Category: The GRC Pundit Blog

This is the first of a three-part series on vendor risk management through the lifecycle of the relationship. Today, we focus on steps to achieve a proper and friction-free onboarding process.

The Vendor Relationship: Stages in the Lifecycle

Traditional brick and mortar business is a thing of the past: physical buildings and conventional employees no longer define organizations. The modern organization is an interconnected mess of relationships and connections that span traditional business boundaries. Complexity grows as these interconnected relationships, processes, and systems nest themselves in intricacy. Today, business is interconnected in a flat world in which over half of the organization’s ‘insiders’ are no longer traditional employees, but are third parties such as contractors, consultants, temporary workers, outsourcers, service providers, and vendors.

An organization can face disruption and disaster by establishing or maintaining the wrong business relationships. Third party security problems are the organizations problems that directly impact the brand and reputation while increasing exposure to risk and compliance matters. When questions of security arise, the organization is held accountable, and it must ensure that third party partners behave appropriately. 

Today’s organization requires complete situational and holistic awareness of third party security and its connection to and impact on operations, processes, transactions, and data. It has become essential that organizations govern third party relationships throughout the lifecycle of the relationship:

1. Onboarding
2. Ongoing monitoring
3. Offboarding

Today we will look at the first stage of onboarding a third party relationship, ensuring the organization is doing business with the right third parties as they are brought onboard before network connections are established and data shared. 

Approaches to Onboarding

There are a variety of approaches to onboarding as part of . . .

[this is a guest blog authored by Michael Rasmussen of GRC 20/20 that can be found at Panorays site, follow the link below to read more]

As the only analyst covering the range of policy and training management solutions as its own segment of the Governance, Risk Management, and Compliance (GRC) market, I am asked several times a month on who is providing the next generation portal that integrated into one portal both policy communication and training related to the policy. The answer is very few.

Organizations need to rethink how they are managing and communicating policies in their environment. Haphazard approaches that scatter policies across different internal websites and portals in different formats is not relevant to today’s workforce and handicaps the organization in managing policy communication and awareness in an era that requires complete visibility and operational effectiveness and understanding of policies. This is particularly true of the millennial generation.

The young and advancing workforce are highly reliant on mobile technologies, and with integrated experiences. You go out to Facebook and you can watch a YouTube video right there in Facebook. You do not need to click on a link and bounce out to a completely different site to watch the video. Organizations need to integrate policy and training into one portal to engage the front lines of the organization. This portal needs to be interactive, mobile, and highly engaging in bringing policies and training together in an integrated experience. As regulators and law enforcement advance the focus on policies and training as the measurement of an operationally effective compliance program this is not a nice to have, but an essential.

The pillars of an engaging and integrated policy and training portal are that it is:

• Unified. Employees come to one policy and training portal to find everything needed. Policies are not just documents but integrated resources & tools. Video and resources are integrated alongside written policy.
• Relevant. The policy portal reflects changes in employee role and context. The most critical “need to know” policies are easy to find. Users can customize and organize the policy portal to their needs.
• Interactive. Understanding is increased through embedded media. Games, scenarios and interactive content is used to reinforce key points within policies. Pop-ups provide access to definitions & resources in written policies.
• Social and Personable. Employees can share policies and provide comment and interaction on policies. The portal makes it is easy for employees to get questions answered. The employee has an corporate avatar that is linked to badges and progress in policy and training tasks.

I am presenting a webinar tomorrow, Wednesday, August 28th, on this very topic:

• Strategies for Integrated Policies and Training – Employee Engagement

Next week, on August 4th, I am presenting on best practices in policy management:

• Blueprint for an Effective, Efficient & Agile Policy Management Program

The GRC 20/20 Policy Management by Design Workshops that dive deep into an interactive and engaging workshop on policy and training management are scheduled for the following cities and dates:

• October 10th; Chicago, USA: Compliance Management by Design, Chicago
• October 14th; Amsterdam, The Netherlands: Policy Management by Design, Amsterdam, The Netherlands
• October 16th; Stockholm, Sweden: Policy Management by Design, Stockholm, Sweden
• October 18th; Paris, France: Policy Management by Design, Paris, France
• October 21st; London, United Kingdom: Policy Management by Design, London
• October 28th; New York, USA: Policy Management by Design, New York

I have two roundtables coming up specifically for financial services on policy management:

• New York, NY, USA; September 19th: The State of Policy Governance and Conflicts of Interest / Conduct Management in Financial Services
• Charlotte, NC, USA; October 8th: The State of Policy Governance and Conflicts of Interest / Conduct Management in Financial Services

GRC 20/20’s flagship research piece on effective, efficient, and agile policy management is:

• Policy Management by Design: A Blueprint for Enterprise Policy & Training Management

Please share your thoughts and experiences on engaging employees on policy and training management . . .

