a technology blueprint for governance, risk management and compliance carole stern switzer, esq....
TRANSCRIPT
A Technology Blueprint for Governance, Risk Management and ComplianceCarole Stern Switzer, Esq.President, [email protected]
Driving Principled Performance®
3/12/2009 (c) OCEG
Our PURPOSE
Community– Interdisciplinary, Cross-Industry– Benchmarking and Research– Education, Webinars and Events
Content– Standards & Guidelines (technical, process, content)– Repositories of Laws, Regulations and Related Standards– Media, Research and other Resources
Certification– Entire Programs or Components of a Program– Solutions, Products and Services
OCEG is the only nonprofit that helps organizations drive Principled Performance® by enhancing corporate culture and improving governance, risk management, internal control and compliance (GRC) capabilities via:
3/12/2009 (c) OCEG
3/12/2009 (c) OCEG
The Bottom Line
an organization must clearly define WHAT it will achieve and how it
will create value while addressing UNCERTAINTY, PROTECTING VALUE and staying within BOUNDARIES
3/12/2009 (c) OCEG
Principle Performance® depends on defining what is “right” for your company and doing the “right” things the “right” way – to achieve these goals.
What is GRC
3/12/2009 (c) OCEG
Integration
“Principled Performance®” requires the integration of a number of enterprise processes, most notably
Governance, Risk Management & Compliance
3/12/2009 (c) OCEG
What is New?
Increased global footprint, increased executive liability, increased volume and velocity of
mandates, increased pressure from stakeholders and other drivers are forcing organizations to…
3/12/2009 (c) OCEG
Trend or Fad?
3/12/2009 (c) OCEG
Market Need
Forrester Research Briefing “GRC Software Platform Revenues Will Rise To $1.3 Billion In 2011” … “We estimate that the market is currently $36 billion, and we expect it to grow to $50 billion over the next three years”
Forrester Research Briefing “GRC Software Platform Revenues Will Rise To $1.3 Billion In 2011” … “We estimate that the market is currently $36 billion, and we expect it to grow to $50 billion over the next three years”
AMR Research Briefing“2007 GRC spending will hit $29.9B, growing 8.5% from last year; companies now expect to spend an additional 3.6%, or $31B, in 2008.”
AMR Research Briefing“2007 GRC spending will hit $29.9B, growing 8.5% from last year; companies now expect to spend an additional 3.6%, or $31B, in 2008.”
Gartner Research Briefing “By 2009, the annual worldwide total software spending for GRC will be about $14 billion.”
Gartner Research Briefing “By 2009, the annual worldwide total software spending for GRC will be about $14 billion.”
3/12/2009 (c) OCEG
90%
“We should adopt a consistent approach or methodology for similar activities in governance,
risk and compliance”
Agree or Strongly Agree
Source: 2007 OCEG Benchmark Series: GRC Strategy Study
Most Important
3/12/2009 (c) OCEG
Adverse Impact of failure to be consistent
Increased general operating expenses
Increased cost of reconciling disparate information
Reduced margins
Higher cost from suppliers
Higher cost of capital
Source: 2007 OCEG Benchmark Series: GRC Strategy Study
3/12/2009 (c) OCEG
Red Book 2.0
3/12/2009 (c) OCEG
GRC Taxonomy & Technical Standards
OCEG GRC Capability Model
Capability Model describes common elements of an effective program that integrates the principles of good corporate governance, risk management, compliance, ethics and internal control.
Content Domains provide topical or industry-specific information that integrates with and assumes that the a capability is in place
Taxonomy & Technical Standards define key entities and systems that comprise a GRC “backbone” and interface standards so that these systems more easily and effectively integrate.
