Real-World GRC Convergence: Platform Considerations

Email     |     Share  
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11
Next Real-World GRC Convergence: Platform Considerations-7 Next

GRC Convergence Platform

Key cross-domain elements of a GRC convergence platform include:

  • Data modeling supports the establishment of a consolidated GRC framework and entity hierarchy within which detailed business records (e.g., objectives, risks, controls, incidents, indicators, action plans) are managed. This core component is used across all GRC domains. Flexibility and configurability of the data modeling architecture are essential in integrated GRC deployments.
  • Content management of individual business records supports authoring, rich-text editing, cross-referencing, tagging, workspace/file collaboration with version control, change history and archiving. This core component is prominently featured in compliance (policy management) and audit management solution areas.
  • Project management is used to manage project scheduling, activities and work papers related to multiple GRC efforts, most notably audit and case management. It is also important for IT project portfolio management and is becoming more useful for the management of regulatory projects stemming from regulatory change management processes.

Integration of multiple governance, risk and compliance (GRC) disciplines on a single platform is a laudable goal, and the effort to achieve it by both vendors and their customer organizations is increasing. Notably, within the enterprise GRC (eGRC) space, integration occurs most often among the internal audit, financial controls and enterprise risk assurance functions. Conversely, the compliance function has been less inclined to integrate, due in part to the specific subject-matter expertise required for each of the compliance functions, which makes the broader risk and control sets documented by other groups less relevant to compliance teams.

Still, the Institute of Internal Auditors' (The IIA) position paper, "The Three Lines of Defense In Effective Risk Management and Control" (January 2013), offers valuable insight into why it makes sense to bring these functions together, at least on an aggregated level, even if subsets of information are contained in other source systems. According to the paper, convergence will enable the three lines (operational/business-line managers, risk and compliance functions, and internal audit) to coordinate activities, map assurance functions and perform independent validation.

But significant barriers to the comprehensive and successful integration of GRC technology across numerous groups remain. For example, many organizations continue to depend on multiple GRC technologies to fulfill different and specific departmental needs, and most organizations use different platforms for IT GRC and eGRC. Other obstacles include the lack of a unified GRC framework or a common language, the complexity of existing technologies, the lack of effective change management, and a lack of demonstrable return on investment (ROI).

Achieving convergence in the face of these obstacles requires technology capable of unifying an organization's policies, processes and infrastructure. In this slideshow, Protiviti has identified the key elements of a technology platform capable of doing so.


Related Topics : A Big Market for Big Data Jobs, Midmarket CIO, IT Management Automation, SharePoint, Technology Markets

More Slideshows

IT_Man89-290x195 9 Tips for Running a 'Tween' Company

Advice and tips for entrepreneurs and companies that are no longer startups but not quite ready for an IPO, also known as "tweens." ...  More >>

IT_Man88-190x128 Top 5 Trends Affecting Women-Owned Micro Businesses

Learn more about the challenges and opportunities presented to women leaders, especially micro-business owners. ...  More >>

Analytics21-190x128 5 Ways to Avoid Becoming 'Digital Prey'

Future IT leaders will need to seek technologies that eliminate silos in order to deliver the right information to the right person within the right application environment at the right time. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.