Category: Blogs

GRC Archetypes: Policy Management

Policy & Training Management Solutions, The GRC Pundit BlogPublished onLeave a Comment on GRC Archetypes: Policy Management

Policy management is the capability to establish, manage, monitor, and enforce policies to reliably achieve objectives, while addressing uncertainty, and act with integrity across the organization (adapted from the OCEG GRC definition).

Policies are critical to the organization to establish boundaries of behavior for individuals, processes, relationships, and transactions. Starting at the policy of all policies – the code of conduct – they filter down to govern the enterprise, divisions/regions, business units, and processes. Policy paints a picture of behavior, values, and ethics that define the culture and expected behavior of the organization; without policy there is no consistent rules and the organization goes in every direction. The existence of a policy means a risk has been identified and is of enough significance to have a formal policy written which details controls to manage the risk. Policies document compliance in how the organization meets requirements and obligations from regulators, contracts, and voluntary commitments. Without policy, there is no written standard for acceptable and unacceptable conduct — an organization can quickly become something it never intended.

Policy also attaches a legal duty of care to the organization and cannot be approached haphazardly. Mismanagement of policy can introduce liability and exposure, and noncompliant policies can and will be used against the organization in legal (both criminal and civil) and regulatory proceedings. Regulators, prosecuting and plaintiff attorneys, and others use policy violation and noncompliance to place culpability. An organization must establish policy it is willing to enforce — but it also must clearly train and communicate the policy to make sure that individuals understand what is expected of them. An organization can have a corrupt and convoluted culture with good policy in place, though it cannot achieve strong and established culture without good policy and training on policy.

Organizations often lack a coordinated enterprise strategy for policy development, maintenance, communication, attestation, and training. An ad hoc approach to policy management exposes the organization to significant liability. This liability is intensified by the fact that today’s GRC programs affect every person involved with supporting the business, including internal employees and third parties. To defend itself, the organization must be able to show a detailed history of what policy was in effect, how it was communicated, who read it, who was trained on it, who attested to it, what exceptions were granted, and how policy violation and resolution was monitored and managed. With today’s complex business operations, global expansion, and the ever changing legal, regulatory, and compliance environments, a well-defined policy management program is vital to enable an organization to effectively develop and maintain the wide gamut of policies it needs to govern with integrity.

THE QUESTION: How is your organization approaching policy management? Can you map yourself to one of the following GRC archetypes of policy management?

  • Fire Fighter. Your organization approaches policy management in an ad hoc fly by the seat of your pants approach. Policy management is not structured and policies are written or reviewed only when there is a burning issue, incident, compliance requirement, or other pressure. Even then, it is about addressing the issue before you and not thinking strategically about policy management. Policy management is addressed in manual processes with file shares, documents, spreadsheets, and emails. The organization does not have a master index of all official policies across departments and there are conflicting versions of the policy in existence (e.g., out of date).
  • Department Islander. In this archetype, your organization has a more structured approach to policy management within specific departments. There is little to no collaboration between departments and you often have different departments with a vested interest in policy management going in different directions with a significant amount of redundancy and inefficiency. Departments may have specific technology deployed for policy management, or may still be relying on manual processes with documents, spreadsheets, and emails. The result is a variety of policies in different portals and file shares with inconsistent formats and templates.
  • GRC Collaborator. This is the archetype in which your organization has cross-department collaboration for policy management to provide consistent processes and structure for policy management. However, the focus is purely on addressing significant compliance concerns and risks. It is more of a checkbox mentality in collaborating on what needs to be done to manage policies to meet requirements. Most often there is a broader policy management platform deployed to manage policies, but some still rely on manual processes supported by documents, spreadsheets, and emails.
  • Principled Performer  This is the model in which the organization is focused on managing the integrity of the organization across its business and its relationships. Policy management is more than meeting requirements but is about encoding and communicating boundaries of expected conduct to develop a strong and consistent corporate culture aligned with the ethics, values, and obligations of the organization. Policies are mapped to risks and objectives and actively understood and managed as critical governance documents of the organization. Policies are consistent in a defined template, language style, and the organization has a current index of all official policies of the organization. Policy management is tightly integrated with training to help communicate and ensure that policies are understood.

The haphazard department and document centric approaches for policy and training management of the past compound the problem and do not solve it.  It is time for organizations to step back and define a cross-functional and coordinated team to define and govern policy and training management. Organizations need to wipe the slate clean and approach policy and training management by design with a strategy and architecture to manage the ecosystem of policies and training programs throughout the organization with real-time information about policy conformance and how it impacts the organization.

GRC 20/20’s Policy Management Workshop

GRC 20/20 will be leading an interactive workshop to facilitate discussion and learning between organizations on Policy Management on the following dates and locations:

Strategy Perspective on Policy Management

Research Briefings on Policy Management

Solution Perspectives on Policy Management

Case Studies on Policy Management

GRC Archetypes: Third Party Management

The GRC Pundit Blog, Third Party Management SolutionsPublished onLeave a Comment on GRC Archetypes: Third Party Management

Third party management is the capability to reliably achieve objectives, while addressing uncertainty, and act with integrity in and across the organizations third party relationships/extended enterprise (adapted from the OCEG GRC definition).

Brick and mortar business is a thing of the past: physical buildings and conventional employees no longer define an organization. The modern organization is an interconnected mesh of relationships and interactions that span traditional business boundaries. Over half of an organization’s ‘insiders’ are no longer traditional employees. Insiders now include suppliers, vendors, outsourcers, service providers, contractors, subcontractors, consultants, temporary workers, agents, brokers, dealers, intermediaries, and more. Complexity grows as these interconnected relationships, processes, and systems nest themselves in layers of subcontracting and suppliers.

Third party compliance requirements are growing at a staggering rate. Human rights, social accountability/labor standards, privacy, security, ethical sourcing, environmental, health and safety, and quality compliance and risk requirements are growing upon organizations. GRC 20/20 is monitoring the impact of regulations such as the UK Modern Slavery Act, US Foreign Corrupt Practices Act, UK Bribery Act, OECD Anti-Bribery Convention, PCI DSS, EU GDPR, US Conflict Minerals, EU Conflict Minerals, California Transparency in Supply Chains Act, France Sapen 2, and more impact third party management strategies in organizations.

In this context, organizations struggle to adequately govern risk in third party business relationships. Third party problems are the organization’s problems that directly impact brand, reputation, compliance, strategy, and risk to the organization. Risk and compliance challenges do not stop at traditional organizational boundaries as organizations bear the responsibility of the actions or inactions of their extended third party relationships. An organization can face reputational and economic disaster by establishing or maintaining the wrong business relationships, or by allowing good business relationships to sour because of poor governance and risk management.  When questions of business practice, ethics, safety, quality, human rights, corruption, security, and the environment arise, the organization is held accountable, and it must ensure that third parties behave appropriately.

THE QUESTION: How is your organization approaching third party management? Can you map yourself to one of the following GRC archetypes of third party management?

  • Fire Fighter. Your organization approaches third party management in an ad hoc fly by the seat of your pants approach. Third party management is not structured and only addressed when there is a burning issue, incident, compliance requirement, or other pressure. Even then, it is about addressing the issue before you and not thinking strategically about third party management. Third party management is addressed in manual processes with documents, spreadsheets, and emails but only for reactive purposes.
  • Department Islander. In this archetype, your organization has a more structured approach to third party management within specific departments. There is little to no collaboration between departments and you often have different departments with a vested interest in third party management going in different directions with a significant amount of redundancy and inefficiency. Departments may have specific technology deployed for third party management, or still be relying on manual processes with documents, spreadsheets, and emails.
  • Compliance/Risk Collaborator. This is the archetype in which your organization has cross-department collaboration for third party management to provide consistent processes and structure for third party management. However, the focus is purely on addressing significant compliance concerns and risks. It is more of a checkbox mentality in collaborating on what needs to be done to manage third party risks to meet regulatory requirements and not a serious look at the governance, risk management, and compliance of third party relationships. Most often there is a broader third party management platform deployed to manage third party compliance, but some still rely on manual processes supported by documents, spreadsheets, and emails.
  • Corporate Citizen. This is the model in which the organization is focused on managing the integrity of the organization across its business and its relationships. Third party management is more than meeting compliance/regulatory requirements but is about being a good corporate citizen focused on doing the right thing. It goes beyond compliance to an approach that ensures that the organizations values, ethics, code of conduct, and culture is shared and consistent across business relationships. The focus is on integrity of the organization and ensuring that this is consistent across the extended enterprise of relationships.

