Governance, Risk Management, and Compliance
Encyclopedia
Governance, Risk Management, and Compliance or GRC is the umbrella term covering an organization's approach across these three areas. Being closely related concerns, governance, risk and compliance activities are increasingly being integrated and aligned to some extent in order to avoid conflicts, wasteful overlaps and gaps. While interpreted differently in various organizations, GRC typically encompasses activities such as corporate governance
, enterprise risk management (ERM) and corporate compliance with applicable laws and regulations.
Governance
describes the overall management approach through which senior executives direct and control the entire organization, using a combination of management information and hierarchical management control structures. Governance activities ensure that critical management information reaching the executive team is sufficiently complete, accurate and timely to enable appropriate management decision making, and provide the control mechanisms to ensure that strategies, directions and instructions from management are carried out systematically and effectively.
Risk management
is the set of processes through which management identifies, analyzes, and, where necessary, responds appropriately to risks that might adversely affect realization of the organization's business objectives. The response to risks typically depends on their perceived gravity, and involves controlling, avoiding, accepting or transferring them to a third party. Whereas organizations routinely manage a wide range of risks (e.g. technological risks, commercial/financial risks, information security risks etc.), external legal and regulatory compliance risks are arguably the key issue in GRC.
Compliance
means conforming with stated requirements. At an organizational level, it is achieved through management processes which identify the applicable requirements (defined for example in laws, regulations, contracts, strategies and policies), assess the state of compliance, assess the risks and potential costs of non-compliance against the projected expenses to achieve compliance, and hence prioritize, fund and initiate any corrective actions deemed necessary.
Widespread interest in GRC was sparked by the US Sarbanes-Oxley Act and the need for US listed companies to design and implement suitable governance controls for SOX compliance, but the focus of GRC has since shifted towards adding business value through improving operational decision making and strategic planning. It therefore has relevance beyond the SOX world.
Governance, Risk, and Compliance or "GRC" is an increasingly recognized term that reflects a new way in which organizations are adopting an integrated approach to these aspects of their business.
Integrated Governance, Risk and Compliance
Most recently though, the term ‘Integrated governance, risk and compliance’ (iGRCTM) was broadened to include active sensor technologies such as those to protect, monitor and manage information networks and systems. UK firm Information Governance Limited teamed with Assuria, Nexor and HP to introduce an open standard termed ‘governance, risk and compliance inter-operability protocol’. By combining GRC technologies such as web based information security management systems with network security related sensor technologies via this interface protocol, it is suggested that defences against cyber attacks are enhanced.
For this initiative, the firm also introduced methods for the automatisation of control status and threat levels for enhanced situational awareness. In summary, an iGRC™ configuration is GRC technology coupled to network sensors via the open (GRCiPTM) protocol to enable recognition of threats at an early stage through the automatisation of control status and threat level change and the taking of measures to avoid it.
Cyber crime has taken on such substantial importance in recent years that target organisations for this information network sensor based iGRCTM software are likely to be those supporting critical national infrastructure, e.g. verticals and industries with significant brand/reputation risk. It is suggested that the primary value proposition for iGRCTM is as follows:
- To provide an insurance policy for CEOs wanting to assure the integrity of critical controls and measures to maintain low probability of occurrence of high impact risk events
- Calibration of risk profiles in the round and validation of controls and measures baselines
- Automatisation capabilities of control status and threat level change
iGRC Related Information Network Technologies
The combined involvement in governance, risk and compliance of a wide range of information network sensors is the compelling facet of this now broadened term, integrated governance, risk and compliance. Typical sensor types include:
- host based intrusion detection, vulnerability assessment, configuration and policy compliance, database logs, web site logs, file accesses
- hosts for penetration testing, email scanning, spam filters
- network intrusion detection and prevention, netflow, firewall/router/other network devices logs
- access and identity for successful or failed logins, new users, deleted users, privilege escalation, bio-metric identities
- web site vulnerability detection (cross site scripting, SQL injection etc), pages visited, referred from
- end-point monitoring such as permitted user activity, not permitted user activity, data leakage monitoring, USB usage monitoring and reporting
- anti-virus, anti-phishing, malware detection
- applications - most keep audit logs of activity, and
- others such as event and audit log collection for operating systems, infrastructure and applications
GRC Research
A publication review carried out in 2009 found that there is hardly any scientific research on GRC as of today. The authors went on to derive the first scientifically grounded GRC short-definition from an extensive literature review. Subsequently the definition was validated in a survey among GRC professionals. "GRC is an integrated, holistic approach to organisation-wide governance, risk and compliance ensuring that an organisation acts ethically correct and in accordance with its risk appetite, internal policies and external regulations through the alignment of strategy, processes, technology and people, thereby improving efficiency and effectiveness."
