Policies are critical to the organization as they establish boundaries of behavior for individuals, processes, relationships, and transactions. Starting at the policy of all policies – the code of conduct – they filter down to govern the enterprise, divisions/regions, business units, and processes. Organizations often lack a coordinated enterprise strategy for policy development, maintenance, communication, attestation, and training. An ad hoc approach to policy management exposes the organization to significant liability. This liability is intensified by the fact that today’s compliance programs affect every person involved with supporting the business, including internal employees and third parties. To defend itself, the organization must be able to show a detailed history of what policy was in effect, how it was communicated, who read it, who was trained on it, who attested to it, what exceptions were granted, and how policy violation and resolution was monitored and managed. The haphazard department and document centric approaches for policy and training management of the past compound the problem and do not solve it.  It is time for organizations to step back and define a cross-functional and coordinated team to define and govern policy and training management.  Organizations need to wipe the slate clean and approach policy and training management by design with a strategy and architecture to manage the ecosystem of policies and training programs throughout the organization with real-time information about policy conformance and how it impacts the organization.  

1. Policy & Training Management Demands Attention
   • The Foundational Role of Policies in GRC Strategies
   • Hordes of Policies Scattered Across the Organization
   • Inevitable Failure of Policy & Training Management
2. Policy & Training Management by Design
   • Contrasting Policy & Training Management Approaches
   • Policy & Training Management Strategic Plan
   • Policy & Training Management Architecture
     • Policy & Training Management Process Architecture
     • Policy & Training Management Information Architecture
     • Policy & Training Management Technology Architecture
3. Benefits of a Policy & Training Management Strategy & Architecture
4. GRC 20/20’s Final Perspective
5. About GRC 20/20 Research, LLC
6. Research Methodology

Michael Rasmussen – The GRC Pundit @ GRC 20/20 Research, Michael Rasmussen is an internationally recognized pundit on governance, risk management, and compliance (GRC) – with specific expertise on the topics of GRC strategy, process, information, and technology architectures and solutions. With 23+ years of experience, Michael helps organizations improve GRC processes, design and implement GRC architectures, and select solutions that are effective, efficient, and agile. He is a sought-after keynote speaker, author, and advisor and is noted as the “Father of GRC” — being the first to define and model the GRC market in February 2002 while at Forrester Research, Inc.