A haphazard department and document centric approach for third party GRC compounds the problem and does not solve it. It is time for organizations to step back and mature their third party GRC approaches with a cross-functional and coordinated strategy and team to define and govern third party relationships. Organizations need to mature their third party governance with an integrated strategy, process, and architecture to manage the ecosystem of third party relationships with real-time information about third party performance, risk, and compliance, as well as how it impacts the organization.

GRC 20/20 has developed the Third Party GRC Maturity Model to articulate maturity in the Third Party GRC processes and provide organizations with a roadmap to support acceleration through their maturity journey.

There are five stages to the model:

1. Ad Hoc (click to read previous post)
2. Fragmented
3. Defined
4. Integrated
5. Agile

Today we look at Stage 2, the Fragmented level of Third Party GRC

The Fragmented stage sees departments with . . .

[this is a guest blog authored by Michael Rasmussen of GRC 20/20 that can be found at Aravo site, follow the link below to read more]

On 30th July, ClauseMatch hosted a Policy Management Workshop with Governance, Risk & Compliance (GRC) expert Michael Rasmussen in Singapore, the first in our global series that aim to provide a blueprint for attendees on effective policy management in today’s dynamic business, regulatory and risk environment. We caught up with Michael after the workshop to hear his summary of the main event.

ClauseMatch: Firstly, let’s recap on why we’ve decided to host a workshop in Singapore (our first in Asia).

Michael: Singapore is one of Asia’s most important business and financial hubs. There are many multinational companies based here that have operations across the region, which presents a significant challenge for compliance and risk officers in terms of policy management, particularly when you take into account the different jurisdictions and regulations that need to be complied with. 

ClauseMatch: Are there any major regulatory changes on the horizon that companies need to be aware of here in Singapore?

Michael: In April 2018 the . . .

[the rest of this article can be found as a guest blog that GRC 20/20 was part of on www.clausematch.com]

Most organizations are waking up to find their policies in a complete disarray. Over the years policy portals have sprung up across the organization. HR has their portal, IT has one, Finance/Accounting has another, Legal/Compliance still another, and it goes on through other departments. Policies look different on each portal, sometimes they conflict with each other. Policies are stored on different shared drives and now mobile devices. There are out of date policies scattered across the organization.

The majority of organizations do not even know what policies they have. At a conference I keynoted at there were 200 attendees in the room. I asked the audience who in the room has a master index of all of their policies across departments and knows what is an official policy . . . only 2 people raised their hand. I was talking to a global bank the other day and they are doing a policy discover process and found over 1,200 policies in North America alone and have not even finished the discover in this geography, and they still have to do discovery in other geographies. A large hospital chain that has acquired nearly 30 hospitals over the past two decades panicked when they realized they now have over 18,000 policy and procedure documents across these hospitals.

Policies are critical governance documents. In fact, several organizations I work with call their policy management program their Governance Documents program. They are also risk documents, the very fact an organization has a policy means somebody has identified a risk. They are certainly compliance and control documents. They need to be managed and communicated with care.

Policies also establish a legal duty of care for the organization. A policy can be used against an organization in a lawsuit, legal action, and such. There is a major retailer I have been interacting with that is concerned about this as any store manager (across 1,000s of stores) can open up a word processor and write a document and call it a policy . . . putting a legal duty of care on the retailer. They are working to identify all the official policies of the organization and put them in one policy management system and portal. Anything that is referred to as a policy that is not in the system should be reported. Policy management and communication/awareness records also provide a strong defense for an organization when it should find itself in the boiling waters of legal and regulatory inquiries.

