Category: Blogs

The Rise of GRC Architecture in GRC 3.0

The GRC Pundit BlogPublished onLeave a Comment on The Rise of GRC Architecture in GRC 3.0

Moving Beyond the GRC Platform to GRC Architecture

Business is complex.  Gone are the years of simplicity in business operations.  Exponential growth and change in regulations, globalization, distributed operations, changing processes, competitive velocity, business relationships, disruptive technology, legacy technology, and business data encumbers organizations of all sizes. Keeping this complexity and change in sync is a significant challenge for boards, executives, as well as governance, risk management, and compliance professionals (GRC) throughout the business.

GRC cannot be managed in isolation.  That is what fails.  The decentralized and disconnected distributed systems of the past catch the organization off guard to risk and expose the organization.  Complexity of business and intricacy and interconnectedness of GRC data requires that we have an integrated approach to business systems, data, and GRC. 

The Bottom Line: The organization requires complete situational and holistic awareness of GRC across operations, processes, relationships, systems, and data to see the big picture or risk and its impact on organization performance and strategy.   Distributed, dynamic, and disrupted business requires the organization to take a strategic approach to GRC architecture.  GRC fails when risk issues are addressed as a system of parts that do not integrate and work as a collective whole.  GRC also fails when it is thought of as a single platform to manage workflow and tasks.  GRC is about the interactions and relationships of cause and effect across strategy, process, transactions, information, and technology supporting the business and requires a GRC architecture approach.

Why not see BOTH the forest and the trees?

The individual components of GRC — governance, risk management, and compliance — are a necessary and intricate challenge to business.  GRC is not optional: every organization has some approach to GRC from the ad hoc to the agile.   The primary directive of a mature GRC program is to deliver effectiveness, efficiency, and agility to the business in managing the interrelationship of performance, risk, and compliance.  This requires a strategic approach that connects the enterprise, business units, processes, transactions, and information to enable transparency, discipline, and control of the ecosystem of business and operational activities. Doing this is not easy as all of these elements are in a constant state of change.

GRC maturity increases as the ability to connect, understand, analyze, and monitor interrelationships and underlying patterns of performance, risk, compliance across the business grows.  Various systems and processes interrelate in apparent and not so apparent interactions that can surprise the organization and catch it off guard.  When risk is understood and compartmented in silos the organization fails to see the web of risk interconnectedness and its impact on performance and strategy leading to greater exposure than any individual silo understood. 

To maintain integrity, and execute on strategy, the organization has to be able to see the individual area of risk (the tree) as well as the interconnectedness of risks (the forest). 

GRC relationships are non-linear.  They are not a simple equation of 1 + 1 = 2.  They are a mesh of exponential relationship and impact in which 1 + 1 = 3 or 30 or 300.  What seems like a small disruption or risk exposure may have a massive effect or no effect at all.  In a linear system effect is proportional with cause, in the non-linear world of business and GRC it is exponential. Business is chaos theory realized.  The small flutter of risk can bring down the organization. If we fail to see the interconnections of risk on the non-linear world of business the result is often exponential to unpredictable.

GRC 3.0 – Moving Beyond the GRC Platform to GRC Architecture

The core of GRC 3.0 is operationalizing GRC across the fabric of business strategy and operations – seamlessly, agilely and non-invasively.  This involves bringing GRC to the ‘coal-face’[1] of the organization through employee engagement in GRC with systems that are simple, mobile, and easy to use at the frontline of the business. It is about leveraging and harmonizing existing data and systems that deliver results in focused areas but now need to feed into the bigger picture of enterprise transparency in the context of distributed and dynamic business.

The challenge is how to reconcile business agility with GRC strategy and architecture?  Most GRC decisions were considered as a base reaction to the newest regulatory demand. This resulted in billions of dollars spent in GRC with a limited understanding alignment to the business. GRC was approached tactically and not strategically. Organizations have ended up with topography of GRC projects individually focused on risk at department or regulatory/risk issues that have often failed to deliver cross-enterprise insight needed. To use an analogy from anatomy, the enterprise GRC body has functioning heart, kidney’s, limbs, lungs, and other organs that operate as separate entities and not as part of a unified body. What is often missing is a level of integration that provides a central nervous system that connects everything and makes it operate as a body.  This is more than a GRC platform as it has been understood for the past decade.