Too often departments are reacting to third party management in silos and the organization fails to actively implement a coordinated strategy for third-party management across the enterprise. Organizations manage third-parties differently across different departments and functions with manual approaches involving thousands of documents, spreadsheets, and emails. Worse, they focus their efforts at the formation of a third-party relationship during the on-boarding process and fail to govern risk and compliance throughout the lifecycle of the relationship. This fragmented approach to third-party governance brings the organization to inevitable failure. Reactive, document-centric, and manual processes cost too much and fail to actively govern, manage risk, and assure compliance throughout the lifecycle of third-party relationships. Silos leave the organization blind to the intricate exposure of risk and compliance that do not get aggregated and evaluated in context of the organization’s goals, objectives, and performance expectations in the relationship.

When the organization approaches third-party management in scattered silos that do not collaborate with each other, there is no possibility to be intelligent about third-party performance, risk management, compliance, and impact on the organization. An ad hoc approach to third-party management results in poor visibility across the organization, because there is no framework or architecture for managing third-party risk and compliance as an integrated framework. It is time for organizations to step back and define a cross-functional strategy to define and govern risk in third-party relationships that is supported and automated with information and technology.

Third Party Management Workshop

GRC 20/20 will be leading an interactive workshop to facilitate discussion and learning between organizations on Third Party Management on the following dates and locations:

Strategy Perspective on Third Party Management

Research Briefings on Third Party Management

Solution Perspectives on Third Party Management

Case Studies on Third Party Management

Diary of a Wimpy GRC Solution

The GRC Pundit BlogPublished onLeave a Comment on Diary of a Wimpy GRC Solution

I understand what it is like to be the underdog. In grade school and junior high I was the target to be picked on. The scrawny emotional kid that was an easy target. Things changed. In high school my Viking Danish DNA caught up and I became a more forbidding obstacle to be a target of. Which worked well for my phlegmatic disposition.

In the GRC market, I have a soft spot for the underdogs. There are many great solutions available that never get the attention they deserve. They have great clients that are amazed with the solution, but they have a hard time getting the clients as they are overshadowed by the popularity contest of solutions that get all the attention from analysts, media, and professional service firms.

Why is this? There are many reasons to this, consider the following . . .

  • Analysts. Yes, I am a market research analyst, but I truly hope of a different flavor. To get analyst attention today requires a lot of money and engagement. My competitors often charge $15,000 or more a day for advisory time to solution providers. They charge tens of thousands of dollars to redistribute research reports in which a solution provider is mentioned. When it comes to their evaluation of solutions, they have more intimacy with those that spend tens of thousands of dollars on advisory days and less on solutions that they simply request video demos from and not actually dive deep into.
  • Professional Service Firms. There are some great advisor and consultants in any firm, but then there are those that think more economically and strategically for the firm. Many major consulting/advisory firms partner with solutions that are very complex and require a lot of build out and customization. The reason is revenue. When GRC projects become the scale of ERP projects and take six months to two years (or more) to roll out . . . that is a lot of services revenue. I have seen one email from a major consulting firm that was responding to a solution provider about partnership. It stated that they are more than willing to work on an opportunity should the solution provider bring one to them, but why would they want to partner with this SaaS solution that stated it was so easy to implement and configure. Where was the services revenue?
  • Black and White Honesty. Many solution providers approach RFPs without any creativity and thoughtfulness. They say no to many answers in a black and white perspective without actually thinking how their solution could meet the criteria. On the other hand, major competitors are saying yes to everything in RFPs and it takes years to build out and deliver as it was not true. But the Yes solutions get further in RFPs than the brutally honest No solutions that have capabilities they did not even consider. In fact, I have even found one major GRC solution in the market demoing functionality that did not exist in their product . . . they were demoing someone else’s functionality for risk management.
  • Poorly trained sales. Too often good solutions fail in getting into deals because they have poorly trained sales people that do not understand the market, how to engage buyers, understand organization needs and requirements, or think outside the box. Perhaps they have focused on IT security for their careers and fail in understanding how to talk to a corporate compliance officer on bribery or corruption, or procurement on human slavery and international labor standards in a supply chain. I recently saw one solution provider fail in an RFP because the sales person only understood IT GRC and the demo scripts requested by the buyer were about EH&S. They kept going off script to talk about security instead of demoing the solutions EH&S capabilities that were there.
  • Misaligned marketing. Too often marketing is taxed with limited resources to adequately message the variety of use cases a solution can be used for. Too often I recommend a solution to an organization and then the organization goes out to the solution providers website and finds nothing about their specific need. Following up with them later on I find they went to others I had recommended that did have messaging to their specific needs.
  • Lack of market intelligence. Many solutions simply do not have visibility into the opportunities available in the market. They miss doors of opportunity as they do not know who to call on and interact with. The analysts are not covering them, professional service firms ignore them, and they have no insight into the many opportunities available to them in the market.

Don’t get me wrong, there are established and mature solutions in the market that do some great things and have happy clients. But there are also many situations in which major GRC solutions take years to build out and implement and cost a ton of money to administer. In fact, one major GRC solution that major analysts love and rank so very highly (I am not naming names in a post like this), has a string for failures. Consider:

  • IT GRC @ Global Manufacturer. I wrote the IT GRC for this RFP. The CISO stated they will not consider this major GRC platform because of the horrible experience at a previous firm he was with.
  • Enterprise GRC @ Utility & Energy Company. The project owner at this firm stated they would not allow this solution into the RFP because of the failure and cost to administer the solution at a previous firm.
  • Enterprise GRC @ Bank. In this RFP I helped with, this solution was already in house for an area of GRC. They told me that they would let the solution provider respond to the RFP as they were an incumbent, but they would not be a consideration because they are very dissatisfied with it.
  • Enterprise GRC @ Outsourcer/Professional Service Firm. In this instance, I helped write and manage the RFP. At the last-minute IT stepped in and said they wanted to be part of this and that it would be this particular solution provider. As they controlled the budget, no one could argue. I warned them that this would not be my choice, that they would be over budget and well past their deadlines. They came back to me two years later and said they wished they would have listened. That they were just now doing the initial rollout and they were way over budget. They now have scrapped the solution and have implemented another they are happy with (which I originally recommended).

My point here is that there are great solutions available in the market. Popularity should not be the measuring stick. While there are exceptions, the popular kids in school were often the jerks and bullies.

Organizations need to do their homework and understand solutions for their features, functionality, ability to deliver, ease of administration, and how agile the solution provider is to engage and adapt to the organization. GRC does not need to be the scale of ERP. There are highly agile, intuitive, easy to use solutions available in the market. All you need to do is ask. GRC 20/20 offers complimentary inquiry to guide organizations on what solutions are available in the market for their specific needs. Every week GRC 20/20 answers between 5 and 15 questions from organizations looking for GRC related solutions in the market.

When you measure the value of a GRC solution in the market, I suggest you frame it around the following three areas:

  1. GRC efficiency. How does this solution make you more efficient in your use of human and financial capital?
  2. GRC effectiveness. How does this solution make you more effective, accurate, and complete in executing GRC processes, activities, and tasks.
  3. GRC agility. How does this solution help you keep up with change – business change, regulatory change, risk change – in your environment. Also, how does it help you quickly identify issues and concerns to contain them before they become big issues.

One more thing, GRC 20/20 has an extensive RFP requirement library across GRC domains. Organizations can engage GRC 20/20 to assist with their RFP development and engagement in the following areas:

  • Enterprise GRC Platforms
  • Enterprise & Operational Risk Management
  • Audit Management
  • Automated/Continuous Controls Management
  • Business Continuity Management
  • Compliance/Ethics Management
  • Environmental, Health & Safety Management
  • Internal Control Management
  • Issue Reporting and Investigations/Incident/Case Management
  • IT GRC Management/IT Security
  • Policy Management
  • Quality Management
  • Third Party (Vendor/Supplier) Management

On the flip side, if you are a GRC Solution Provider in the market, check out GRC 20/20’s next Research Briefing on How to Market and Sell GRC Solutions to go through these challenges discussed in this post and how to overcome them.

Three Lines of Defense: Enabling High Performing Organizations

Audit Management & Analytic Solutions, GRC Platforms & Architecture Solutions, Internal Control Management & Automation Solutions, Risk Management Solutions, The GRC Pundit BlogPublished onLeave a Comment on Three Lines of Defense: Enabling High Performing Organizations

Like battling the multi-headed Hydra in Greek mythology, redundant, manual, and uncoordinated governance, risk management, and compliance (GRC) approaches are ineffective. As the Hydra grows more heads of regulation, legal matters, operational risks, and complexity, scattered departments of GRC responsibilities that do not work together become overwhelmed and exhausted and start losing the battle. This approach increases inefficiencies and the risk that serious matters go unnoticed. Redundant and inefficient processes lead to overwhelming complexity that slows the business, at a time when the business environment requires greater agility.