I can go on and on with these stories, and cover many of them in detail in my Policy Management by Design workshops. I am finding many organizations are building enterprise policy management strategies that span departments to manage, communicate, and monitor policies consistently across the organization. Most often this is lead by Corporate Compliance & Ethics (sometimes under legal), and at times it is lead by Human Resources). These organizations are finding that they need a solution designed and built for managing the lifecycle and communication of policies. I am interacting with five global banks on this topic right now. But it does not stop there, there are interactions/inquiries this past month from insurance, healthcare, retail, manufacturing, life sciences, hospitality, and more looking for policy management solutions. It is just not large organizations, two inquiries this past week have been from organizations with under 1,000 employees.

However, the needs and requirements for a policy management solution vary with these organizations. The needs of a large global organization managing policies across different lines of business and in different languages are not the same as a small organization in one geography. The needs of a financial services firm trying to keep policies current with regulatory change (there are 220 regulatory change events in financial services every business day around the world) are different from those of manufacturer or hospitality firm.

GRC 20/20 has identified just over 100 solutions available in the market that do policy management. Some of these are very narrow and specific (e.g., they just do IT policies, or EH&S policies, or policies in a healthcare environment), some are broad platforms that manage policies as well as other GRC related activities (e.g., risk, incidents, controls), and some are very deep and advanced solutions for policy management.

NOTE: organizations looking for policy management solutions in the market can ask GRC 20/20 inquiries to get your questions answered.

GRC 20/20 separates policy management solutions into basic and competitive solutions, but then also distinguishes advanced capabilities that separate solutions in the market.

• Basic policy management solutions. These are solutions, and there are many of them, that address the workflow and task management of policy management with some basic reporting capabilities. Policies are typically authored outside of the solution in a word processor and attached as a file.
• Competitive policy management solutions. These are the solutions that most often come up in RFPs regularly and have stronger capabilities too author policies within the solution itself (e.g., through a built in editor, or integration with a word processor). They have more advanced reporting capabilities and provide a stronger portal for the publication of policies.

However, what really separates policy management solutions in the market are the advanced capabilities. These include:

• Collaborative policy authoring and editing. This is coming up frequently with global organizations. They find that the document check-in and check-out slows them down and want that modern collaborative experience that allows multiple people to be authoring, editing, and commenting on the same policy at the same time and to see in real-time the policy changes and edits as they are made by others.
• Advanced workflow and task management. This is often the ability to define workflow and tasks down to a section/paragraph level to an individual and not just at a document level.
• Regulatory change management. The ability to map regulations to policies and manage changes to policies as regulations change. The more advanced solutions with this capability will be able to manage a section, paragraph, or even ‘clause’ in a regulation to the same in a policy.
• Global policy management. This is the need to manage policies across different languages. The master policy may be written in one language, but then it has to be written (or updated when being maintained) in several different languages. I worked on an RFP for one global firm managing policies in 8 languages to 160,000 employees. There are other organizations I am working with that manage policies in over 20 languages. This all involves organizational mapping of policies and detailed workflow and task management capabilities.
• Engaging policy portal. I am finding more and more organizations looking for that next generation policy portal that brings policy and training management together in a unified experience. Organizations are telling me every week that employees can go out to Facebook and watch a YouTube video in Facebook. They do not have to go out too YouTube to watch the video. They want that integrated portal that provides a single point of access to policies and related training. This is particularly important for the millennial generation. They also want mobile policy portals that can be used on phones and tablets. Particularly where a tablet can become a policy and training kiosk for employees that do not have computers/laptops.
• Awareness and communication campaigns. Organizations are looking for the ability to manage communication and awareness campaigns for a policy (or groups of policies). To define tasks, workflow, and such. A new policy, such as a Code of Conduct, may have been written. In the first month all employees need to read and acknowledge. The second month they have to complete training. The third month the CEO is going to talk about the new policy at the company meeting. The fourth month managers are to bring it up in their staff meetings and document any questions or discussion on it. The fifth month a funny video or some reminder is going to go out. Then we are going to put up posters by the elevators reminding employees on the policy . . . you get the picture. Each of these involve defining the campaign activities and assigning workflow and tasks to individuals.
• Integration with business systems. This is where organizations want to be able to integrate their policy management system with their HR systems. So new employees or those that changes job roles/departments can be automatically sent the new policies and related training for their new role/function. I have worked with one life sciences company that there master employee record list came from their policy management system and not their HR systems as they has seven different HR systems and it was the policy management system that connected to each every night to gather the employee lists and identify changes to communicate policies and training. Another global high-tech firm integrated their policy and training platform with their login and access systems. If an employee was behind on critical policy training they would go to login to their computer and find that all they can access was the training. The same thing for physical access in an oil refinery and in a chemical manufacturer in a health and safety context.
• Geo-location monitoring. I have had this asked for a few times in which an employees smartphone will pick up a location change and communicate to an employee policies and other things they need to know when entering a facility (perhaps in a different country) that they had not been to before.