GRC Platforms: Problem or Cure?

In GRC 2.0 organizations approached GRC as a platform to document and manage content related to risks, policies, and controls, enhanced with workflow to manage assessments, issues, and reporting.  There was limited integration and correlation of GRC information and analytics and reporting was on fairly static information collected over time. Organizations suffered when GRC did not connect all the dots and provide context to business analytics, performance, objectives and strategy in the real-time business operates in.  GRC delivers limited value to the organization when it simplifies risk management to being just surveys and forms that lead to subjective analysis.  GRC has been tactical and focused on putting out fires, particularly compliance fires.   GRC platforms have been primarily workflow, task management, and content systems to document controls and compliance and provide some subjective reporting on risk.  GRC in 1.0 and 2.0 has not delivered on a true integrated understanding of risk and performance. Organizations often have a diverse set of independent and disconnected systems to address a range of credit, market, interest, operational, strategic, reputation, capital, and regulatory risks with no integrated view across these systems.  It is not uncommon for an organization to have six different GRC platforms from different solution providers and a dozen or more other risk and compliance solutions scattered across the organization.

Organizations need to move beyond the concept of a GRC platform as it only addresses part of the challenge and focus on an integrated view of GRC data and systems through a GRC architecture that is a cohesive part of the broader business fabric of the organization. GRC technology is not about a single GRC platform that promises to be all things and fails to deliver them.

The goal of GRC 3.0 is to enable a GRC architecture that effectively reconciles organization strategy, process, information, and technology into a federated architecture model.  There still can be a central core system for GRC, but GRC is not defined as this one central system (or platform) but the integrated whole.  

GRC 3.0 is: an architecture that is enterprise wide; delivers consistent and uniform value from the boardroom to the ‘coal-face’ of the front office
; focused at value protection and creation; and is proactive in measurement, management and interdiction.  GRC 3.0 provides an integrated GRC architecture that connects the fabric of the business together across the organization and its disparate systems, processes, and information. 

[1] The ‘Coal-Face’ is a term originated in the United Kingdom referring to the miners deep in the shafts extracting coal for the business.  Every organization has a ‘coal-face.’  These are the front-line employees that make decisions every day impacting GRC and business performance. 

Where does conflict minerals fit into your broader 3rd party GRC strategy?

The GRC Pundit BlogPublished onLeave a Comment on Where does conflict minerals fit into your broader 3rd party GRC strategy?

The 3rd Party GRC market is the fastest growing segment of the GRC market.  The pressures are many: social accounability/international labor standards, quality, environmental, health and safety, privacy, informaiton security, credentialing, code of conduct, geo-political and operational risk.  An organization's vendors, suppliers, outsourcers, agents, service providers, contractors, consultants, temporary workers . . . it is hard to understand where the organization starts and stops.  The extended enterprise of today is a complex, distributed, diverse, and dynamic organizations that requires risk and complaince oversight.

One of the most significant challenges bearing down on many organizations is conflict minernal compliance.

Organizations approaching conflict mineral compliance can take several paths leading to varying degrees of program maturity.  Mature conflict mineral compliance is an integrated part of a broader governance, risk management, and compliance strategy. It requires a top-down view of conflict mineral risk that is understood in context of enterprise risks. It also means bottom-up participation where business functions identify and monitor risk and suppliers that expose the organization. GRC 20/20 has developed the third Party GRC Maturity Model to articulate maturity in conflict mineral compliance processes in context of broader third party governance, risk management, and compliance. 