Successful GRC strategy in complex business environments requires layers of protection to ensure that the organization can “reliably achieve objectives [Governance] while addressing uncertainty [Risk Management] and act with integrity [Compliance].” (source: www.OCEG.org) Any strategist, whether in games, sports, combat, or business, understands that layers of defense are critical to the protection of assets and achievement of objectives. Consider a castle in the Middle Ages in which there are layers of protection by moats, gates, outer walls, inner walls, with all sorts of offensive traps and triggers along the way. Organizations are modern castles that require layers of defense to protect the organization and allow it to reliably achieve strategic objectives.

The Three Lines of Defense model is the key model that enables organizations to organize and manage layers of GRC controls and responsibilities. The European Commission originally established it in 2006 as a voluntary audit directive within the European Union. Since this time, it has grown in popularity and is now a globally accepted framework for integrated GRC across lines of defense within organizations – from the front lines, to the back office of GRC, to the assurance and oversight roles. GRC 20/20 sees the Three Lines of Defense Model as critical to enable organizations to reliably achieve objectives while addressing uncertainty and act with integrity.

As the name suggests, the Three Lines of Defense model is comprised of three layers of GRC responsibility and accountability in organizations. These are:

  • Business Operations. The front lines of the organization across operations and processes comprise the roles that make risk and control decisions every day. This represents the functions within departments and processes that ultimately own and manage risk and controls in the context of business activities. These roles need to be empowered to identify, assess, document, report, and respond to risks, issues, and controls in the organization. This first layer operates within the policies, controls, and tolerances defined by the next layer of defense, GRC professionals.
  • GRC Professionals. The back office of GRC functions (e.g., risk management, corporate compliance, ethics, finance, health & safety, security, quality, legal, and internal control) are the roles that specify and define the boundaries of the organization that are established in policy, procedure, controls, and risk tolerances. These roles oversee, assess, monitor, and manage risk, compliance, and control activities in the context of business operations, transactions, and activities.
  • Assurance Professionals. The third layer of defense is assurance professionals (e.g., internal audit, external audit) that provide thorough, objective, and independent assurance on business operations and controls. It is their primary responsibility to provide assurance to the Board of Directors and executives that the first and second lines of defense are operating within established boundaries and are providing complete and accurate information to management. This is accomplished through planning and executing audit engagements to support assurance needs.

The Three Lines of Defense Model is well understood and adopted globally. The major downside of the model is the name itself using the word ‘defense.’ This gives the model a perception of being reactionary and tactical and not strategic. This is unfortunate as the model enables high-performance by aligning accountabilities at different levels of the organization and getting these functions working together in context of each other. High performing organizations require consistency and controls to ensure the organization operates within boundaries of controls. The Three Lines of Defense Model is key to enable reliable achievement of objectives and consistent control of the business.

The key to success in implementing the Three Lines of Defense Model is collaboration. If the layers of accountability across the three lines do not collaborate and work together, GRC functions will remain in silos and be ineffective, inefficient, and lack agility to respond to a complex and dynamic business environment. Internal politics and divisions work against the Three Lines of Defense Model in organizations.

Another challenge for organizations in implementing the Three Lines of Defense Model is not having a consistent GRC process, information, and technology architecture. Not only do different groups across the lines of defense need to be able to work together, they need to be able to share information and have a consistent and single source of truth for GRC activities, accountabilities, and controls.

The Bottom Line: Three Lines of Defense is an integrated GRC framework with the goal of allowing different parts of the organization to work cohesively together to reliably achieve objectives while addressing uncertainty and acting with integrity. It enables what OCEG calls Principled Performance, and ensures that there are clear responsibilities, accountability, and oversight of risk and control at all levels of the organization. Organizations are adopting the Three Lines of Defense Model for GRC as they have come to realize that silos of GRC that do not collaborate and work together lead to inevitable failure. There is a need for visibility across these lines of defense that is scalable, integrated and consistent. The Three Lines of Defense Model enables efficient, effective, and agile business.

GRC 20/20’s latest research piece evaluating solutions on this topic is:

Role of Technology in Risk Management Maturity

Blogs, The GRC Pundit BlogPublished onUpdated on1 Comment on Role of Technology in Risk Management Maturity

To maintain the integrity of the organization and execute on strategy, the organization has to be able to see their individual risk (the tree) as well as the interconnectedness of risk (the forest). Risk management in business is non-linear. It is not a simple equation of 1 + 1 = 2. It is a mesh of exponential relationship and impact in which 1 + 1 = 3, 30, or 300. What seems like a small disruption or exposure may have a massive effect or no effect at all. In a linear system, effect is proportional with cause, in the non-linear world of business risk management risks is exponential. Business is chaos theory realized. The small flutter of risk exposure can bring down the organization. If we fail to see the interconnections of risk on the non-linear world of business, the result is often exponential to unpredictable.

Mature risk management enables the organization to understand performance in the context of risk. It can weigh multiple inputs from both internal and external contexts, and use a variety of methods to analyze risk and provide qualitative and quantitative modeling. Successful risk management requires the organization to provide an integrated process, information, and technology architecture to identify, analyze, manage, and monitor risk and capture changes in the organization’s risk profile from internal and external events as they occur. Mature risk-management is a seamless part of governance and operations. It requires the organization to take a top-down view of risk, led by the executives and the board, and made part of the fabric of business, not an unattached layer of oversight. It also involves a bottom-up participation where business functions at all levels identify and monitor uncertainty and the impact of risk.

Organizations striving to increase risk management maturity in their organization become more:

  • Aware. They want to have a finger on the pulse of the business and watch for change in the internal and external environments that introduce risk. Key to this is the ability to turn data into information that can be, and is, analyzed and be able to share information in every relevant direction.
  • Aligned. They need to align performance and risk management in the context to support and inform business objectives. This requires the ability to continuously align objectives and operations of the integrated risk capability to the objectives and operations of the entity and give strategic consideration to information from the risk management capability, enabling appropriate change.
  • Responsive. Organizations cannot react to something they do not sense. Mature risk management is focused to gain greater awareness and understanding of information that drives decisions and actions, improves transparency, but also quickly cuts through the morass of data to what an organization needs to know to make the right decisions.
  • Agile. Stakeholders desire the organization to be more than fast; they require it to be nimble. Being fast isn’t helpful if the organization is headed in the wrong direction. Principled Performance enables decisions and actions that are quick, coordinated, and well thought out. Agility allows an entity to use risk to its advantage, grasp strategic opportunities, and be confident in its ability to stay on course.
  • Resilient. The best laid plans of mice and men fail. Organizations need to be able to bounce back quickly from changes in context and risks with limited business impact. They desire to have sufficient tolerances to allow for some missteps and have confidence necessary to rapidly adapt and respond to opportunities.
  • Lean. They want to build business muscle and trim fat to rid expense from unnecessary duplication, redundancy, and misallocation of resources; to lean the organization overall with enhanced capability and related decisions about application of resources.

Risk Management Information & Technology Architecture

Risk management fails when information is scattered, redundant, non-reliable, and managed as a system of parts that do not integrate and work as a collective whole. The risk management information architecture supports the process architecture and overall risk management strategy. With processes defined and structured the organization can now define the information architecture needed to support risk management processes. The risk management information architecture involves the structural design, labeling, use, flow, processing, and reporting of risk management information to support risk management processes.

Successful risk management information architecture will be able to integrate information across risk management systems and business systems. This requires a robust and adaptable information architecture that can model the complexity of risk information, transactions, interactions, relationship, cause and effect, and analysis of information that integrates and manages with a range of business systems and external data.

The risk management technology architecture operationalizes the information and process architecture to support the overall risk management strategy. The right technology architecture enables the organization to effectively manage risk and facilitate the ability to document, communicate, report, and monitor the range of risk assessments, documents, tasks, responsibilities, and action plans.

There can and should be a central core technology platform for risk management that connects the fabric of the risk management processes, information, and other technologies together across the organization. Many organizations see risk management initiatives fail when they purchase technology before understanding their process and information architecture and requirements. Organizations have the following technology architecture choices before them:

  • Documents, spreadsheets, and email. Manual spreadsheet and document-centric processes are prone to failure as they bury the organization in mountains of data that is difficult to maintain, aggregate, and report on, consuming valuable resources. The organization ends up spending more time in data management and reconciling as opposed to active risk monitoring.
  • Point solutions. Implementation of a number of point solutions that are deployed and purpose built for very specific risk and regulatory issues. The challenge here is that the organization ends up maintaining a wide array of solutions that do very similar things but for different purposes. This introduces a lot of redundancy in information gathering and communications that taxes the organization in managing risk holistically.
  • Risk management/GRC platforms. These are solutions built specifically for risk management and often have the broadest array of built-in (versus built-out) features to support the breadth of risk management processes. In this context they take a balanced view of risk management that includes performance as well as risk and compliance needs. These solutions allow an organization to govern risk throughout the lifecycle and enable enterprise risk reporting.

The right risk management technology architecture choice for an organization often involves integration of several components into a core risk management platform solution to facilitate the integration and correlation of risk information, analytics, and reporting. Organizations suffer when they take a myopic view of risk management technology that fails to connect all the dots and provide context to business analytics, performance, objectives, and strategy in the real-time business operates in.