The authors then translated the definition into a frame of reference for GRC research.
Governance, Risk Management and Compliance are the core disciplines of GRC. Each of the disciplines consists of the four basic components of GRC: strategy, processes, technology and people. The organisation's risk appetite, its internal policies and external regulations constitute the rules of GRC. The disciplines, their components and rules are now to be merged in an integrated, holistic and organisation-wide (the three main characteristics of GRC) manner – aligned with the (business) operations that are managed and supported through GRC. In applying this approach, organisations long to achieve the objectives of GRC: ethically correct behaviour, and improved efficiency and effectiveness of any of the elements involved.
GRC Market Segmentation
A GRC program can be instituted to focus on any individual area within the enterprise, or a fully integrated GRC is able to work across all areas of the enterprise, using a single framework.
A fully integrated GRC uses a single core set of control material, mapped to all of the primary governance factors being monitored. The use of a single framework also has the benefit of reducing the possibility of duplicated remedial actions.
When reviewed as individual GRC areas, the three most common individual headings are considered to be Financial GRC, IT GRC, and Legal GRC.
Analysts disagree on how these aspects of GRC are defined as market categories. Gartner
has stated that the broad GRC market includes the following areas:
They further divide the IT GRC Management market into these key capabilities. Although this list relates to IT GRC, a similar list of capabilities would be suitable for other areas of GRC.
GRC Product Vendors
The distinctions between the sub-segments of the broad GRC market are often not clear. With a large number of vendors entering this market recently, determining the best product for a given business problem can be challenging. Given that the analysts don’t fully agree on the market segmentation, vendor positioning can increase the confusion.
Due to the dynamic nature of this market, any vendor analysis is often out of date relatively soon after its publication.
Broadly, the vendor market can be considered to exist in 3 segments:
Integrated governance, risk and compliance solutions attempt to unify the management of these areas, rather than treat them as separate entities. An integrated solution is able to administer one central library of compliance controls, but manage, monitor and present them against every governance factor. For example, in a domain specific approach, three or more findings could be generated against a single broken activity. The integrated solution recognizes this as one break relating to the mapped governance factors.
Domain specific governance, risk and compliance vendors understand the cyclical connection between governance, risk and compliance within a particular area of governance. For example, within Financial Processing - that a risk will either relate to the absence of a control (need to update governance) and/or the lack of adherence to (or poor quality of) an existing control. An initial goal of splitting out GRC into a separate market has left some vendors confused about the lack of movement. It is thought that a lack of deep education within a domain on the audit side, coupled with a mistrust of audit in general causes a rift in a corporate environment. However, there are vendors in the marketplace that, while remaining domain-specific, have begun marketing their product to end users and departments that, while either tangential or overlapping, have expanded to include the internal corporate internal audit (CIA) and external audit teams (tier 1 big four AND tier two and below, information security and operations/production as the target audience. This approach provides a more 'open book' approach into the process. If the production team will be audited by CIA using an application that production also has access to, is thought to reduce risk more quickly as the end goal is not to be 'compliant' but to be 'secure,' or as secure as possible.
