Good post to read over at the Burton Blog. A snippet:
Of course, the elements of G, R, C are not dead. Governing, managing risk, and responding to compliance obligations are ongoing and critical organizational tasks. The problem is conflating them into a single term. As Burton Group is inclined to say, GRC is a four-letter word that shouldn’t be spoken among polite company. Each function is deserving of its own, complete, and separate word. There’s no organization in which compliance activities, risk management, and executive governance are rolled into a single person, group, or tool. No sense creating an acronym that implies it.
My favorite part. One of those things I’m jealous I didn’t put into writing first:
If everything is “GRC,” then nothing is.
Amen.
Reader interactions
One Reply to “A Most Concise, Accurate Description Of The Problem With GRC”
Below is my response to the Burton Group blog – which has it wrong. GRC is not about a single role or group in the organization but an approach to providing a common infrastructure and collaboration across roles for GRC.
The Governance, Risk, and Compliance (GRC) market is in significant momentum as organizations embrace collaboration across silos of GRC and generally recognize that something needs to be done. However, defining GRC can be difficult, is often misunderstood, and organizations struggle to grasp where to start.
The following standard definitions are used to define the components of GRC:
Governance is the culture, policies, processes, laws, and institutions that define the structure by which companies are directed and managed.
Risk is the effect of uncertainty on business objectives; risk management is the coordinated activities to direct and control an organization to realize opportunities while managing negative events.
Compliance is the act of adhering to, and demonstrating adherence to, external laws and regulations as well as corporate policies and procedures.
GRC is About Organizational Collaboration
GRC is more than a catchy acronym used by technology providers and consultants to market their solutions – it is a philosophy of business. This philosophy permeates the organization: its oversight, its processes, and its culture. It is about individual GRC roles across the organization working in harmony to provide a collaborative view of governance, risk, and compliance. It is about collaboration and sharing of information, assessments, metrics, risks, investigations, and losses across these professional roles.
Organizations are approaching GRC to get an enterprise view of risk and compliance with a specific need to identify interrelationships in today’s complex and distributed business environment. This requires that GRC initiatives involve a federation of professional roles – the corporate secretary, legal, risk, audit, compliance, IT, ethics, corporate social responsibility, finance, quality, environmental, health and safety, line of business, and others – working together in a common framework, collaboration, and architecture to achieve:
1 – Sustainability. Organizations demand a sustainable process and infrastructure for ongoing risk and compliance processes that are becoming more onerous. Further, organizations need to sustain their risk and compliance management practices on a continuous basis as business is changing rapidly – point in time assessments are no longer good enough.
2 – Consistency. Organizations require that multiple roles in the organization start working together in an integrated framework. Business roles of governance, risk, and compliance need to understand how their roles fit into the big picture. GRC is getting everyone to play out of the same playbook.
3 – Efficiency. The line-of-business is fighting back because of redundant assessment and audit processes looking for similar information for different purposes. GRC aims to ease the burden on the business by leveraging common processes, assessments, and information.
4 – Transparency. Business demands transparency across key performance and risk indicators so they can monitor the organization’s health, take advantage of opportunity, and avert or mitigate disaster. Corporate performance management is tightly related to risk management.