Some of the core capabilities organizations should consider in a risk management platform are:

  • Internal integration. Risk management is not a single isolated competency or technology within a company. It needs to integrate well with other technologies and competencies that already exist in the organization. So the ability to pull and push data through integration is critical.
  • Content, workflow, and task management. Content should be able to be tagged so it can be properly routed to the right subject matter expert to establish workflow and tasks for review and analysis. Standardized formats for measuring business impact, risk, and compliance.
  • 360° contextual awareness. The organization should have a complete view of what is happening with risk in context of performance, risk, and compliance. Contextual awareness requires that risk management have a central nervous system to capture signals found in processes, data, and transactions as well as changing risks and regulations for interpretation, analysis, and holistic awareness of risk in the context of risk and performance.
  • Support for multiple risk frameworks. The risk management technology architecture should allow the organization to harmonize risk management across the organization. The business can use different risk management frameworks in different parts of the organization and still integrate risk data and reporting with an enterprise perspective.
  • Define and map objectives and controls to risk. Controls are used to mitigate and monitor risk. Every control in the environment maps to the risks addressed, using an integrated risk and control framework. Risk technology should allow for complete integration and reporting on objectives and controls in the context of their relationship to risk across the enterprise.
  • Establish and communicate risk policy. Risk technology should allow the organization to develop, approve, and communicate policies to address risk. This establishes expectations and a culture around risk, including risk capacity, tolerance, appetite, accountability, and controls.
  • Manage loss and incidents. Loss represents the materialization of risk and must be documented and fed into risk models. Risk technology enables the management of incidents and records loss as an integrated component of a risk management process.
  • Allocate risk accountability. Risk management requires that someone is responsible for risk. Risk without an owner is like a leaf blowing in the wind. Risk technology tracks accountability and ownership through its risk taxonomy, and enforces accountability through task management, workflow, and escalation. Through reporting and metrics, owners see risk from different perspectives and understand the risks they are responsible for.
  • Advanced risk reporting and trending. Risk technology manages and monitors risk at the enterprise level and within individual departments. This permits detailed reporting, dashboards, trending, and analytics that scale to the needs of the department or enterprise. Organizations can establish and monitor risk metrics through KRIs and map them to objectives and processes. Reporting is customizable and scalable to context and level of detail appropriate to the audience — whether process owner, manager, executive, or board member.
  • Risk analytics and modeling. Mature risk technology should support a breadth of risk analytics and modeling to meet the diverse needs of groups across the business. The solution can track and model spending to treat risk in the context of exposure.
  • Understand the interrelationship of risk. Risk technology provides for identification and categorization of risk into hierarchical structures to effectively manage and assign accountability. However, individual risks can also relate to risk outside of a hierarchical model. The risk information architecture allows for hierarchical categorization of risk, as well as mapping and relationship of risk that does not always fit into neat hierarchies.

This post is an excerpt from GRC 20/20’s latest Strategy Perspective research: Risk Management by Design: A Blueprint for Federated Enterprise Risk Management

  • Role of Risk Content & Intelligence in a Risk Management Strategy. Attend GRC 20/20’s next Research Briefing to learn about the range of risk intelligence and content offerings available in the market that can enable a GRC strategy and integrate with GRC technology solutions. GRC 20/20 has mapped over 125 providers of GRC intelligence and content with more than 350 content offerings across these providers.
  • Have a question about Risk Management Solutions and Strategy? GRC 20/20 offers complimentary inquiry to organizations looking to improve their policy management strategy and identify the right solutions they should be evaluating. Ask us your question . . .
  • Risk Management by Design Workshop. Engage GRC 20/20 to facilitate and teach the Risk Management by Design Workshop in your organization.
  • Looking for Risk Management Solutions? GRC 20/20 has mapped the players in the market and understands their differentiation, strengths, weaknesses, and which ones best fit specific needs. This is supported by GRC 20/20’s RFP support project that includes access to an RFP template with over 500 requirements for risk management solutions.

GRC 20/20’s Risk Management Research includes . . .

Register for the upcoming Research Briefing presentation:

Access the on-demand Research Briefing presentation:

Strategy Perspectives (written best practice research papers):

Solution Perspectives (written evaluations of solutions in the market):

Case Studies (written evaluations of specific strategies and implementations within organizations):

Do You Know Your Third-Party Risks?

Blogs, The GRC Pundit BlogPublished onUpdated onLeave a Comment on Do You Know Your Third-Party Risks?

Increasing Exposure to Third-Party Risks

The Modern Organization is an Interconnected Mesh of Relationships

Brick and mortar business is a thing of the past: physical buildings and conventional employees no longer define an organization. The modern organization is an interconnected mesh of relationships and interactions that span traditional business boundaries. Over half of an organization’s ‘insiders’ are no longer traditional employees. Insiders now include suppliers, vendors, outsourcers, service providers, contractors, subcontractors, consultants, temporary workers, agents, brokers, dealers, intermediaries, and more. Complexity grows as these interconnected relationships, processes, and systems nest themselves in layers of subcontracting and suppliers.

In this context, organizations struggle to adequately govern risk in third-party business relationships. Third-party problems are the organization’s problems that directly impact brand, reputation, compliance, strategy, and risk to the organization. Risk and compliance challenges do not stop at traditional organizational boundaries as organizations bear the responsibility of the actions or inactions of their extended third-party relationships. An organization can face reputational and economic disaster by establishing or maintaining the wrong business relationships, or by allowing good business relationships to sour because of poor governance and risk management.  When questions of business practice, ethics, safety, quality, human rights, corruption, security, and the environment arise, the organization is held accountable, and it must ensure that third-parties behave appropriately.

There are particular challenges of managing bribery and corruption, social accountability, international labor standards, human rights, information security, privacy, quality, environmental, health and safety,  and more across the organizations. Growing regulatory pressures from things like US FCPA, UK Bribery Act, UK Modern Slavery Act, US Conflict Minerals, EU Conflict Minerals, California Transparency in Supply Chains Act, PCI DSS, OCC Requirements, HIPAA, and much more all put pressure on third party risk management.

Inevitable Failure of Silos of Third Party Governance

Governing third-party relationships, particularly in context of risk and compliance, is like the hydra in mythology: organizations combat each head, only to find more heads springing up to threaten them. Departments are reacting to third party management in silos and the organization fails to actively implement a coordinated strategy for third-party management across the enterprise. Organizations manage third-parties differently across different departments and functions with manual approaches involving thousands of documents, spreadsheets, and emails. Worse, they focus their efforts at the formation of a third-party relationship during the on-boarding process and fail to govern risk and compliance throughout the lifecycle of the relationship.

This fragmented approach to third-party governance brings the organization to inevitable failure. Reactive, document-centric, and manual processes cost too much and fail to actively govern, manage risk, and assure compliance throughout the lifecycle of third-party relationships. Silos leave the organization blind to the intricate exposure of risk and compliance that do not get aggregated and evaluated in context of the organization’s goals, objectives, and performance expectations in the relationship.

Failure in third party management happens when organizations have:

  • Growing risk and regulatory concerns with inadequate resources. Organizations are facing a barrage of growing regulatory requirements and expanding geo-political risks around the world. Many target third party relationships specifically, while others require compliance without specifically addressing the context of third parties. Organizations are, in turn, encumbered with inadequate resources to monitor risk and regulations impacting third-party relationships and often react to similar requirements without collaborating with other departments which increases redundancy and inefficiency.
  • Interconnected third-party risks that are not visible. The organization’s risk exposure across third-party relationships is growing increasingly interconnected. An exposure in one area may seem minor but when factored into other exposures in the same relationship (or others) the result can be significant. Organization often lack an integrated and thorough understanding of the interconnectedness of performance, risk management, and compliance of third parties.
  • Silos of third party oversight. Allowing different departments to go about third-party management without coordination, collaboration, consistent processes, information, and approach leads to inefficiency, ineffectiveness, and lack of agility. This is exacerbated when organizations fail to define responsibilities for third-party oversight and the organization breeds an anarchy approach to third-party management leading to the unfortunate situation of the organization having no end-to-end visibility and governance of third-party relationships.
  • Document, spreadsheet, and email centric approaches. When organizations govern third-party relationships in a maze of documents, spreadsheets, and emails it is easy for things to get overlooked and buried in mountains of data that is difficult to maintain, aggregate, and report on. There is no single source-of-truth on the relationship and it becomes difficult, if not impossible, to get a comprehensive, accurate, and current-state analysis of a third-party. To accomplish this requires a tremendous amount of staff time and resources to consolidate information, analyze, and report on third-party information. When things go wrong, audit trails are non-existent or are easily covered up and manipulated as they lack a robust audit trail of who did what, when, how, and why.
  • Scattered and non-integrated technologies. When different parts of the organization use different approaches for on-boarding and managing third-parties; the organization can never see the big picture. This leads to a significant amount of redundancy and encumbers the organization when it needs to be agile.
  • Due diligence done haphazardly or only during on-boarding. Risk and compliance issues identified through an initial due diligence process are often only analyzed during the on-boarding process to validate third-parties. This approach fails to recognize that additional risk and compliance exposure is incurred over the life of the third-party relationship and that due diligence needs to be conducted on a continual basis.
  • Inadequate processes to monitor changing relationships. Organizations are in a constant state of flux. Governing third-party relationships is cumbersome in the context of constantly changing regulations, risks, processes, relationships, employees, processes, suppliers, strategy, and more. The organization must monitor the span of regulatory, geo-political, commodity, economic, and operational risks across the globe in context of its third-party relationships. Just as much as the organization itself is changing, each of the organization’s third parties is changing introducing further risk exposure.
  • Third-party performance evaluations that neglect risk and compliance. Metrics and measurements of third-parties often fail to properly encompass risk and compliance indicators. Too often metrics from service level agreements (SLAs) focus on delivery of products and services by the third-party but do not include monitoring of risks, particularly compliance and ethical considerations.