  1. Ad hoc and document centric approach. Organizaitons at this level of maturity do not understand risk and exposure to conflict mineral issues.  The organization addresses conflict mineral compliance in a reactive mode and does not invest in technology for compliance and utlizes documents and emails by the thousands to get the job done.  This leads to a mountain of information requiring significant time to reconcile and report while introducing errors and omissions.  It never produces a defensible audit trail or chain of evidence of how assessments and documents were completed and reported upon.  This leaves the organization into exposure as their compliance program is riddled with flaws waiting for the auditor or regulator to pounce upon. There is limited ownership or monitoring of conflict mineral compliance, and certainly no integration of compliance information and processes. 
  2. Fragmented approach focused only on conflict minerals. Here the organization is fragemented.  Conflit mineral compliance is a defined program but operates independently of other programs monitoring risk and compliance across third party relationships.  The organization most likely has seen the value of technology and utlizes it to address conflict mineral compliance. In the broader scope of things conflict minerals is a siloed initiative operating indepentely of others such as social accountabiltiy, quality, environmental, health and safety, and anti-bribery and corruption across the supply chain.  The requirements are being met and the reports made but the organization is inefficient, ineffective, and certainly not agile as it has redundancy in approaches to third party oversight as information and processes are highly redundant and lack integration. 
  3. Integrated approach to conflict minerals as part of social accountability. The integrated stage of conflict mineral maturity is when it is understood in the context of social accountability.  The goal of conflict minerals is to address human rights violations.  This stage of maturity sees conflict mineral compliance moving beyond a compliance initiative to being an integrated part of the values and ethics of the organization and is lived out actively through the code of conduct throughout the organization and its third party relationships.  The organization has an integrated approach to not only address conflict mineral compliance but also child labor, forced labor, working hours, wage/hour, health & safety across its supply chain. The organization has developed consistent and integrated processes to manage assessments, audits, communicate policies, deliver training, report, and remediate.  Technology enables this and ensures that items are done and that the integirty of the organization is protected. 
  4. Aligned third party governance, risk management, and compliance program. In the aligned stage the organization has a cross-department strategy for managing third party GRC.  Here the organization is thinking holistically across governance, risk management, and compliance issues impacting third party relationships.  As the integrated stage sees conflict minerals in the context of social accountability, both are now managed consistently across other third party GRC areas such as anti-bribery & corruption, quality, environmental, health & safety, security, and privacy in third party relationships. The organizaiton has an integrated third party GRC platform to manage the range of these topics while delivering consistency in policy communication, training, assessment, audit, and remediation in third party relationships.  Suppliers and other third parties are relieved as there is a consistent approach and the burden of responding to multiple items in different formats goes away.  The organization benefits from removing the cost of redundant processes, forms, assessments, and approach but also gains the value of an integrated view of the integrity and health of thrid party relationships in the context of performance.
  5. Optimized as part of  an enterprise GRC architecture. At the optimized stage, the third party risk program – and with that conflict minerals – is part of the fabric of a broader enterprise GRC architecture.  As the Aligned stage brought the value of understanding third party risk and compliance in context across third party risk and compliance domains, the organization at the Optimized stage sees and understands third party risk in context of enterprise risk.  This allows for a holistic approach to a 360º conextual awareness.  The organization understands its risk and compliance posture in the context of business objectives, values, risk boundaries, and strategy.  The intricacies of third party risk and how they impact other risks such as financial, reputational, strategic, and operational are understood and managed accordingly.

How Do I Achieve Effective, Efficient, & Agile Conflict Mineral Compliance?

The GRC Pundit BlogPublished onLeave a Comment on How Do I Achieve Effective, Efficient, & Agile Conflict Mineral Compliance?