These are some of the advanced capabilities that I am encountering regularly. If you are looking for or evaluating policy management solutions, feel free to ask an inquiry of GRC 20/20.

Here are some policy management rescuers and events you should be aware of:

Policy Management by Design Workshops

• Policy Management by Design, Singapore, July 30th
• Compliance Management by Design, Chicago, October 10th
• Policy Management by Design, Amsterdam, The Netherlands, October 14
• Policy Management by Design, Stockholm, Sweden, October 16
• Policy Management by Design, Paris, France, October 18
• Policy Management by Design, New York, October 24

Seminars

• Forum on the State of Employee Conduct Management and Policy Governance, New York, August 8 @ 3:00 pm – 6:00 pm EDT

Webinars

• Strategies for Integrated Policies and Training – Employee Engagement, August 28 @ 9:00 am – 10:00 am CDT
• Blueprint for an Effective, Efficient & Agile Policy Management Program, September 4 @ 1:00 pm – 2:00 pm CDT

Published/Recorded GRC 20/20 Research

• Research Paper: Policy Management by Design: A Blueprint for Enterprise Policy & Training Management
• Research Briefing: How to Purchase Policy & Training Management Platforms

Have a question on Policy Management strategy, process, and/or technology?

This post is an excerpt from GRC 20/20’s most recent research piece, Third Party GRC Maturity Model: A New Paradigm in Governing Third Party Relationships, and upcoming webinar From Ad Hoc to Agile: Set Your Course for Third-Party GRC Maturity.

Traditional brick-and-mortar business is a thing of the past: physical buildings and conventional employees no longer define the organization. The modern organization is an interconnected maze of relationships and interactions that span traditional business boundaries. Layers of relationships go beyond traditional employees to include suppliers, vendors, outsourcers, service providers, contractors, subcontractors, consultants, temporary workers, agents, brokers, intermediaries, and more. Complexity grows as these interconnected relationships, processes, and systems nest themselves in intricacy, such as deep supply chains.

In this context, organizations struggle to govern third party relationships. Risk and compliance challenges do not stop at organizational boundaries. An organization can face reputation and economic disaster by establishing or maintaining the wrong business relationships, or by allowing good business relationships to sour because of weak governance of the relationship. Third party problems are the organization’s problems and directly impact the brand, as well as reputation, while increasing exposure to risk and compliance matters. 

Fragmented governance of third party relationships through disconnected silos leads the organization to inevitable failure. A haphazard department- and document-centric approach for third party governance, risk management, and compliance (GRC) compounds the problem and does not solve it. It is time for organizations to step back and mature their third party GRC approaches with a cross-functional and coordinated strategy and team to define and govern third party relationships. 

A New Paradigm in Governing Third Party Relationships

The primary directive of a mature third party GRC management program is to deliver effectiveness, efficiency, and agility to the business in managing the breadth of third party relationships in context of performance, risk, and compliance. This requires a strategy that connects the enterprise, business units, processes, transactions, and information to enable transparency, discipline, and control of the ecosystem of third parties across the extended enterprise. In the end, third party management is more than compliance and more than risk, but is also more than procurement. Using the definition for GRC^[1]  – governance, risk management and compliance – third party GRC is a “capability to reliably achieve objectives [GOVERNANCE], while addressing uncertainty [RISK MANAGEMENT], and act with integrity [COMPLIANCE]” in the organization’s third party relationships.  

Third party GRC is a “capability to reliably achieve objectives [GOVERNANCE], while addressing uncertainty [RISK MANAGEMENT], and act with integrity [COMPLIANCE]” in the organization’s third party relationships.  