When the organization approaches third-party management in scattered silos that do not collaborate with each other, there is no possibility to be intelligent about third-party performance, risk management, compliance, and impact on the organization. An ad hoc approach to third-party management results in poor visibility across the organization, because there is no framework or architecture for managing third-party risk and compliance as an integrated framework. It is time for organizations to step back and define a cross-functional strategy to define and govern risk in third-party relationships that is supported and automated with information and technology.

Organizations need to have an approach with a supporting information and technology architecture that enables:

  • Identification and management of the range of third parties across the organization
  • Evaluation and monitoring of third-party risks across the organization
  • Prioritization of control and mitigation efforts in context of third-party risk exposure
  • Management of the lifecycle of third party relationship process from on-boarding to off-boarding
  • Conducting initial and ongoing due diligence efforts of third parties based on risk exposure
  • Monitoring and track individual third party relationships as well as groups of relationships (e.g., type of relationship, type of risk, geography)
  • Providing a system of record and audit trail to provide evidence when under legal or regulatory scrutiny

What are your thoughts and concerns on third party management? Please post your comments below. If you have a question on third party management best practices or solutions in the market, please submit an inquiry.

Third Party Management Research from GRC 20/20 . . .

GRC 20/20 will be releasing a detailed written Market Landscape: Third Party Management Solutions later in April that includes market definition, segmentation, sizing, forecasting, solutions in the space, drivers, trends and more.

Research Briefings on Third Party Management

Strategy Perspectives on Third Party Management

Solution Perspectives on Third Party Management

Case Studies on Third Party Management

 

Pitfalls in GRC Software Selection and RFPs

The GRC Pundit BlogPublished onUpdated onLeave a Comment on Pitfalls in GRC Software Selection and RFPs

There is a broad array of governance, risk management, and compliance (GRC) related solutions available in the market. In fact, GRC 20/20 has catalogued and mapped over 800 technology solutions and over 300 content/intelligence solutions that organizations use to improve GRC processes in an effort to make them more efficient, effective, and agile. Navigating this array of solutions is not easy and organizations need to understand what there needs today as well as into the future to select the right solution(s) that best fit their needs. GRC 20/20 offers complimentary inquiry to organizations looking for solutions in the market and need some quick guidance as well as deeper RFP assistance and help in our RFP templates and support

GRC 20/20 maps these solutions across the following categories and capabilities:

Some organizations are looking to solve a specific problem, such as addressing a regulatory requirement like Sarbanes Oxley, US Foreign Corrupt Practices Act, UK Modern Slavery Act, UK Senior Manager’s Regime, or PCI DSS compliance (just a random sampling as there are thousands of regulations). Others are looking to address a range of requirements and risks within a specific department or domain like environmental, health and safety, IT security, internal control over financial reporting, HR investigations, or business continuity. Then some organizations look to address a specific area consistently across the organization such as enterprise policy management, third party management, or enterprise investigations management. Then there are organizations looking to address a range of domains and GRC requirements across departments in a single or core common technology backbone, this is what we refer to as Enterprise GRC platforms.

There are two things that are consider when looking at GRC related technologies.

  1. GRC is something you do not something you buy. Yes, there is a wide range of GRC related technologies in the market, but at the end of the day GRC is not about technology it is about organization’s actions, decisions, capabilities, and collaboration on GRC. The official definition of GRC as found in OCEG’s GRC Capability Model that I helped contribute to is that GRC is a capability to reliably achieve objectives [GOVERNANCE], while addressing uncertainty [RISK MANAGEMENT], and act with integrity [COMPLIANCE]. Certainly technology can enable this and make it more efficient, effective, and agile – but it is not a silver bullet that accomplishes this magically for the organization. The organization needs a strong culture, established boundaries of controls and policies, and strong processes for GRC to make a technology investment in any GRC related area a success.
  2. There is no one stop shop for all of GRC. Yes, there are GRC platforms that can accomplish a range of capabilities and needs across departments for an organization. However, there is no solution out of the 800+ solutions that does everything GRC. In fact, there are broad solutions that span many areas but they often do not go deep in some areas. Too often I find organizations with failed GRC projects because they try to do everything in one platform and find that in some weak areas of the platform they water things down and lose capabilities they previously had with deeper focused solutions.

Organizations should really be thinking about GRC architecture and not GRC platforms. There can still be a core GRC platform when the organization has the maturity and cross-department collaboration to be successful, but this platform will have constraints. Organizations are best served with understanding these constraints and integrating best of breed solutions when and where they make sense. There are many organizations I interact with and advise that have an Enterprise GRC strategy that have a strong core platform for GRC and operational risk but break off and integrate best of breed solutions that go deeper in areas such as IT GRC/security, third party management, policy management, quality management, or commodity/market risk management. In fact, this past year I interacted with three tier-1 financial services organizations that all used one GRC solution for enterprise GRC and operational risk management and all three had another solution in place for IT GRC and security that went deeper in that area.

The point is that organizations should define their strategy and understand their processes then select the right GRC technologies that provide the information and technology architecture to enable the strategy and process and not handicap it.

Some other common pitfalls in GRC solution selection to be aware of are . . .

  • RFP beauty contests. I work on a lot of RFPs, and get engaged for my RFP templates and support regularly. I have seen a lot of horrible things happen in RFPs. Good solutions get ignored because some sales person did a half-hearted attempt at answering questions while a problematic solution gets selected because they had great but not always honest answers to RFP questions. Also, some solution providers are brutally honest in their RFP responses to their own demise while other solution providers will say anything to win the deal. My job is often to come in and keep these solution providers honest and raise red flags when I see them.
  • Client references are tricky. Understand that client references that solution providers give are often the decision makers that stand behind there decision to invest thousands to hundreds of thousands of dollars in a GRC solution. They will have rosy and glowing things to say about the solution. You need to ask the hard questions to these references and word them in a way they cannot wiggle out of them. Ask them what they like least about the solution. I also thank them for their time and ask if I could talk to someone on their team that works with the solution every day – one of the GRC worker bees. I often get a completely different perspective on the solution. In one situation the Chief Audit Executive loved the product and  only had great things to say about it, while the auditors I talked to that reported to the CAE hated the solution and it was the bane of their workday.
  • Understand what is actually a feature in the solution. There are solution providers that say yes to everything in RFPs. Some do so because they are shady and will do anything it takes to win deal, others do it because they genuinely believe they have a flexible solution that simply can be tailored to meet any need or requirement. Either way, I have seen implementations that have dragged out for over two years because of all the build out and customization required to meet what the organization purchasing the solution thought already existed in the RFP. I assisted one company in their RFP and against my advice they selected a solution I did not recommend. I told them there is a lot that has to be built out for this and it will take a lot longer than they planned. They came back two years later and told me they wished they would have listened to me as they were just rolling out the initial phase of the solution and were seriously behind timeline and over budget. They now are with a different solution in the market.
  • Ease of use is critical. A solution can have tremendous capabilities but if it is complicated to use, lacks intuitiveness, and users simply ignore it . . . the implementation fails. Many solutions in the market are very dated and have interfaces that look like they are 10 to 15 years old. This makes it hard to engage all levels of the organization on GRC. The number one selection criteria I see in organizations moving from one solution that has failed them to another solution is ease of use and intuitiveness. One enterprise policy management implementation I advised after they had an abysmal failure in their implementation because what could be done in one screen took three of four screens and lacked any sense of user friendliness and intuitiveness.
  • Integration and openness is a key to success. Siloed solutions that do not integrate with other solutions are a dead-end. Organizations needs solutions that have a strong API for integration. One global Fortune 100 company I am advising on third party management needs to be able to integrate their third party management platform with their ERP environment to sync master data records. They tried one solution which failed them on this because of data integrity issues in the syncing (and user experience issues as well), they are now seeing success with a different solution that has strong integration capabilities. This is important across GRC areas. For example, policy management solutions should be able to integrate with HR systems to get new and changed employee records to be able to automate the communication of new policies when employees are on-boarded or change roles in the organization.
  • Mobility matters in GRC. In most situations if a solution does not have a mobility strategy it is best be ignored. I am seeing growing demand for using tablets and smart phones for audits, assessments, investigations & case management, policy management and communication, training and clearing, issue reporting, and more.
  • Cloud is everywhere, but be cautious. Everyone has a cloud solution – but this does not mean all cloud solutions are equal. Some use the term cloud and simply mean a hosted model while others refer to it as a multi-tenet architecture. The scalability and cost parameters can make a difference here. Security is to be critically understood and evaluated as well. I do not like the cloud naysayers that avoid it because they are concerned about security. I have seen many cloud environments that are more secure than the organizations evaluating them. This does not mean they all are secure . . . do your homework and evaluation.