The specific obligation of the Conflict Mineral Rule is to gather information about the use and source of 3TG in products and report to the SEC (and on the organization's website). As with other significant regulations with a far reach (e.g., Sarbanes Oxley), there is a lot of confusion out of the gates. This includes misconceptions and failure to scope a program that will stand the test of time.
Organizations are best served to define a supplier GRC program and framework to address Conflict Mineral Rule requirements that will be effective today and into the future. The goal is to establish a process that meets or exceeds requirements and reduces risk exposure in a dynamic and distributed business environment. A successful supplier GRC program that addresses conflict mineral requirements is:

  • Effective. Organizations need the program to be effective in meeting requirements as well as reduce risk exposure to the organization.
  • Efficient. Developing processes that are efficient reduces both financial and human capital costs in meeting requirements and governing supplier relationships.
  • Agile. Organizations require agility in supplier governance as it operates in an ever-changing business environment – regulations and requirements change, the business itself changes and new products are developed, and the supply chain is in a constant state of change.

To be effective, efficient, and agile in supplier governance with a focus on conflict mineral compliance program requires a framework that has the following elements supported by process and technology:

  1. Ownership. At the end of the day someone needs responsibility to ensure that the conflict mineral compliance program is functioning and meeting the obligations and reducing risk exposure. This role needs executive sponsorship, as the organization will have to certify the reports it submits putting the executives and board on the line in regards to their fiduciary responsibilities.
  2. Collaboration. While the organization needs someone to lead the conflict mineral compliance program to ensure that it is both designed and operating properly, there are many departments and roles that need to be involved in the program. This includes supply-chain management, procurement, corporate compliance & ethics, legal, risk management, business operations, and audit. A cross-functional committee of roles and departments involved should be established to ensure that everyone is on board and working as a team.
  3. Policies, Procedures, & Training. The cornerstone of any compliance program is policy. In the case of conflict minerals this starts with the organizations code of conduct with a statement regarding the organization's ethics and values in relation to human rights within its operations and across supply-chain and third party relationships. This gets reflected in the supply-chain code of conduct that suppliers have to acknowledge and adhere to. Further detail on expectations, boundaries, and responsibilities is spelled out in related policies and procedures. Training is critical both internally to the organization as well as with the supply-chain so that everyone is on board and understands what is expected of them. Suppliers need to be informed of expectations and obligations as well as understand the process for compliance.
  4. Understand the organization's products. Product filtering is the cornerstone task for making conflict mineral compliance effective, efficient, and agile. The organization needs to catalog its products and the materials used and determine which ones contain 3TG. This is done to define the scope of the detailed assessment and reporting requirements. Proper scoping of products impacts the effectiveness and efficiency of the program as the organization has to track down the source of 3TG that are used in them. Scoping products correctly directly impacts the organization and suppliers burden in compliance.
  5. Assessment. The majority of conflict mineral compliance work is in the assessment process. Here the organization compiles self-assessment surveys/questionnaires to send to its suppliers. Each supplier that is involved with 3TG minerals in products needs to be sent a self-assessment survey to attest to the use and source of 3TG in those products. The challenge for organizations is to drill down deep into the supply-chain to get to the smelter and mine that the minerals came from. Organizations can send self-assessments to their direct suppliers and then require that these suppliers send self-assessments to their downstream suppliers until the original country and source of the mineral is discovered. Or the organization can insist that their suppliers inform the organization of their downstream suppliers and the organization can send assessments itself down into the depths of the supply chain. This becomes a tricky area to navigate: at many points the organization may have to rely on the attestation and information provided by suppliers finding it difficult to navigate past them to the source of the minerals. The key is to keep a watch for inaccurate and misleading information. Intelligence, intuition, and insight are needed to ensure that the organization has taken 'reasonable' steps to identify the source of conflict minerals.
  6. Due Diligence. If the organizations determines that 3TG in products is sourced from DCR or adjoining countries the next step is due diligence. The due diligence expectation is to determine if the minerals sourced from these countries are connected with armed militias. The organization needs to determine how the minerals are moved and controlled. It is expected that the organization will have to put greater oversight and control over the logistics of minerals from these countries to ensure that these groups do not profit militias known for crimes against humanity.
  7. Audit. An important element of conflict mineral compliance is the requirement to have the Conflict Mineral Report audited. Organizations need to leverage their own internal audit staff to ensure the integrity of the report, information collected, and the process for compliance. However, the requirement is to have the report audited by an external auditor. The goal of internal audit is to provide assurance and find issues for the organization to resolve before it gets to the external auditor. Both internal and external audit will need complete access to assessments and due diligence efforts to conduct their audits. Onsite inspections of suppliers should also be expected.
  8. Reporting. The primary deliverable of conflict mineral compliance is the disclosure forms that are reported to the SEC and put on the organizations website. At a minimum organizations have to file a Form SD. Organizations that have to go further and develop a Conflict Mineral Report to accompany Form SD are those that cannot provide reasonable assurance that 3TG is conflict free and have to go beyond reasonable inquiry to suppliers to a structured due diligence process that is audited. This requires the integration and analysis of all the previous collected information so that the organization can build these reports and executives can attest to accuracy.
  9. Remediation. The end game of conflict mineral regulation is to reduce the use of 3TG sourced from facilities connected to human rights violations and bring greater awareness to human rights violations connected to the militias involved with mines and smelters in the region. When issues are found, the organization is to work through the supply chain to remove these facilities and cut off funds to militia groups in the region of the DRC and their crimes against humanity.

