Home > Risk > Questions to ask about GRC – Part 2, question 1: Goals and Strategies

Questions to ask about GRC – Part 2, question 1: Goals and Strategies

Last week, I posted the first in what I plan to be a series of posts on the topic of ‘questions to ask about GRC’. It discussed what GRC is, a necessary foundation for any discussion of how to optimize GRC processes.

Today, we start the next section, where I suggest 12 questions that can be asked – by the board, management, or practitioners.

I welcome comments and views on each question, each of which I will post and discuss separately.


Questions to ask about GRC

It is now time to turn to the questions that board members (and others) can ask to assess whether their organization has effective GRC. This is not a comprehensive list and each organization may see fit to add to or change it as appropriate. The questions are also intended to start a discussion of each point; in other words, the board member can ask one of these questions and then ask additional, more probing questions depending on the answer received.

1.       Are goals and strategies to achieve them clearly established and communicated across the organization, so that there are common goals and objectives?

While it is routine for a board to work with management and approve the organization’s goals, objectives, and strategies, many do not ensure that they are clearly communicated to everybody whose actions should be harnessed to those goals and objectives. Instead, individual or group goals (and therefore compensation targets) are set based upon local objectives that may be inconsistent with or irrelevant to the achievement of organizational goals.

Even when there is an apparent linkage to organizational goals, the latter are often expressed at a high level without detailing who needs to do what and what assumptions have been made. As a result, individual managers interpret the organizational goals in their own way – and put corporate achievement at risk.

In addition, achieving some goals may require compromise with others. Take the example of a company that has goals of increasing both revenue and operating margins, with strategies that include managing personnel cost. One arm of the organization is planning a move into a new geography, requiring additional local sales and support personnel, but the human resources (HR) function has set spending (budget) targets that do not permit the addition of a recruitment specialist for the area. As a result, the new initiative stumbles. While HR achieves its local goals, it fails to support achievement of the corporate revenue goal.

Another example might be an organization that has goals of enhancing customer satisfaction and moving products to the cloud. The product development team decides that the only new development will be ‘in the cloud’, but existing customers using ‘on premise’ solutions are clamoring for additional functionality and are not ready to move to the cloud. Unless somebody on the executive floor takes control, achievement of one goal (cloud product development) may be at the expense of another (customer satisfaction) where the organization cannot afford to fail.

  1. July 16, 2012 at 6:28 AM

    Hi Norman: It is refreshing to see that you are taking a different and more sophisticated approach to the notion of management support, and that you adress the nuances of potential conflict / resolution. Keep up the good work on the next 11! Thx. –Don Parker

  2. Dojo Soeandy
    July 18, 2012 at 9:24 AM

    Hi Norman,

    It seems to be a bureaucratic approach,or top-down approach, in which the bottom has to achieve the goals without any input in goal setting.

    Top management or BOD might not fully realize if the goals are easy to achieve or impossible to be achieved, especially if there are so many “Yes Man” in the company. They might not know if the strategies are really reasonable or something that can facilitate some ‘personal goals’. The company should set the goals carefully or even set a team that compose of different departments.



    • Norman Marks
      July 26, 2012 at 6:16 AM

      Hi Dojo,

      I don’t really address in the post whether there is a bottom-up or top-down process for evaluating alternatives and recommending goals and strategies to the board for approval. I agree that there has to be an element of consultation within the management team before the overall corporate goals are established.

  3. Urvil
    July 18, 2012 at 11:37 AM

    I think this perspective seems more business focused rather than assurance focused. Thanks for sharing perspectives sir. 🙂

  4. Ehtisham Syed
    July 25, 2012 at 8:13 PM

    Hi Norma,

    How may goals and their types i.e. only strategic goals or financial goals or mix of both? When you say “strategies”, it sounds like for each goal there must be a different strategy to achieve the goals. This is in contrast with Porter’s view on strategy which is based on positioning, trade offs, and fit among a company’s activities. In other words there is only one strategy to achieve long term goals (BHAGs) which is your vision. Also, goals and objectives are often used interchangeably, but in this case objectives are like milestones to achieve the intended strategy over a planning period (3, 5, or 10 years). In other words, these short to medium term strategic objectives help accomplish the strategy which in turn help achieve the goals/vision.

    Do my two cents match with you thinking/approach?

  5. Ehtisham Syed
    July 25, 2012 at 8:14 PM

    Sorry, please read “Hi Norman”

  6. Norman Marks
    July 26, 2012 at 6:14 AM

    Ehtisham, in my experience as an executive with major global firms there were multiple goals.

    In the best company I worked for, there were a few (a limited number) of long-term corporate goals with subordinate goals set for the interim periods. Some might call these strategic goals or objectives, although there was typically a financial element.

    I don’t mind whether people call them goals or objectives – whatever works for that organization and its culture. In my language, you then have strategies for achieving those goals (often a many-to-many relationship)

    I agree that individual managers and units will have local, hopefully subordinate goals and objectives which contribute to the achievement of corporate goals and objectives.

    My point in the post is that when the board and top management set a direction, everybody in the organization acts in concert to drive in the same direction – with little or no wasted energy moving in irrelevant or contrary directions.

    Does that make more sense?

  1. July 18, 2012 at 6:23 AM
  2. August 6, 2012 at 5:13 AM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: