Ad Hoc
2. Fragmented
3. Defined
4. Integrated
5. Agile

Today we look at Stage 1, the Ad Hoc level of Third Party GRC

Organizations at the Ad Hoc stage of maturity have . . .

[this is a guest blog authored by Michael Rasmussen of GRC 20/20 that can be found at Aravo site, follow the link below to read more]

READ MORE

Policy Management Technology: Separating the Simple from the Advanced

The GRC Pundit BlogPublished onUpdated onLeave a Comment on Policy Management Technology: Separating the Simple from the Advanced

Most organizations are waking up to find their policies in a complete disarray. Over the years policy portals have sprung up across the organization. HR has their portal, IT has one, Finance/Accounting has another, Legal/Compliance still another, and it goes on through other departments. Policies look different on each portal, sometimes they conflict with each other. Policies are stored on different shared drives and now mobile devices. There are out of date policies scattered across the organization.

The majority of organizations do not even know what policies they have. At a conference I keynoted at there were 200 attendees in the room. I asked the audience who in the room has a master index of all of their policies across departments and knows what is an official policy . . . only 2 people raised their hand. I was talking to a global bank the other day and they are doing a policy discover process and found over 1,200 policies in North America alone and have not even finished the discover in this geography, and they still have to do discovery in other geographies. A large hospital chain that has acquired nearly 30 hospitals over the past two decades panicked when they realized they now have over 18,000 policy and procedure documents across these hospitals.

Policies are critical governance documents. In fact, several organizations I work with call their policy management program their Governance Documents program. They are also risk documents, the very fact an organization has a policy means somebody has identified a risk. They are certainly compliance and control documents. They need to be managed and communicated with care.

Policies also establish a legal duty of care for the organization. A policy can be used against an organization in a lawsuit, legal action, and such. There is a major retailer I have been interacting with that is concerned about this as any store manager (across 1,000s of stores) can open up a word processor and write a document and call it a policy . . . putting a legal duty of care on the retailer. They are working to identify all the official policies of the organization and put them in one policy management system and portal. Anything that is referred to as a policy that is not in the system should be reported. Policy management and communication/awareness records also provide a strong defense for an organization when it should find itself in the boiling waters of legal and regulatory inquiries.

I can go on and on with these stories, and cover many of them in detail in my Policy Management by Design workshops. I am finding many organizations are building enterprise policy management strategies that span departments to manage, communicate, and monitor policies consistently across the organization. Most often this is lead by Corporate Compliance & Ethics (sometimes under legal), and at times it is lead by Human Resources). These organizations are finding that they need a solution designed and built for managing the lifecycle and communication of policies. I am interacting with five global banks on this topic right now. But it does not stop there, there are interactions/inquiries this past month from insurance, healthcare, retail, manufacturing, life sciences, hospitality, and more looking for policy management solutions. It is just not large organizations, two inquiries this past week have been from organizations with under 1,000 employees.

However, the needs and requirements for a policy management solution vary with these organizations. The needs of a large global organization managing policies across different lines of business and in different languages are not the same as a small organization in one geography. The needs of a financial services firm trying to keep policies current with regulatory change (there are 220 regulatory change events in financial services every business day around the world) are different from those of manufacturer or hospitality firm.

GRC 20/20 has identified just over 100 solutions available in the market that do policy management. Some of these are very narrow and specific (e.g., they just do IT policies, or EH&S policies, or policies in a healthcare environment), some are broad platforms that manage policies as well as other GRC related activities (e.g., risk, incidents, controls), and some are very deep and advanced solutions for policy management.

NOTE: organizations looking for policy management solutions in the market can ask GRC 20/20 inquiries to get your questions answered.

GRC 20/20 separates policy management solutions into basic and competitive solutions, but then also distinguishes advanced capabilities that separate solutions in the market.

  • Basic policy management solutions. These are solutions, and there are many of them, that address the workflow and task management of policy management with some basic reporting capabilities. Policies are typically authored outside of the solution in a word processor and attached as a file.
  • Competitive policy management solutions. These are the solutions that most often come up in RFPs regularly and have stronger capabilities too author policies within the solution itself (e.g., through a built in editor, or integration with a word processor). They have more advanced reporting capabilities and provide a stronger portal for the publication of policies.