I would love to hear your comments and thoughts on GRC related software and strategy. Please post below . . .

  • Have a question about GRC related solutions and strategy? GRC 20/20 offers complimentary inquiry to organizations looking to improve their policy management strategy and identify the right solutions they should be evaluating. Ask us your question . . .
  • Looking for GRC related solutions? GRC 20/20 has mapped the players in the market and understands their differentiation, strengths, weaknesses, and which ones best fit specific needs. This is supported by GRC 20/20’s RFP support project that includes access to an RFP template with over hundreds of requirements for each GRC domain.

Increased Pressure to Control Spreadsheets and Documents

Internal Control Management & Automation Solutions, The GRC Pundit BlogPublished onLeave a Comment on Increased Pressure to Control Spreadsheets and Documents

Pervasiveness of End User Computing Brings Risk

Use of end user computing applications such as spreadsheets, emails, and other document types has revolutionized how technology creates value for organizations. However, this brings a significant challenge to govern and control information and technology in a distributed and dynamic environment. Organizations are facing increased pressures from regulators and auditors to ensure that they have adequate controls over end user computing applications, particularly spreadsheets used in accounting and finance processes. This specifically has caught the attention of the Public Company Accounting Oversight Board (PCAOB) and external auditors. This scrutiny is leading to new SOX failings for companies that had previously had no such failings.

How does the organization take advantage of the wealth of benefits that end user computing solutions such as documents and spreadsheets deliver while avoiding the compromise of confidentiality, integrity, availability, and auditability of critical business information, increased risk exposure, and potential legal and regulatory actions?

End user computing applications are pervasive in the enterprise. This increases productivity and gives organizations agility that helps them succeed in a complex, dynamic, and distributed business environment. At the same time, risk and compliance issues are compounded by the extensive nature of collaboration and unstructured data. Individuals and departments can quickly set up online collaboration portals and share documents inside and outside the organization, increasing the number of people who can misuse them and simultaneously decreasing the organizations control over them. Consider that information comes in various forms:

  • Structured data is found in databases and consists of master data and transactions. Structured data can expose the organization to significant risk and compliance concerns but is contained within database structures and is to a degree easier to control, monitor, and secure.  However, pathways to export data and access to structured data is a concern to organizations when it is exported and manipulated in spreadsheets and documents.
  • Unstructured data is pervasive and quickly gets out of control. It consists of documents, emails, spreadsheets, as well as communication and collaboration technologies. Data is easily copied, disseminated, and manipulated. In the distribution process, different versions evolve and can conflict with each other. Business critical data is often stored within spreadsheets and communications subjecting the organization to risk and compliance exposure.
  • Dark data that is data that the organization has no clue about or control over. What should have been destroyed still lives on in remote corners of the organization and beyond. An older version of a spreadsheet that relies on bygone assumptions may still be accessed and used resulting in poor business decisions and faulty analytics.
  • Rogue data that is easy to manipulate and present out of context. What is legitimate information may be unintentionally or maliciously altered to present a different story out of context.
  • Duplicated data in which the organization may have understanding and control of areas where information exists, but is not aware how it has been copied and distributed. When the data changes, those changes are not reflected across areas where it has been copied, referenced, and used.
  • Pervasive data that has no boundaries — unless controlled. Employees quickly use social sharing, collaboration portals, and mobile devices to access information from wherever they are, whenever they want it with little thought to risk and compliance.

There is no doubt about it – end user computing applications are a strategic and critical business application. End user computing applications, particularly spreadsheets, represent an essential and strategic application to business, but also are a significant risk if left uncontrolled.

Specific Challenges and Risks in the Use of Spreadsheets

Organizations face a challenge: spreadsheets are a strategic, useful, and flexible business application but require significant amounts of checking and review to mitigate errors and risk. It is not the spreadsheet’s fault; it is the users’ fault. Organizations need to control spreadsheets so that they can in the end control or avoid the problems users introduce in their use – both inadvertent and malicious.

Organizations that have failed to manage and control spreadsheets have faced significant loss as the result of bad decisions from unreliable data. Lack of control can introduce significant loss to the organization: spreadsheets are prone to breaking because of user error in their configuration, values, use, and calculations. The organization, without proper end user computing controls, does not know that spreadsheets are broken and ends up relying on data that is faulty. Bad spreadsheets do not tell you they are broken; they just spit out bad information. Organizations need to have a defined process to ensure the control over end user computing applications used in critical business processes. This includes understanding:

  • Business criticality of end user computing applications. Spreadsheets and documents are business-critical applications. They offer advanced analytics and modeling of numbers, finance, and statistics. They are flexible, used, and cherished by many users. Spreadsheets and documents are here to stay, and the organization must figure out how to control them.
  • Pervasiveness of spreadsheets and documents. Spreadsheets and documents are everywhere; every workstation typically has them installed as a standard application. They electronically breed and multiply by users adapting them for different purposes. They are copied and modified with no accountability or documentation of their use. Little thought has gone into their development and they often have a host of inaccuracies.
  • Complexity and integrity of spreadsheets and documents. Spreadsheets, while a tool in everyone’s electronic toolbox, are often highly complex with bewildering math, configuration, and calculations spanning multiple worksheets. Complexity makes integrity a challenge. The data quality and integrity of spreadsheets is critical, and the more complex they are, the more control, oversight, and diligence is required.
  • Simple mistakes introduce significant errors. Spreadsheet issues resulting in loss and bad decisions come about through simple user error, miscalculations, and manual processes such as copying and pasting data. When spreadsheets and documents are not controlled or vetted, it can be quite some time before the organization realizes the loss, and in the meantime, it has grown exponentially. It is the exponential loss that finally brings attention to the fact that a simple error in a spreadsheet caused it. Organizations also struggle with the fact that as spreadsheets were developed or changed, no testing was done to provide assurance that they functioned correctly.
  • No audit trail, change control, or versioning. Changes to spreadsheets are typically not monitored, and the organization could not tell you who did what, when, how, and why. It is not a difficult task for miscreants to come in and modify numbers to cover a trail and protect themselves. Further, the data in spreadsheets can often be a mystery with no way to trace where it came from. Organizations struggle with versioning and archiving of spreadsheets because of modifications and cannot fall back to a reliable version should an error be found as there is no reliable version available.
  • Lack of accountability and ownership. In general, spreadsheets and documents are unsecured and unmonitored tools. A spreadsheet is developed and then proliferated throughout the enterprise. It may be modified, and calculations changed. Multiple versions end up existing with no single person responsible for their integrity and use. Someone may access a spreadsheet and never realize it was modified and perhaps functions in a different way or has errors in calculations and/or values.
  • Compliance and audit challenges. Organizations are under the microscope from regulators and external auditors to improve control and assurance over the data in their spreadsheets, comply with regulatory requirements, and conform to auditor expectations. Further, the internal control and audit process is cumbersome as it involves manual processes that require significant time to manually check spreadsheet integrity and function – time that constrained resources in internal audit and control staff do not have. They need an automated and reliable approach to meet expectations and requirements while minimizing risk and loss to the business.

Despite these challenges and risks, many organizations lack a thorough understanding of end-user computing solutions that present a risk to an organization’s financial reports.

Increased Pressure to Gain Control over End User Computing

The information within documents and spreadsheets faces a bombardment of risk and compliance challenges from every direction. New methods of collaborating through pervasive access to data introduce serious risk and compliance concerns. Documents shared inside, as well as outside, the organization may not be adequately protected. How does the organization take advantage of the wealth of benefits that end user computing and pervasive access to information promises? While at the same time avoiding the compromise of confidentiality, integrity, and availability of critical business information, increased risk exposure, legal actions, and regulatory actions? With an onslaught of regulations and enforcement actions, the concern of information governance, risk management, and compliance continues to grow.