Five Stages of Third Party GRC Maturity

Mature third party GRC is a seamless part of governance and operations. It requires a top-down view of third party governance, led by the executives and the board, where third party risk management is part of the fabric of business – not an unattached layer of oversight. It also means bottom-up participation, where business functions identify and monitor transactions and relationships that expose the organization. GRC 20/20 has developed the Third Party GRC Maturity Model to articulate maturity in the Third Party GRC processes and provide organizations with a roadmap to support acceleration through their maturity journey. There are five stages to the model:

1: Ad Hoc 

Organizations at the Ad Hoc stage of maturity have siloed approaches to third party governance, risk and compliance at the department level. Businesses at this stage do not understand risk and exposure in third party relationships; few if any resources are allocated to third party governance. The organization addresses third party GRC in a reactive mode — doing assessments when forced to. There is no ownership or monitoring of risk and compliance, and certainly no integration of risk and compliance information and processes in context of third party performance. 

2: Fragmented

The Fragmented stage sees departments with some focus third party GRC within respective functions — but information and processes are highly redundant and lack integration. With siloed approaches to third party GRC, the organization is still very document-centric. Processes are manual and they lack standardization, making it hard to measure effectiveness.

3: Defined

The Defined stage suggests that the organization has some areas of third party GRC that are managed well at a department level, but it lacks integration to address third party risk across departments. Organizations in the Defined stage will have defined processes for third party GRC in some departments or business functions, but there is no consistency. Third party GRC processes have the beginning of an integrated information architecture supported by technology and ongoing reporting. Accountability and oversight for certain domains such as bribery and corruption risk and compliance, and/or information security are beginning to emerge. 

4: Integrated

In the Integrated stage, the organization has a cross-department strategy for managing third party governance across risk and compliance. Third party GRC is aligned across several departments to provide consistent frameworks and processes. The organization addresses third party GRC through shared processes and information that achieve greater agility, efficiency, and effectiveness. However, not all processes and information are completely integrated, and there is not an integrated view of third party performance.

5: Agile

At the Agile stage, the organization has completely moved to an integrated approach to third party GRC across the business that includes an understanding of risk and compliance in context of performance and objectives in third party relationships. Consistent core third party GRC processes span the entire organization and its geographies. The organization benefits from consistent, relevant, and harmonized processes for third party governance with minimal overhead. 

Advancing Your Organization’s Third Party Governance Maturity 

Organizations with third party GRC processes siloed within departments operate at the Ad Hoc, Fragmented, or Defined stage. At these stages third party GRC programs manage third party risk and compliance at the departmental level and lack an integrated view with no gain in efficiencies from shared processes. 

In the Integrated and Agile maturity levels, organizations have centralized third party GRC oversight to create consistent programs around the world with a common third party GRC process, information, and technology architecture. These organizations report process efficiencies reducing human and financial capital requirements, greater agility to understand and report on third party performance, risk, and compliance, and greater effectiveness through the ability to report and analyze third party risk and compliance data. The primary difference between the Integrated and Agile stage is the integration of third party GRC in the context of performance, objectives, and strategy in individual relationships aligned with the organization. Differences may be seen in top-down support from executive management, and when various risk and compliance functions align with strategy to collaborate and share information and processes. 

The Agile Maturity approach is where most organizations will find the greatest balance in collaborative third party governance and oversight. It allows for some department/business function autonomy where needed, but focuses on a common governance model and technology architecture that the various groups in third party GRC utilize. A federated approach increases the ability to connect, understand, analyze, and monitor interrelationships and underlying patterns of performance, risk, and compliance across third party relationships. It allows different business functions to be focused on their areas while reporting into a common governance framework and architecture. Different functions participate in third party GRC management with a focus on coordination and collaboration through a common core architecture that integrates and plays well with other systems.

---

Supporting 3rd Party GRC Research . . .

GRC 20/20 has defined this in our key research papers:

• Third Party GRC Maturity Model: A New Paradigm in Governing Third Party Relationships
• Third Party Management by Design

Upcoming webinar:

• From Ad Hoc to Agile: Set Your Course for Third-Party GRC Maturity

GRC 20/20 is also presenting on how to build a business case for and evaluate the range of 3rd Party GRC solutions in the market:

• Buyers Guide: Third Party GRC Solutions

GRC 20/20 is also facilitating several upcoming workshops on this topic as well:

• Third Party Management by Design, Seattle – September 24th
• Third Party Management by Design, Minneapolis – September 26th
• Third Party Management by Design, Charlotte – October 7th

Other Case Studies, Strategy Perspectives, and Solution Perspectives on Third Party GRC can be found here.GRC 20/20’s 3rd Party GRC Research

Ask GRC 20/20 an inquiry on what 3rd Party GRC solutions available in the market and what differentiates them, this is what we do – research and analysis of technology for GRC . . . .