However, what really separates policy management solutions in the market are the advanced capabilities. These include:

  • Collaborative policy authoring and editing. This is coming up frequently with global organizations. They find that the document check-in and check-out slows them down and want that modern collaborative experience that allows multiple people to be authoring, editing, and commenting on the same policy at the same time and to see in real-time the policy changes and edits as they are made by others.
  • Advanced workflow and task management. This is often the ability to define workflow and tasks down to a section/paragraph level to an individual and not just at a document level.
  • Regulatory change management. The ability to map regulations to policies and manage changes to policies as regulations change. The more advanced solutions with this capability will be able to manage a section, paragraph, or even ‘clause’ in a regulation to the same in a policy.
  • Global policy management. This is the need to manage policies across different languages. The master policy may be written in one language, but then it has to be written (or updated when being maintained) in several different languages. I worked on an RFP for one global firm managing policies in 8 languages to 160,000 employees. There are other organizations I am working with that manage policies in over 20 languages. This all involves organizational mapping of policies and detailed workflow and task management capabilities.
  • Engaging policy portal. I am finding more and more organizations looking for that next generation policy portal that brings policy and training management together in a unified experience. Organizations are telling me every week that employees can go out to Facebook and watch a YouTube video in Facebook. They do not have to go out too YouTube to watch the video. They want that integrated portal that provides a single point of access to policies and related training. This is particularly important for the millennial generation. They also want mobile policy portals that can be used on phones and tablets. Particularly where a tablet can become a policy and training kiosk for employees that do not have computers/laptops.
  • Awareness and communication campaigns. Organizations are looking for the ability to manage communication and awareness campaigns for a policy (or groups of policies). To define tasks, workflow, and such. A new policy, such as a Code of Conduct, may have been written. In the first month all employees need to read and acknowledge. The second month they have to complete training. The third month the CEO is going to talk about the new policy at the company meeting. The fourth month managers are to bring it up in their staff meetings and document any questions or discussion on it. The fifth month a funny video or some reminder is going to go out. Then we are going to put up posters by the elevators reminding employees on the policy . . . you get the picture. Each of these involve defining the campaign activities and assigning workflow and tasks to individuals.
  • Integration with business systems. This is where organizations want to be able to integrate their policy management system with their HR systems. So new employees or those that changes job roles/departments can be automatically sent the new policies and related training for their new role/function. I have worked with one life sciences company that there master employee record list came from their policy management system and not their HR systems as they has seven different HR systems and it was the policy management system that connected to each every night to gather the employee lists and identify changes to communicate policies and training. Another global high-tech firm integrated their policy and training platform with their login and access systems. If an employee was behind on critical policy training they would go to login to their computer and find that all they can access was the training. The same thing for physical access in an oil refinery and in a chemical manufacturer in a health and safety context.
  • Geo-location monitoring. I have had this asked for a few times in which an employees smartphone will pick up a location change and communicate to an employee policies and other things they need to know when entering a facility (perhaps in a different country) that they had not been to before.

These are some of the advanced capabilities that I am encountering regularly. If you are looking for or evaluating policy management solutions, feel free to ask an inquiry of GRC 20/20.

Here are some policy management rescuers and events you should be aware of:

Policy Management by Design Workshops

Seminars

Webinars

Published/Recorded GRC 20/20 Research

Have a question on Policy Management strategy, process, and/or technology?

ASK AN INQUIRY

Michael Rasmussen on GRC value & creating your GRC RFP template

UncategorizedPublished onUpdated onLeave a Comment on Michael Rasmussen on GRC value & creating your GRC RFP template

What do you need to include in a GRC RFP? We asked one of the experts in this interview.

Enterprise governance, risk, and compliance (GRC) strategies can help organizations across the board become more efficient and agile in navigating the ever-changing regulatory and risk environment. However, in order to maximize efficiency, effectiveness, and agility, organizations need to approach GRC with a collaborative, inter-departmental strategy.To make GRC software implementation as strong as possible, organizations should have a clear business case, strategy with defined goals, and detailed system requirements.

We sat down with Michael Rasmussen of GRC 20/20 to talk about the components of a successful GRC business case and strategy, how to understand the range of GRC capabilities, how to navigate selecting a solution, and what to include in a GRC RFP. Here are some of his responses.

The value of GRC

Eric Goldberg: How do we go about articulating the value, or the ROI, of a GRC strategy?

Michael Rasmussen: It starts with finding . . .

[This is an interview done with Galvanize, the rest of this post can be found through the button link below]

READ MORE