Posted on Leave a comment

GRC 2.0 – The GRC.EcoSystem

GRC 1.0 – it was a good start.

When I originally defined the GRC market, unlike other analysts, I had a holistic view of business processes in mind that needed to participate in a GRC vision and strategy.  The goal was to make sure that GRC was not limited to SOX/finance or IT.  GRC needed to embrace a range of roles and business processes and could not be hijacked (which it often has been) by specific roles.  Thus, I defined the GRC Software Platform as one that could manage policies & procedures, risk & control assessments, loss & investigations, and analytics & reporting across the enterprise.

This was a good start and I have interacted with 114 software vendors that tell me they can do this across GRC roles (NOTE: this is a fabrication or at best a far stretch of the truth for most of them).  In the meantime, I was compiling what appeared to be an endless list of 500+ software vendors offering GRC-related solutions.   Further, I started working with consulting/professional service firms offering a range of professional services across roles and another growing list of 200+ firms.  Finally, I became more aware of the dozens of information/content providers that provided GRC-related content and information to the various roles of GRC.

GRC 2.0 – The GRC.EcoSystem expands on the original vision.

Obviously, the definition and market of GRC needs an overhaul.  And that is what I present to you today in draft form – GRC 2.0 – the GRC.EcoSystem.

The GRC.EcoSystem falls into three primary categories; each with myriad branches and interrelationship beneath them:

  1. GRC Technology Providers. The GRC.EcoSystem moves beyond the four areas I originally defined as GRC (Policy & Procedure Management, Risk & Control Management, Loss & Investigation Management, and GRC Analytics & Reporting).  It now provides an architecture that can more relevantly map the 500+ technology providers.
  2. GRC Professional Service Firms. Next, the GRC.EcoSystem provides a framework for modeling the market for the range of consulting and professional services.  This includes 200+ professional service firms from the Big 4, mid-tier audit firms, management consulting, systems integrators, outsourcers, and law firms.
  3. GRC Content Providers. Finally, the GRC.EcoSystem defines a model for mapping the dozens of firms aimed at consolidating and providing risk and compliance information to organizations.

The goal of the GRC.EcoSystem is to provide a map of the market to GRC professional roles (e.g., corporate secretary, legal, ethics, compliance, risk, security, audit, finance, IT, quality, health & safety, environmental, fraud . . . you get the picture).  This map helps these roles understand how they integrate into the holistic view of business GRC issues as well as provides a resource for them to identify the right professional service firms, content providers, and technology providers with which to work.

Next, I would like to mention that my work on the GRC.EcoSystem is integrated with my work with the Open Compliance and Ethics Group.  The GRC technology provider section is being leveraged as the foundation for what we are building together at OCEG as the GRC IT Blueprint. For those interested in OCEG’s work in this space, I would encourage you to contact OCEG to see how you can contribute to this work. Yes, I am working closely with the same individual who used to be my arch-rival and nemesis at Gartner when I was at Forrester.

As for my direction – I aim to take the structure of the GRC.EcoSystem when finalized and map, at a minimum, 500+ technology providers with over 1000+ products, 200+ professional service firms, and 50+ content providers into the GRC.EcoSystem.  It will then be my tool to size and model the market, provide direction to buyers, and build an online directory of GRC to those looking for firms to engage.

Today, I am revealing the following document drafts to get your feedback on the organization and structure of the GRC.EcoSystem so I can incorporate it into a final (but ever evolving) market landscape.

  • GRC.Ecosystem Map.  This link provides the overall visual map in tabloid format. Those interested can purchase a large color printed format from me.
  • GRC.EcoSystem Outline. This link provides the map in a text outline form that can be used alongside the map.

I would encourage you to review and provide feedback back to me on how it can be improved.  You may post a comment on this blog, or reply directly back to me at

It has been a rewarding time working with many of you – and I look forward to many more years of interactions with my new endeavor!

Posted on Leave a comment

GRC Gripes

It has been nearly four years since I originally defined the GRC market for professional services and technology solutions.  While PricewaterhouseCoopers was the first (to my knowledge) to use the acronym GRC, I was the first industry/market analyst to define a market for products and services and call it “GRC.” In fact: I have been referred to as the “Father of GRC”.

A New Year combined with starting my own company –  that provides strategic direction in governance, risk, and compliance – has allowed me to wipe the slate clean and redefine the GRC market landscape.

However, I first need to get on my soapbox and list some grievances:

  • GRC is not exclusively about technology! What a buzz I have created – every software vendor in the world seems to be defining a GRC market message.  The issue is that there is a growing perception that GRC = technology.  My formula, however, would be GRC > (is greater than) technology . A solid GRC strategy will contain a technology enablement, but GRC is bigger and broader than just what technology can provide.
  • GRC is not exclusively Sarbanes-Oxley! Another trap GRC falls into is that individuals equate it with SOX.  GRC is not just about solving SOX compliance issues.  GRC strategies may get off the ground in a company with SOX – but it needs to have a broader vision to be truly GRC.
  • GRC is not exclusively about enterprise risk management (ERM)! ERM is an important part of GRC, but ERM is just one leg of the three leg stool.   ERM is about measuring and monitoring risk across the enterprise. This may include, among many other areas, governance-related risk as well as legal and compliance risk.  However, GRC is broader than ERM in all that it ties together.
  • GRC is not about a single role owning all things GRC! There is no Chief GRC Officer – at least none that I am aware of.  GRC is about multiple roles in the organization working together – collaborating – to provide a holistic and integrated approach to GRC that includes the Corporate Secretary and Board of Directors and dives down into the weeds of quality, health & safety, security, etc.