---

^[1]        This is the OCEG definition of GRC.

I am amazed at the number of risk management programs I encounter that lack an organized structure and approach. So often what we know as ERM (enterprise risk management) is a hodge-podge of processes and assessments that somebody tagged the ERM label on without much thought for what they were doing. In fact, most of the ERM processes I encounter are nothing more than a slightly expanded view of SOX and financial controls: they are not truly an enterprise view of risk across the organization and its operations that aligns and supports performance management and strategy.

One of the best research pieces I have seen on Risk Culture is from the Institute of Risk Management, which I am delighted to be an honorary life member and love participating in their research and events. Every organization has a culture that defines and influences how risks are understood and managed. How integrated or disintegrated risk management is with strategic planning and performance.

Most ERM programs lack the fundamental building blocks for a risk management program, and that is established in an enterprise risk management charter and policy (or something similar if you do not like the term risk as some risk pundits do not). I will be presenting on this in detail in the upcoming webinar: PART 2: Developing an Enterprise Risk Management Strategy & Policy

I worked with one Fortune 100 firm that asked me what the main components of an ERM policy are and then asked me to review and comment on theirs. Here is what I provided.

MY ANSWER: ERM policies are organization specific; no two ERM policies are identical. However, there is a logical structure that works well as a starting block for most organizations. These include the following structural components for an ERM policy:

• Objective/Purpose. As with any policy it is necessary that the policy begin with the organization and purpose of the policy. This is nothing more than writing out the charter for ERM and establishing the authority of this policy to establish and govern the ERM program.
• Risk Governance Structure. It is critical that the organization establish the governance structure for risk management and specifically how it is aligned with strategic planning and objective/performance management. This is a big area of failure for most ERM programs when it is often the case that risk management operates as an island with very little to know interaction with the board and executives or with organization strategy and objectives. A solid ERM policy will identify how the board and its committees interact with ERM as well as senior executives.
• Roles & Responsibilities. Once the governance structure is in place, the policy should get into specific roles and responsibilities for ERM. This includes a clear understanding of the roles of a Chief Risk Officer, executive management, business operations, risk owners across the business, risk management staff, and the role of audit in the assurance oversight of risk management.
• Risk Culture. The single greatest hurdle to successful ERM is articulating and integrating risk management into the organization’s culture. In one sense risk management is part of the culture no matter what is articulated in policy – an organization can have a cavalier approach to risk taking, a structured approach to risk taking and oversight thereof, or anywhere in between. The organization needs to clearly spell out how the organization approaches risk taking, ownership, management, and ongoing monitoring of risk in the organization.
• Risk Strategy. Following on the heels of risk culture, the ERM policy should next deal with how ERM aligns and integrates with corporate performance, objective, and strategy management. ERM often is disconnected from these areas which makes it of little practical use to the organization.
• Risk Tolerance & Appetite. The next logical sequence in the ERM policy is to establish the boundaries of risk taking in articulating the organization’s approach and boundaries to risk tolerance and appetite (yes, I acknowledge that some I respect hate the term appetite, but this is where you would include it). It is hear that the policy discusses what is acceptable and unacceptable risk. This provides the high-level boundaries and approach to risk taking, though most of the specifics on these boundaries will be found in supporting policies (e.g., credit risk policy).
• Risk Taxonomy. The ERM policy needs to authorize and give authority to the development and ongoing maintenance of the organization’s risk taxonomy. The highest level structure for risk management should be included in the policy – such as the establishment of risk oversight for areas such as strategic, financial/treasury, operational, and legal/compliance risks. The policy should reference and give authority to the establishment of another document that defines the depth of the structure of risk categories that the organization recognizes and manages.
• Risk Ownership. You cannot hold anyone accountable for risk unless clear ownership of risk is defined. While specific ownership of individual risks are found in supporting risk management policies (e.g., vendor risk policy, privacy policy, credit risk policy, information risk policy) – the ERM policy should state the ownership of risk at the high-level categories defined in the risk taxonomy. It should also be clear on the point that the risk management function does not own risk, the business and process owners are the ones that own risk. The ERM process is there to communicate and provide the infrastructure to manage and monitor risk to support the risk owners across the business.
• Risk Assessment Process. The ERM policy is to authorize the formation of risk assessment processes in the organization. The policy itself should outline the expectations of required periodic assessments such as an annual ERM assessment process, and is to authorize the establishment of more specific risk assessments that are established in supporting risk management policies. This section of the policy should identify the approval needed to establish a risk assessment, what structure is provided, and how the assessment gets communicated and integrated into the ERM structure.
• Risk Infrastructure, Documentation. & Communication. Documentation of risk, risk taking, risk acceptance and ownership, as well as assessment, management, and monitoring activities for risk are critical to a successful ERM program. An organization cannot hold individuals accountable for risk taking if there is not clear documentation on the risk. This section should authorize the establishment of an enterprise platform to monitor ongoing risk management processes across the organization. It should also establish a warning against the use of technologies such as spreadsheets for risk assessments that lack proper audit trails and a system of record of risk activities.
• Mitigation & Response. The ERM policy should articulate the proper response plans to risk such as risk transfer, risk acceptance, risk mitigation, and risk avoidance. While much of the details of this will be worked out in supporting risk policies, it is in the ERM policy that the are defined at a high level.
• Key Risk Indicators. Ongoing monitoring for risk is critical to a successful ERM program. This involves the authorization and establishment of a process to gather metrics on Key Risk Indicators that are further defined in supporting policies. The ERM policy should provide guidance on how KRI information is collected, how often, and establish that KRI’s are to be relevant to the business and mapped to Key Performance Indicators of the business.
• Risk Training. Individuals throughout the organization has some role in risk management as part of their day to day oversight, management, and activities – it is necessary that risk culture, risk taking, and risk responsibilities be clearly understood at all levels of the business for the various business roles and the risks they encounter and manage. The ERM policy establishes an ongoing risk training and awareness program to communicate and educate risk to employees, stakeholders, and business partners.
• Risk Budgets/Funding. The ERM policy should establish and authorize the financing for risk management and oversight activities. This ties into other sections of the ERM policy as well as supporting policies to clearly define what budget areas various risk activities will be financed from.
• Risk Activities (calendar). The ERM policy should establish what activities are required of ERM on an ongoing/calendar basis. This should include monthly/quarterly/annual reports and assessments, the individuals responsible for them, and who they get communicated to. One of the best examples I have seen of this is at Microsoft in what they have called ‘The Rhythm of Risk’ in which risk management is aligned to the needs of the board and executives based on their quarterly and monthly calendars.
• Definitions. Finally, as with all policies, a section is needed that clearly defines definitions related to risk and risk management. I encourage the use of standard definitions such as those in ISO 31000 and ISO:IEC 73.