Growing Risk Exposure in Business Relationships

The GRC Pundit BlogPublished onLeave a Comment on Growing Risk Exposure in Business Relationships
This is part 1 in GRC 20/20's series of posts on Conflict Mineral Compliance and broader 3rd Party GRC . . . 

No company is an island unto itself: organizations are a complex and diverse system of business relationships. Governance, risk management and compliance (GRC) challenges do not stop at traditional organizational boundaries. Organizations today struggle to identify, manage, and govern risk and compliance in extended business relationships as they stand in the shoes of their vendors, partners, suppliers, and other third parties. Business partner problems are the organizations problems that directly impact the organization’s brand, reputation, and increase exposure to compliance matters. When questions of business practice, ethics, safety, human rights, corruption and the environment arise, the organization is held accountable, and it must ensure that business partners behave appropriately. 

Organizations need to understand business relationships in the context of the risk and compliance  issues that impact operations and the brand. The challenge before organizations is: “Can you attest to the status of risk and compliance across the organization’s extended business relationships?”  The head of procurement, for example, is often left considering supplier risk during on-boarding of a relationship but has inadequate resources and experience to effectively monitor risk ongoing.

Managing risk across third party relationships is particularly cumbersome in the context of constantly changing regulations, relationships, employees, processes, suppliers, strategy, and more.  Risk, regulatory, and business environments are in a constant state of change. The business needs to be consistent in its GRC processes across business relationships as well. Manual spreadsheet and document centric processes are prone to failure, as they bury procurement and other areas of third party business relationship management, in mountains of data that is difficult to maintain, aggregate, and report on.  This consumes valuable resources trying to figure things out instead of actively understanding and managing third party risk and compliance exposure.  

Third party relationships — supply chain, value chain, vendors, service providers, outsourcers, agents, and contractors — cannot be left to themselves. Risk across these relationships must be monitored and managed. Business relationships must comply with regulatory requirements, corporate and regional cultures, codes of conduct, statements of social responsibility and sustainability, policies, risk limits, controls, and other business practices. Organizations need to actively demonstrate an in-compliance status throughout their extended business environment.

Managing 3rd party risk is a particular challenge in the context of conflict mineral compliance requirements across the organization’s supply chain.  Organizations need an integrated approach to manage the entire supply chain exposure to conflict minerals.  This requires a framework to manage supplier risk, conduct assessments, gather supporting information, report and analyze, resolve issues, and monitor a supply chain that is constantly changing.

In the next few weeks GRC 20/20 will post more articles in the Conflict Mineral series. . . 

 

 

Characteristics of GRC 3.0

The GRC Pundit BlogPublished on1 Comment on Characteristics of GRC 3.0

In the previous post I reviewed the history of GRC.  In this post we examine the characteristics of GRC 3.0. REMEMBER:  every organization does GRC.  You may not call it GRC but your organization has some approach to governance, risk management, and compliance.  The question is how mature is the organizations approach.  The definition of GRC is “a capability to reliably achieve objectives [governance] while addressing uncertainty [risk management] and acting with integrity [compliance].”