The creation, integration, consumption, and analysis of information in various forms drives the products, services, operations, and finances of the organization, determines strategy, and impacts operations of organizations. A challenge to organizations is to govern information and use in end user computing applications like word processes and spreadsheets. This requires managing the uncertainty and exposure to risk that documents and spreadsheet use brings to the organization.

Spreadsheets are too often not in the purview of internal control programs, though they support and are an important part of critical business processes. Thus, they often fall below the radar of internal control, oversight, and audit with little to no governance and data standards. This is something the PCAOB and external auditors are focused on rectifying. Organizations are facing increased pressures from regulators and auditors to ensure that they have adequate controls over end user computing applications, particularly spreadsheets used in accounting and finance processes. The PCAOB specifically has requested auditors to increase their focus on ‘System Generated Data and Reports’ driving the application of so-called ‘enhanced audits’ of Sarbanes Oxley (SOX) control processes which often involve a predominant and pervasive use of end user computing applications.

This scrutiny is leading to new SOX failings for companies that had previously had no such failings. Enhanced audits are exposing the role of spreadsheets in context of Internal Control over Financial Reporting (ICFR) and the fact that spreadsheets are often open to manual manipulation.

 

Organizations have a clear need to ensure that information access and collaboration is controlled and secured. GRC roles have often been in reactive mode to an onslaught of regulations and risk and have failed to develop a sufficient strategy to govern how end user computing is used across the organization. It is the responsibility of an internal control team to work in tandem with GRC functions across areas of IT, security, legal, compliance, risk management, and audit. Together these roles have the responsibility to provide a clear strategy for end user computing controls. In that context they need to clearly define classification, policy, and control of unstructured information, and use of end user computing solutions.  This is not the responsibility of one department, but is a cooperative effort across functions. These collaborative roles need to clearly define the appropriate use of end user computing applications in policies and provide for automated controls needed to govern end user computing applications. GRC technologies that discover, monitor, and enforce control of end user computing solutions are a key component of how to address this growing need.

Information governance is not information restriction. The goal is not to inhibit business, but to protect the business. There is a legitimate need for the access to information and collaboration with others inside and outside the organization using end user computing solutions. It is the role of GRC professionals to provide this control and governance so that those who need it in the context of regulatory boundaries and risk mitigation can access information.

A GRC strategy for end user computing controls helps organizations to:

  • Ensure that ownership and accountability of information governance and collaboration through end user computing technologies is clearly established and enforced.
  • Manage ongoing business impact of risk exposure in the context of end user computing.
  • Integrate intelligence that establishes workflows and tasks when issues arise that impacts the organization in context of improper use of end user computing solutions.
  • Monitor the organization’s environment for the dissemination, access, and control of information across end user computing solutions.
  • Identify changes in risk, compliance, and control profiles spreadsheets that expose information to issues of integrity, confidentiality, availability, and auditability.
  • Visualize the impact of a change on the organization’s processes and operations in the context of information and end user computing use.

GRC 20/20 will be presenting a webinar on this topic on April 26th: The Spreadsheet and SOX: the Never Ending Battle

This post is an excerpt from GRC 20/20’s Strategy Perspective research: Gaining Control Over End User Computing: Increased Pressure to Control Spreadsheets and Documents

  • Have a question about End User Computing & Internal Control Management Solutions and Strategy? GRC 20/20 offers complimentary inquiry to organizations looking to improve their policy management strategy and identify the right solutions they should be evaluating. Ask us your question . . .
  • Internal Control Management by Design Workshop. Engage GRC 20/20 to facilitate and teach the Internal Control Management by Design Workshop in your organization.
  • Looking for Internal Control Management Solutions? GRC 20/20 has mapped the players in the market and understands their differentiation, strengths, weaknesses, and which ones best fit specific needs. This is supported by GRC 20/20’s RFP support project that includes access to an RFP template with over 500 requirements for risk management solutions.

GRC 20/20’s Internal Control Management Research includes . . .

Strategy Perspectives (written best practice research papers):

Solution Perspectives (written evaluations of solutions in the market):

Case Studies (written evaluations of specific strategies and implementations within organizations):

Gartner: Missing the Risk & Compliance (GRC) Target

The GRC Pundit BlogPublished onUpdated onLeave a Comment on Gartner: Missing the Risk & Compliance (GRC) Target

Gartner, in context of governance, risk management, and compliance (GRC) related research, is ignorant and harmful to organizations that rely on their research publications and advice.

In full disclosure, Gartner is my competitor. I have been an analyst for seventeen of my twenty-four years as a GRC professional. I spent seven years at Forrester Research, Gartner’s primary competitor, and the past ten years on my own as an independent market research analyst and advisor. Forrester I have a lot of respect for, although I wish their research on GRC related areas was deeper and evolving to keep up. Verdantix is another competitor that I have deep respect and admiration in the quality and thoroughness of their research, though they only cover a segment of the GRC market in environmental, health, and safety (EH&S). On the other hand, it is perilous to rely on Gartner’s GRC research.

My rants on Gartner are the most popular commentaries and posts that I do, but also the hardest. I am not trying to take cheap shots at a competitor. I care about this space and find the market for GRC related solutions, content, and services to be as much a passion for me as it is a career. I provide this commentary because organizations need to be wary of what and how Gartner is doing this research. Specifically, I am talking about Gartner’s GRC related research and not all their research. I have former colleagues that I deeply respect that now work for Gartner. I can’t just stay idle on their approach to their GRC related research, it would not be professional on my part.

My issues with Gartner and their approach to GRC related research run deep, these include:

  • The cost of Gartner. They charge organizations tens of thousands of dollars for very basic access to their research and analysts. Solution providers that fare well in their reports pay for redistribution rights at the cost of tens of thousands of dollars. If a solution provider or organization wants a strategy day with Gartner it is typically more than $15,000 for a day of advisory. My issue here is one of context and setting the stage. One would think their research would be deep and thorough as a result. This is not the case. Obviously, organizations are willing to pay for this even though it is outrageous. But the assumption would be that there would be deep methodologies and transparency in their research at these rates. They are trying to automate, streamline, and make more money by cutting corners. Let us now unpack this further . . .
  • Lack of consistency in evaluating solutions in Magic Quadrants. When it comes to several of the Magic Quadrants in GRC related areas, they are primarily asking for video demos. This does vary, as some Magic Quadrants do want live demonstrations. But the fact is that Gartner is inconsistent. For many of these Magic Quadrants they are not actually sitting behind the solution, navigating through it, and figuring it out how it works, all they want is a video submission. This makes their rankings in Magic Quadrants nothing more than a beauty contest in who can provide the best video demo of functionality that may or may not actually be there. They are not engaging solution providers on a fair playing field and validating functionality. Gartner analysts are often not actually working with these solutions they are ranking and scoring. They may fall back and state this is because they have previous experience with these solutions, but this is cutting corners. If you are publishing research ranking solutions then you should go through each solution step by step in a defined methodology and evaluation. A video submission does not cut this.
  • No transparency in Magic Quadrants. When it comes to Magic Quadrants, they are what they say they are . . . MAGIC. No one but Gartner knows how solution providers are measured and scored. Forrester, on the other hand, publishes all their criteria for Waves. With Gartner no one has any idea about the criteria and scores for vendors plotted on their Magic Quadrants. For example, the Operational Risk Magic Quadrant, the only way I can imagine the solutions plotting out the way they do on this is if Gartner is weighting IT security extremely high. If it was true operational risk management capabilities across operational risk areas there is no way the solutions would plot the way they do. But no one can really determine this as Gartner will not reveal criteria or scoring. This is bad research. Evaluations should be fully transparent and allow organizations to see how solutions score on specific criteria and adjust for their own needs.
  • Simplifying client reference checks. This is exacerbated by how they are streamlining client reference checks. They used to get on the phone and talk to client references and ask them the hard questions. Now there is more reliance on sending web surveys to client references. Surveys that solution providers, in some cases I am aware of, are providing pre-populated answers for their references. This is not fair. When I do reference checks I talk to clients of solution providers. Furthermore, I not only talk to the references solution providers provide, I also ask to talk to others on their teams that use the solution every day. Decision makers give glowing references, you often find a different story with the people that use a solution day in and day out. You cannot get to the dirt and issues that organizations need to understand when making purchasing decisions for solutions by sending out a survey form. Deeper conversations with stakeholders are so much more valuable than an automated survey.
  • Putting a new coat of paint on the same thing. My latest issue with Gartner is their relabeling of GRC to IRM (Integrated Risk Management). From my perspective, this is just putting a new coat of paint on the same thing. To me, it makes no sense. Organizations, associations, professional service firms, solution providers, and more have invested in GRC. So, why would they do this? Perhaps to leverage their position, creating some differentiation for Gartner? But let me ask the key question – does this help the market? I see no benefit to this name change, just obfuscation. If they do not like the acronym GRC, then just fall back to ERM (enterprise risk management). As an aside, GRC is a better acronym in my opinion. By the official definition (from OCEG), GRC is an integrated capability to reliably achieve objectives [governance], while addressing uncertainty [risk management], and act with integrity [compliance]. There is a natural flow to this and puts risk management and compliance in context of governance and objectives.