Point Solutions to Governance, Risk & Compliance are marked by their focus on addressing only one of these areas (Governance or Risk or Compliance). In some cases of limited requirements, these solutions can serve a viable purpose. However, because they tend to have been designed to solve domain specific problems in great depth, they generally do not take a unified approach and are not tolerant of integrated governance requirements. Information systems will address these matters better if the requirements for governance, risk and compliance management are incorporated at the design stage, as part of a coherent framework.
GRC Data Warehousing & Business Intelligence
GRC vendors with an integrated data framework are now able to offer custom built GRC data warehouse and business intelligence solutions. This allows high value data from any number of existing Governance, Risk and Compliance applications to be collated and analysed.
The aggregation of GRC data using this approach adds significant benefit in the early identification of risk and business process (and business control) improvement.
Further benefits to this approach include (i) it allows existing, specialist and high value applications to continue without impact (ii) organizations can manage an easier transition into an integrated GRC approach because the initial change is only adding to the reporting layer and (iii) it provides a real-time ability to compare and contrast data value across systems that previously had no common data scheme.
Corporate governance
Corporate governance is a number of processes, customs, policies, laws, and institutions which have impact on the way a company is controlled...
, enterprise risk management (ERM) and corporate compliance with applicable laws and regulations.
Governance
Governance
Governance is the act of governing. It relates to decisions that define expectations, grant power, or verify performance. It consists of either a separate process or part of management or leadership processes...
describes the overall management approach through which senior executives direct and control the entire organization, using a combination of management information and hierarchical management control structures. Governance activities ensure that critical management information reaching the executive team is sufficiently complete, accurate and timely to enable appropriate management decision making, and provide the control mechanisms to ensure that strategies, directions and instructions from management are carried out systematically and effectively.
Risk management
Risk management
Risk management is the identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities...
is the set of processes through which management identifies, analyzes, and, where necessary, responds appropriately to risks that might adversely affect realization of the organization's business objectives. The response to risks typically depends on their perceived gravity, and involves controlling, avoiding, accepting or transferring them to a third party. Whereas organizations routinely manage a wide range of risks (e.g. technological risks, commercial/financial risks, information security risks etc.), external legal and regulatory compliance risks are arguably the key issue in GRC.
Compliance
Compliance (regulation)
In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Regulatory compliance describes the goal that corporations or public agencies aspire to in their efforts to ensure that personnel are aware of and take steps to comply with relevant laws and...
means conforming with stated requirements. At an organizational level, it is achieved through management processes which identify the applicable requirements (defined for example in laws, regulations, contracts, strategies and policies), assess the state of compliance, assess the risks and potential costs of non-compliance against the projected expenses to achieve compliance, and hence prioritize, fund and initiate any corrective actions deemed necessary.
Widespread interest in GRC was sparked by the US Sarbanes-Oxley Act and the need for US listed companies to design and implement suitable governance controls for SOX compliance, but the focus of GRC has since shifted towards adding business value through improving operational decision making and strategic planning. It therefore has relevance beyond the SOX world.
Governance, Risk, and Compliance or "GRC" is an increasingly recognized term that reflects a new way in which organizations are adopting an integrated approach to these aspects of their business.
Integrated Governance, Risk and Compliance
Most recently though, the term ‘Integrated governance, risk and compliance’ (iGRCTM) was broadened to include active sensor technologies such as those to protect, monitor and manage information networks and systems. UK firm Information Governance Limited teamed with Assuria, Nexor and HP to introduce an open standard termed ‘governance, risk and compliance inter-operability protocol’. By combining GRC technologies such as web based information security management systems with network security related sensor technologies via this interface protocol, it is suggested that defences against cyber attacks are enhanced.
For this initiative, the firm also introduced methods for the automatisation of control status and threat levels for enhanced situational awareness. In summary, an iGRC™ configuration is GRC technology coupled to network sensors via the open (GRCiPTM) protocol to enable recognition of threats at an early stage through the automatisation of control status and threat level change and the taking of measures to avoid it.