3/12/2009 (c) OCEG
Component View of the OCEG GRC Capability Model
3/12/2009 (c) OCEG
INFORM &INTEGRATE
DETECT & DISCERN
ORGANIZE & OVERSEE
ASSESS & ALIGN
MONITOR & MEASURE
PREVENT & PROMOTE
RESPOND & RESOLVE
8 INTEGRATED COMPONENTS 8 UNIVERSAL OUTCOMES
Enhance Organizational Culture
Increase Stakeholder Confidence
Prepare & Protect the Organization
Prevent, Detect & Reduce Adversity
Motivate & Inspire Desired Conduct
Improve Responsiveness & Efficiency
Optimize Economic & Social Value
Achieve Business Objectives
Element View of the GRC Capability Model
3/12/2009 (c) OCEG
Element Contents
• Principles• Common Sources of Failure• Practices• Related Requirements• Key Deliverables • Technology Modules from the GRC-IT
Blueprint
3/12/2009 (c) OCEG
3/12/2009 (c) OCEG
Effectiveness is a term of art• Design Effectiveness• Operating Effectiveness
We want to keep it that way!
Effectiveness Performance The law does not demand
anything beyond effectiveness
– BUT shareholders (stakeholders) expect more!
High-Performance
EFFECTIVE
EFFICIENT RESPONSIVE
O U T C O M E S
ACTIVITIES
Principles and Needs
IT for GRC Principles• Integration – it is unlikely a single
application can enable all GRC activities. Create a “GRC Backbone” of integrated parts
• Simplification – Simplify the architecture and use common components to enable multiple risk areas
• Reuse – Leverage existing investments and only buy when you must
• Automation – For repetitive or complex tasks, but sometimes human judgment is required
• Information – Sharing information about performance, risks, controls, incidents and resolution is fundamental to GRC. The ability to analyze this information alongside business information is the essence of GRC.
Common IT Needs for GRC:• Legal and regulatory requirements
management• Policy and procedure management• Communication management• Organization and responsibility
management• Process and control libraries or
frameworks• Risk libraries• Training and attestations• Risk and impact assessments• Audit and assurance activities• Incident and action plan
management• Alignment with the business• Visibility for process owners• Visibility at the business unit and
enterprise levels
3/12/2009 (c) OCEG
The GRC-IT Blueprint
The Blueprint defines 72 GRC Technology Modules and organizes and maps them in several ways as follows:
• To Each of the Elements of the GRC Capability Model
• Within Three Technology Levels – Business Applications– GRC Core Applications– Infrastructure
• Within Nine Technology Arenas – Assurance and Audit
Management– Business Intelligence– Business Process Management– Corporate Governance– Enterprise Content
Management– Enterprise Resource
Management– Enterprise Risk Management– Human Resources
Management– Security Management
3/12/2009 (c) OCEG
Sample Element Page
3/12/2009 (c) OCEG
Next Steps for OCEG
• Release of final Red Book 2.0 – March 2009• Release of final GRC-IT Blueprint – March 2009• Release of GRC-IT Roadmap (a process guide for
maturing use of IT for GRC with self-evaluation tools) – June 2009
• Development of GRC-XML – ongoing through OCEG Technology Council
• Launch of broader GRC-IT Community in OCEG site – June 2009
3/12/2009 (c) OCEG
A few key take aways
• The use of technology for GRC is not an option, it is a necessity
• Using the OCEG Red Book and GRC-IT Blueprint can help you benchmark against an independent standard and other companies
• There are barriers beyond budget – people like their spreadsheets; data hoarding has perceived benefits
• But don’t attempt to boil the ocean – look for small quick wins and build support for more
3/12/2009 (c) OCEG
OCEG Resources
• For more information and to access some key OCEG resources, go to: https://www.oceg.org/subscribe/FEI
• 15 days demo subscription• Download OCEG Illustrations (from the GRC Illustrated Series)
– IT ROADMAP FOR GRC– How Do We Integrate IT to Enable GRC?– HOW DO I ASSESS RISK?
• Download from the OCEG Whitepaper Series “Critical Conversations” - CFO AT THE CENTER
3/12/2009 (c) OCEG