Organizations are relying on Gartner to produce quality research. They are spending tens to hundreds of thousands of dollars with Gartner. Worse, they are making investment decisions in GRC solutions with licensing that can costs hundreds of thousands a year for some organizations. Gartner is failing these organizations by cutting corners and not going deep and working with these solutions first hand. Defining proprietary markets and researching them with video demos, web survey references, and opaque scoring criteria is robbery for what Gartner charges both organizations evaluating solutions as well as the solution providers themselves.

I personally wish Gartner would ask about usability. I get so many complaints about Leaders in Magic Quadrants and Forrester Waves that struggle with interfaces that are not intuitive, difficult to use, and often look like they were coded over a decade ago.  I would love to see them say “in a live environment, configure this solution” then have them “demonstrate how the solution works.” This would show the front and back end of the products they are evaluating. They do a terrible job at differentiating products. For example . . . ask them to compare the workflow functionality of four products and they cannot. Ask them how the products differ when importing information and they cannot.

Gartner also has dropped very important areas of GRC related research, particularly Environmental, Health & Safety (EH&S). I am seeing more and more RFPs that are include EH&S as a primary focus of GRC yet Gartner abandoned this a few years back. Largely, Gartner appears to see GRC (or what they now call IRM) related solutions predominantly through an IT security point of view, as I reference with the Operational Risk Magic Quadrant, and is also apparent in their Vendor Risk Magic Quadrant.

Bottom Line on Gartner: Gartner’s approach to their risk and compliance research (e.g., GRC, IRM) is disloyal, dishonest, untrue, treacherous, and unfair from the part of an analyst who is supposed to be a trusted advisor to many. It’s outrageously expensive, but not just that: expensive for no value.

NOTE: While I have greater respect for Forrester, things need to evolve there as well. Forrester publishes their criteria and scoring, thus is transparent. But their criteria is at a high level and has not evolved much over the years. It also concerns me that they rank client satisfaction so low, where someone that scores a 1 out of 5 on client satisfaction can be positioned highly in a Wave while someone that scores a 5 out of 5 does not.

Understanding Risk Management Process & Architecture

Risk Management Solutions, The GRC Pundit BlogPublished onLeave a Comment on Understanding Risk Management Process & Architecture

The risk management strategy and policy is supported and operationalized through a risk management architecture. Organizations require complete situational and holistic awareness of risks across operations, processes, transactions, and data to see the big picture of risk in context of organizational performance and strategy. Distributed, dynamic, and disrupted business requires the organization to take a strategic approach to risk management architecture. The architecture defines how organizational processes, information, and technology is structured to make risk management effective, efficient, and agile across the organization and its relationships.

There are three areas of the risk management architecture:

  • Risk management process architecture
  • Risk management information architecture
  • Risk management technology architecture

It is critical that these architectural areas be initially defined in this order. It is the business processes that often determine the types of information needed, gathered, used, and reported. It is the information architecture combined with the process architecture that will define the organization’s requirements for the technology architecture. Too many organizations put the cart before the horse and select technology for risk management first, which then dictates what their process and information architecture will be. This forces the organization to conform to a technology for risk management instead of finding the technology that best fits their process and information needs.

Risk Management Process Architecture

Risk management processes are a part and subset of overall business processes.  Processes are used to manage and monitor the ever-changing risk environments.

The risk management process architecture is the structural design of processes, including their components of inputs, processing, and outputs. This architecture inventories and describes risk management processes, each process’s components and interactions, and how risk management processes work together as well as with other enterprise processes.

While risk management processes can be very detailed and vary by organization and industry, there are five that organizations should have in place:

  • Risk identification. This is the collection of processes aimed at automating a standard, objective approach for identifying risk. Understand your surroundings. It is about the internal business context, the external environment that business operates in, and your strategy as to where the business is heading. On an ongoing basis, and separate from monitoring of individual risks, is the ongoing process to monitor risk, regulatory, and business environments as well as the internal business environment. The purpose is to identify opportunities as well as risks that are evolving that impact the overall objectives and performance of the organization. A variety of regulatory, environmental, economic, geo-political, and internal business factors can affect the success or failure of any organization. This includes the potential for natural disasters, disruptions, commodity availability and pricing, industry developments, and geo-political risks. This also involves monitoring relevant legal and regulatory environments in corresponding jurisdictions to identify changes that could impact the business and its objectives.
  • Risk assessment. Once an organization identifies risk it then can identify what can happen to help or hinder your objectives. An organization wants to identify the possibilities of outcomes to what can impact it achieving objectives. This should go beyond heat maps to include a vareity of risk analysis and assessment techniques (e.g., bow-tie risk assessments, scenario analysis, Bayesian modeling).
  • Risk treatment. After the range of potential possibilities is understood, the organization needs to decide what to do. What is going to be the best route for the organization to achieve objectives while minimizing loss/harm. This gets into risk measurement activities of understanding inherent and residual risk while looking at risk strategies of risk acceptance, risk transfer (insurance), risk avoidance, or risk mitigation (controls). The goal is to optimize value and return while keeping risk within acceptable levels of risk tolerance and appetite.
  • Risk monitoring. This stage includes the array of processes to continuously monitor risks in the organization. These activities are the ones typically done within the organization to monitor and assess risks on an ongoing basis.
  • Risk communications & attestations. Ongoing processes to manage the communications and interactions with risk owners throughout the risk management lifecycle. These are done on a periodic basis or when certain risk conditions are triggered.

Effective risk management processes deliver:

  • Holistic awareness of risk. This means there is defined risk taxonomy across the enterprise that structures and catalogs risk in the context of business and assigns accountability. A consistent process identifies risk and keeps the taxonomy current. Various risk frameworks are harmonized into an enterprise risk framework. The IT architecture in place aggregates risk data and effectively communicates, monitors, and manages risk.
  • Establishment of risk culture and policy. Risk policy must be communicated across the business to establish a risk management culture. Risk policies are kept current, reviewed, and audited on a regular basis. Risk appetite and tolerance are established and reviewed in the context of the business, and are continuously mapped to business performance and objectives. Technology monitors key risk indicators (KRIs) to ensure management of risk policy, and the management of risk against risk appetite, tolerance, and capacity.
  • Risk-intelligent decision-making. This means the business has what it needs to make risk-intelligent business decisions. Risk strategy is integrated with business strategy — it is an integral part of business responsibilities. Risk assessment is done in the context of business change and strategic planning, and structured to complement the business lifecycle to help executives make effective decisions.
  • Accountability of risk. Accountability and risk ownership are established features of risk management. Every risk, at the enterprise and business-process level, has clearly established owners. Risk is communicated to stakeholders and the organization’s track record should illustrate successful management of risk against established risk tolerances and appetite.
  • Multidimensional risk analysis and planning. The organization needs a range of risk analytics, correlation, and scenario analysis. Various qualitative and quantitative risk analysis techniques must be in place and the organization needs an understanding of historical loss to feed into analysis. Risk treatment plans — whether acceptance, avoidance, mitigation, or transfer — must be effective and monitored for progress.
  • Visibility of risk as it relates to performance and strategy. The enterprise views and categorizes risk in the context of corporate optimization, performance, and strategy. KRIs are implemented and mapped to key performance indicators (KPIs). Risk indicators are assigned established thresholds and trigger reporting that is relevant to the business and effectively communicated. Risk information adheres to information quality, integrity, relevance, and timeliness.

The next post will explore risk management information and technology architecture. I would love to hear your thoughts and comments on risk management strategy and process . . .

This post is an excerpt from GRC 20/20’s latest Strategy Perspective research: Risk Management by Design: A Blueprint for Federated Enterprise Risk Management

  • Have a question about Risk Management Solutions and Strategy? GRC 20/20 offers complimentary inquiry to organizations looking to improve their policy management strategy and identify the right solutions they should be evaluating. Ask us your question . . .
  • Risk Management by Design Workshop. Engage GRC 20/20 to facilitate and teach the Risk Management by Design Workshop in your organization.
  • Looking for Risk Management Solutions? GRC 20/20 has mapped the players in the market and understands their differentiation, strengths, weaknesses, and which ones best fit specific needs. This is supported by GRC 20/20’s RFP support project that includes access to an RFP template with over 500 requirements for risk management solutions.

GRC 20/20’s Risk Management Research includes . . .

Register for the upcoming Research Briefing presentation:

Access the on-demand Research Briefing presentation:

Strategy Perspectives (written best practice research papers):

Solution Perspectives (written evaluations of solutions in the market):

Case Studies (written evaluations of specific strategies and implementations within organizations):