As I stated before, no two risk management policies are alike. What I have provided here is some guidance on the sections I most often include in developing an ERM policy (as well as supporting risk policies). There are other standard sections to policies such as revision history I have not included for the sake of simplicity.

I would love to hear your thoughts on the topic of ERM policies. Please feel free to comment in this forum, or send me an e-mail. If anyone seeks further help in writing, reviewing, and/or revising their risk policies please do not hesitate to contact me.

Upcoming Risk Management Webinar Series

The Evolution of Risk: Impacting Change Across the Organization

• PART 1: Overcoming Top Challenges in Risk Management, May 29 @ 11:00 am – 12:00 pm CDT
• PART 2: Developing an Enterprise Risk Management Strategy & Policy, June 19 @ 11:00 am – 12:00 pm CDT
• PART 3: Understanding the Lifecycle & Process of Risk Management in the Rhythm of Business, July 23 @ 11:00 am – 12:00 pm CDT
• PART 4: How Technology Makes Risk Management Efficient, Effective, & Agile (and How to Build a Business Case), August 20 @ 11:00 am – 12:00 pm CDT

Upcoming Risk Management by Design Workshops

• Risk Management by Design, London, United Kingdom, June 12
• Risk Management by Design, South Africa, September 11
• Risk Management by Design, Dublin, Ireland, October 22

Other GRC 20/20 by Design Workshops

• Policy Management by Design, London, United Kingdom, June 13
• Third Party Management by Design, Seattle, USA, September 24
• Third Party Management by Design, Minneapolis, USA, September 26
• Third Party Management by Design, Charlotte, USA, October 7
• Policy Management by Design, New York, USA, October 24