Cyber crime has taken on such substantial importance in recent years that target organisations for this information network sensor based iGRCTM software are likely to be those supporting critical national infrastructure, e.g. verticals and industries with significant brand/reputation risk. It is suggested that the primary value proposition for iGRCTM is as follows:
- To provide an insurance policy for CEOs wanting to assure the integrity of critical controls and measures to maintain low probability of occurrence of high impact risk events
- Calibration of risk profiles in the round and validation of controls and measures baselines
- Automatisation capabilities of control status and threat level change
iGRC Related Information Network Technologies
The combined involvement in governance, risk and compliance of a wide range of information network sensors is the compelling facet of this now broadened term, integrated governance, risk and compliance. Typical sensor types include:
- host based intrusion detection, vulnerability assessment, configuration and policy compliance, database logs, web site logs, file accesses
- hosts for penetration testing, email scanning, spam filters
- network intrusion detection and prevention, netflow, firewall/router/other network devices logs
- access and identity for successful or failed logins, new users, deleted users, privilege escalation, bio-metric identities
- web site vulnerability detection (cross site scripting, SQL injection etc), pages visited, referred from
- end-point monitoring such as permitted user activity, not permitted user activity, data leakage monitoring, USB usage monitoring and reporting
- anti-virus, anti-phishing, malware detection
- applications - most keep audit logs of activity, and
- others such as event and audit log collection for operating systems, infrastructure and applications
GRC Research
A publication review carried out in 2009 found that there is hardly any scientific research on GRC as of today. The authors went on to derive the first scientifically grounded GRC short-definition from an extensive literature review. Subsequently the definition was validated in a survey among GRC professionals. "GRC is an integrated, holistic approach to organisation-wide governance, risk and compliance ensuring that an organisation acts ethically correct and in accordance with its risk appetite, internal policies and external regulations through the alignment of strategy, processes, technology and people, thereby improving efficiency and effectiveness."
The authors then translated the definition into a frame of reference for GRC research.
Governance, Risk Management and Compliance are the core disciplines of GRC. Each of the disciplines consists of the four basic components of GRC: strategy, processes, technology and people. The organisation's risk appetite, its internal policies and external regulations constitute the rules of GRC. The disciplines, their components and rules are now to be merged in an integrated, holistic and organisation-wide (the three main characteristics of GRC) manner – aligned with the (business) operations that are managed and supported through GRC. In applying this approach, organisations long to achieve the objectives of GRC: ethically correct behaviour, and improved efficiency and effectiveness of any of the elements involved.
GRC Market Segmentation
A GRC program can be instituted to focus on any individual area within the enterprise, or a fully integrated GRC is able to work across all areas of the enterprise, using a single framework.
A fully integrated GRC uses a single core set of control material, mapped to all of the primary governance factors being monitored. The use of a single framework also has the benefit of reducing the possibility of duplicated remedial actions.
When reviewed as individual GRC areas, the three most common individual headings are considered to be Financial GRC, IT GRC, and Legal GRC.
- Financial GRC relates to the activities that are intended to ensure the correct operation of all financial processes, as well as compliance with any finance-related mandates.
- IT GRC relates to the activities intended to ensure that the IT (Information Technology) organization supports the current and future needs of the business, and complies with all IT-related mandates.
- Legal GRC focuses on tying together all three components via an organization's legal department and Chief Compliance Officer.
Analysts disagree on how these aspects of GRC are defined as market categories. Gartner
Gartner
Gartner, Inc. is an information technology research and advisory firm headquartered in Stamford, Connecticut, United States. It was known as GartnerGroup until 2001....
has stated that the broad GRC market includes the following areas:
- Finance and Audit GRC
- IT GRC Management
- Enterprise Risk Management.
They further divide the IT GRC Management market into these key capabilities. Although this list relates to IT GRC, a similar list of capabilities would be suitable for other areas of GRC.