The Core Characteristic of GRC 3.0 is Architecture

The core of GRC 3.0 is to approach GRC as architecture involving strategy, process, information, and technology working together across the business and its operations.  GRC requires the integration of different types of applications and content across the business to achieve efficiency, effectiveness, and agility in a dynamic and distributed business environment.  This requires that we understand the business and how it operates – and how mature GRC is about integration and not necessarily one platform that tries to be all things.

There are different architecture approaches to GRC – decentralized where everyone does their own thing, centralized where everyone has to use one common GRC platform, or a federated approach.  GRC 3.0 is focused on a federated GRC approach.

A federated GRC architecture allows best of breed solutions to exist where they make sense but has a centralized capability to integrate and manage GRC information.  Instead of “one platform to replace them all” (centralized architecture model) we have the “one platform to integrate them all” (GRC 3.0 federated architecture model).

The truth is – organizations often have multiple GRC solutions in house. Different departments have invested in best of breed solutions that make sense where they are.  Gutting and replacing solutions often means the department loses functionality and we manage GRC to the lowest common denominator. No GRC solution does everything GRC.  GRC involves a range of different roles, processes, technologies, and content.  One platform simply does not do everything – or at least it cannot do everything well.

A federated GRC model allows for consolidation where it makes sense, but also allows for best of breed where it makes sense. GRC 3.0 is about building a federated GRC architecture that centralizes oversight, reporting, accountability, and analytics yet allows for integration with other GRC technologies that do specific things very well. The goal is to let GRC work with and throughout the business and not force parts of the business into a mold that does not fit. It allows for diversity while still providing integration and consistency centrally. It allows an organization to have an ecosystem of process, technology, and content that works together to provide the best alignment and value to the business.

Other characteristics of GRC 3.0 include:

  • Operationalizing GRC. Operationalizing GRC is extending GRC into business applications and processes. It is about enabling GRC across business systems and processes.  It is bringing GRC to the business intelligence, performance, and ERP environment to improve real-time insight into business decisions, operational intelligence, and monitoring.
  • Integration of content.  The integration of content and technology is core to GRC 3.0. GRC strategies are looking to integrate GRC process and technology with content from content providers to rapidly assess changing regulations, risks, industry and geopolitical events, and how they impact strategy, performance, controls, policy and the integrity of the organization.
  • 360º GRC contextual and situational awareness.  Through GRC architecture and extension into business operations the GRC environment gains a complete view of what is happening – situational awareness.  Where risk and compliance is monitored and understood in the course of business operations and transactions.
  • Bringing GRC to the ‘coal-face’.  Organizations are recognizing that effective GRC includes those on the front lines of the business – the “coal-face.” GRC 3.0 is about delivering a better end-user experience: getting employees involved by providing elegant interfaces that are intuitive and social. The goal here is to engage employees and provide them with an interface that allows them to participate in GRC without feeling intimidated and lost.
  • GRC gamification.  GRC 3.0 is focused on GRC gamification, engaging employees – that coal-face – with games and interactive content.  Implementing training and awareness programs that enables employees to earn points or badges – perhaps redeemable for certain things.  To recognize people when they make good risk decisions or alert the organization to a problem.
  • Mobility. There’s an app for GRC! GRC is embracing mobile technology on tablets and other devices.  Issue reporting is readily done through mobile devices.  Tablets can be used to deliver policies, training, and other interactive content to employees, particularly those without desktop workstation access or as a mobile kiosk for a group of employees.  Mobile devices can be used in conducting investigations, audits and compliance assessments.  The ability to record pictures and video right into compliance applications will make these processes more efficient and effective.

What are your thoughts on GRC 3.0 and its characteristics?

Life Science: Tips for Selecting Compliance and Quality Management Solution Vendors

GRC Pundit TVPublished onLeave a Comment on Life Science: Tips for Selecting Compliance and Quality Management Solution Vendors