GRC Confusion

In 2008, SAP asked me to take a leadership position in talking about GRC. I was ready for a change, as my company (Business Objects, where I had led both internal audit and risk management as a vice president) had been acquired by SAP. While I had been offered an interesting opportunity in a risk management role with the company, I was less than enthusiastic about it.

I had enjoyed speaking at IIA and other conferences and seminars over the years, and the idea of making that a full-time job was appealing.

First, I had to find out what they meant by GRC!

In all my years as a risk and audit executive, I had never heard about it.

I knew what governance, risk, and compliance were individually, but I was not familiar with this acronym and why people wanted to combine three separate activities into a single expression.

SAP had a suite of programs they called GRC. But they were limited to tools to help manage user access to its ERP, maintain trade compliance (I make no comment on their own recent trade compliance problems), perform risk management, and comply with SOX. They also had a strategy management solution, but it was managed separately without integration with the solutions in “GRC”.

SAP also had a GRC department that focused on risk management, SOX compliance testing, and high-level information security oversight. The Senior Vice President of GRC also chaired their policy management committee.

These situations were not the answer to “what is GRC?” – in a way that made sense. Why the three in combination?

I found the answer in the work of the Open Compliance and Ethics Group. They have a definition of GRC that makes sense.

GRC is the capability, or integrated collection of capabilities, that enables an organization to reliably achieve objectives, address uncertainty, and act with integrity; including the governance, assurance and management of performance, risk, and compliance.

In other words, it is about achieving objectives – together.

While this makes business sense, it is not accepted by everybody.

In fact, when I did my own study of what GRC meant, I found a useless plethora of definitions and understandings.

That led me to writing and talking about the fact that GRC should stand for Governance, Risk Management, and Confusion.

I also pointed out that the G in GRC was silent in most cases, because few if any GRC departments and even fewer GRC “platforms” have functionality to help those with a governance role: the board, executive management team, legal, strategy, and so on.

I first started blogging about this in 2009 (when I was in my new role at SAP). I closed that post with (emphasis added):

So, what does this all mean? I believe that there is so much talk about GRC that we can’t ignore it. Instead, we need to:

• Recognize there is no common definition of GRC and ask everybody who uses it just what do they mean.
• Instead of talking about GRC processes and applications, talk about the real business process problems in the enterprise.
• When assessing applications from so-called GRC vendors, realize that each has a different definition of GRC and focus on the real business process needs you have. Don’t allow the fog of GRC to get in the way.
• Recognize that the assessments of the market and solutions by analysts like Forrester Research and Gartner are based on their own (different) definitions of GRC. The components they include may not all be as important to you as they have assumed in rating vendors’ solutions.

The bottom line, for me, is that we should not allow the buzzword of GRC to divert us from assessing what is needed in our business. Just because somebody includes a functionality in their “GRC platform” does not mean we have to.

In a second post, I suggested a common English variation of the OCEG definition:

I like to think of GRC as how a company is managed and directed to achieve the strategies and goals of the stakeholders, considering risks and staying within compliance boundaries of applicable laws and regulations.

I could have said it even more simply: it’s effective, thoughtful, management for success.

XX

Have people learned in the dozen years since?

I don’t think so.

People call themselves GRC professionals without any responsibility for governance activities. For the most part, they seem to be risk practitioners, compliance professionals, or internal auditors. Few have more than one part of GRC in their job description.

XX

PwC recently published “Next generation digital GRC”. Do they understand and have a useful way of talking about GRC? Look at how they start, with a quote from their Asia Pacific leader:

Throughout the last decade, the concept of governance, risk, and compliance has been viewed as a supporting function. However, more than ever, businesses are evolving to respond to shifting market dynamics, new digitally enabled competitors and changing customer expectations. Addressing these emerging challenges requires companies to rethink how to integrate GRC in order to build trust and enhance their market competitiveness. Otherwise, businesses cannot successfully manage rising uncertainty, complexity, and ambiguity around today’s regulatory and geopolitical environments.

GRC should not be considered a “supporting function”. It is how you manage for success! This is a pure sales pitch, IMHO. If this is your idea of GRC, I will let you read the PwC piece but I am not going to excerpt anything here.

The value of thinking about GRC is, as I have said in the past, that it makes you ask how everybody is working together to achieve success.

XX

Who is a GRC practitioner?

The clearest answer is the CEO. He or she has all the dimensions of G, R, and C.

But another answer is that instead of only people who have all of G, R, and C, its anybody that has at least one part of that combination. That means pretty much everybody is a GRC practitioner.

Or is it a silly expression? Should we instead talk about risk practitioners, compliance professionals, internal auditors, strategic planners, attorneys, board members, information security personnel, and so on? In other words, focus on what people are responsible for rather than tagging them with an expression that signifies nothing?

XX

I welcome your thoughts.

Advertisement