To further explain – GRC is about collaboration between roles in the organization who share information, integrate frameworks, and provide reporting on GRC issues in order to get the big picture of what the organization is up against. Organizations implementing GRC strategies continually tell me they are aiming for four benefits to the business. . . .

  • Sustainability. Organizations demand a sustainable process and infrastructure for ongoing risk and compliance processes that are not going away.
  • Consistency. Organizations require that multiple roles in the organization start working together in an integrated framework.
  • Efficiency. The line-of-business is fighting back because of redundant assessment and audit processes looking for similar information for different purposes.
  • Transparency. Business demands transparency across key performance and risk indicators so they can monitor the organization’s health, take advantage of opportunity, and avert or mitigate disaster.
Posted on Leave a comment

Understanding GRC

Governance, Risk, and Compliance can each be confusing to understand in their individual capacities – bring them together as GRC and it can be even more confounding. GRC is more than a catchy acronym used by technology providers and consultants to market their solutions – it is a philosophy of business. This philosophy permeates the organization: its oversight, its processes, its culture. Ultimately, GRC is about the integrity of the organization:

  • Does the organization properly managed and have sound governance?
  • Does the organization take risk within risk appetite and tolerance thresholds?
  • Does the organization meet its legal/regulatory compliance obligations?
  • Does the organization make its code of ethics, policies, and procedures clear to its employees and business partners?

The challenge of GRC is that each individual term – governance, risk, compliance – has varied meanings across the organization. There is corporate governance, IT governance, financial risk, strategic risk, operational risk, IT risk, corporate compliance, Sarbanes-Oxley (SOX) compliance, employment/labor compliance, privacy compliance . . . the list of mandates and initiatives goes on and on.

It is easier to define what GRC is NOT. GRC is not about silos of risk and compliance operating independently of each other. GRC is not solely about technology – though technology plays a critical role. GRC is not just a label of services that consultants provide. GRC is not just about Sarbanes-Oxley compliance. GRC is not another label for enterprise risk management (ERM), although GRC encompasses ERM.

Further, GRC is not about a single individual owning all aspects of governance, risk, and compliance. 

GRC IS a philosophy of business. It is about individual GRC roles across the organization working in harmony to provide a complete view of governance, risk, and compliance. It is about collaboration and sharing of information, assessments, metrics, risks, investigations, and losses across these professional roles. GRC’s purpose is to show the full view of risk and compliance and identify interrelationships in today’s complex and distributed business environment. GRC is a federation of professional roles – the corporate secretary, legal, risk, audit, compliance, IT, ethics, finance, line of business, and others – working together in a common framework, collaboration, and architecture to achieve sustainability, consistency, efficiency, and transparency across the organization.

Individually, I use the following standard definitions to define the components of GRC as:

  • Governance is the culture, policies, processes, laws, and institutions that define the structure by which companies are directed and managed.
  • Risk is the effect of uncertainty on business objectives; risk management is the coordinated activities to direct and control an organization to realize opportunities while managing negative events.
  • Compliance is the act of adhering to, and demonstrating adherence to, external laws and regulations as well as corporate policies and procedures.

GRC is a three-legged stool:  governance, risk, and compliance are all necessary to effectively manage and steer the organization. In summary – good governance can only be achieved through diligent risk and compliance management. In today’s business environment, ignoring a federated view of GRC results in business processes, partners, employees, and systems that behave like leaves blowing in the wind — GRC aligns them to be more efficient and manageable. Inefficiencies, errors, and potential risks can be identified, averted, or contained, reducing exposure of the organization and ultimately creating better business performance.

How do you define GRC? What is GRC’s role within the organization (please comment)?

Posted on Leave a comment

Why Integrity?

Integrity is a mirror revealing the truth about an individual or a corporation. It involves walking the talk — not just talking it.

On a personal level, integrity is measured by what an individual does and does not do when no one is looking. Do they hold to their values, beliefs, and ethics? Or do they compromise and do the opposite of what they believe is right?

Integrity is the same at the corporate level. Corporate reports, filings, and stakeholder communications state one thing but in reality the corporation is doing something else. This inconsistency comes as a result of ignorance, market/management pressure, or an outright willingness to deceive. Within corporations it may be the result of one individual or a campaign of several seeking to violate an organization’s governance principles, risk posture, compliance obligations, culture, and ethical practices.

Integrity is violated when corporate policies and procedures are thrown out the window in the quest for personal or corporate gain. From an organization’s perspective, personal and corporate integrity are two sides of the same coin. In order for a corporation to have integrity it must have an ethical environment with employees and business partners willing to follow and enforce corporate culture, policies, and procedures. From an individual’s perspective, an employee or partner wants to make sure they are working with a corporation aimed at doing the right thing and is in sync their personal values and beliefs.

This is the reason I have launched my new firm – GRC 20/20 Research, LLC.  My objective is to assist organizations in achieving integrity in their corporate governance, risk, and compliance (GRC) processes. This is accomplished by monitoring GRC events, drivers, trends, and best practices in corporations around the world and providing insight to GRC professionals, technology vendors, and professional services firms that make up the international GRC community.

I would welcome your thoughts and perspectives on GRC and its relationship to integrity …

All the best,