- Controls and policy library
- Policy distribution and response
- IT Controls self-assessment and measurement
- IT Asset repository
- Automated general computer control (GCC) collection
- Remediation and exception management
- Reporting
- Advanced IT risk evaluation and compliance dashboards
GRC Product Vendors
The distinctions between the sub-segments of the broad GRC market are often not clear. With a large number of vendors entering this market recently, determining the best product for a given business problem can be challenging. Given that the analysts don’t fully agree on the market segmentation, vendor positioning can increase the confusion.
Due to the dynamic nature of this market, any vendor analysis is often out of date relatively soon after its publication.
Broadly, the vendor market can be considered to exist in 3 segments:
- Integrated Governance, Risk & Compliance Solutions (Multi-Governance Interest, Enterprise Wide)
- Domain Specific GRC Solutions (Single Governance Interest, Enterprise Wide)
- Point Solutions to Governance, Risk or Compliance (Relate to Enterprise Wide Governance or Enterprise Wide Risk or Enterprise Wide Compliance but not in combination.)
Integrated governance, risk and compliance solutions attempt to unify the management of these areas, rather than treat them as separate entities. An integrated solution is able to administer one central library of compliance controls, but manage, monitor and present them against every governance factor. For example, in a domain specific approach, three or more findings could be generated against a single broken activity. The integrated solution recognizes this as one break relating to the mapped governance factors.
Domain specific governance, risk and compliance vendors understand the cyclical connection between governance, risk and compliance within a particular area of governance. For example, within Financial Processing - that a risk will either relate to the absence of a control (need to update governance) and/or the lack of adherence to (or poor quality of) an existing control. An initial goal of splitting out GRC into a separate market has left some vendors confused about the lack of movement. It is thought that a lack of deep education within a domain on the audit side, coupled with a mistrust of audit in general causes a rift in a corporate environment. However, there are vendors in the marketplace that, while remaining domain-specific, have begun marketing their product to end users and departments that, while either tangential or overlapping, have expanded to include the internal corporate internal audit (CIA) and external audit teams (tier 1 big four AND tier two and below, information security and operations/production as the target audience. This approach provides a more 'open book' approach into the process. If the production team will be audited by CIA using an application that production also has access to, is thought to reduce risk more quickly as the end goal is not to be 'compliant' but to be 'secure,' or as secure as possible.
Point Solutions to Governance, Risk & Compliance are marked by their focus on addressing only one of these areas (Governance or Risk or Compliance). In some cases of limited requirements, these solutions can serve a viable purpose. However, because they tend to have been designed to solve domain specific problems in great depth, they generally do not take a unified approach and are not tolerant of integrated governance requirements. Information systems will address these matters better if the requirements for governance, risk and compliance management are incorporated at the design stage, as part of a coherent framework.
GRC Data Warehousing & Business Intelligence
GRC vendors with an integrated data framework are now able to offer custom built GRC data warehouse and business intelligence solutions. This allows high value data from any number of existing Governance, Risk and Compliance applications to be collated and analysed.
The aggregation of GRC data using this approach adds significant benefit in the early identification of risk and business process (and business control) improvement.
Further benefits to this approach include (i) it allows existing, specialist and high value applications to continue without impact (ii) organizations can manage an easier transition into an integrated GRC approach because the initial change is only adding to the reporting layer and (iii) it provides a real-time ability to compare and contrast data value across systems that previously had no common data scheme.
External links
- Open Compliance & Ethics Group (OCEG), OCEG is a nonprofit organization that provides numerous resources for corporate governance, risk management, compliance and business ethics.
- GRC-Resource.com, GRC-Resource provides free information and scientific publications on integrated approaches to GRC.
- http://www.complianceonline.com, GRC community that provides a viral GRC forum and training on different topics conducted by community experts
- Real Time Governance, GRC site that shows how a practical steps are taken to in an organisation to address GRC issues