a technology blueprint for governance, risk management and compliance carole stern switzer, esq....

A Technology Blueprint for Governance, Risk Management and ComplianceCarole Stern Switzer, Esq.President, OCEGcswitzer@oceg.org

Driving Principled Performance®

3/12/2009 (c) OCEG

Our PURPOSE

Community– Interdisciplinary, Cross-Industry– Benchmarking and Research– Education, Webinars and Events

Content– Standards & Guidelines (technical, process, content)– Repositories of Laws, Regulations and Related Standards– Media, Research and other Resources

Certification– Entire Programs or Components of a Program– Solutions, Products and Services

OCEG is the only nonprofit that helps organizations drive Principled Performance® by enhancing corporate culture and improving governance, risk management, internal control and compliance (GRC) capabilities via:

3/12/2009 (c) OCEG

3/12/2009 (c) OCEG

The Bottom Line

an organization must clearly define WHAT it will achieve and how it

will create value while addressing UNCERTAINTY, PROTECTING VALUE and staying within BOUNDARIES

3/12/2009 (c) OCEG

Principle Performance® depends on defining what is “right” for your company and doing the “right” things the “right” way – to achieve these goals.

What is GRC

3/12/2009 (c) OCEG

Integration

“Principled Performance®” requires the integration of a number of enterprise processes, most notably

Governance, Risk Management & Compliance

3/12/2009 (c) OCEG

What is New?

Increased global footprint, increased executive liability, increased volume and velocity of

mandates, increased pressure from stakeholders and other drivers are forcing organizations to…

3/12/2009 (c) OCEG

Trend or Fad?

3/12/2009 (c) OCEG

Market Need

Forrester Research Briefing “GRC Software Platform Revenues Will Rise To $1.3 Billion In 2011” … “We estimate that the market is currently $36 billion, and we expect it to grow to $50 billion over the next three years”

Forrester Research Briefing “GRC Software Platform Revenues Will Rise To $1.3 Billion In 2011” … “We estimate that the market is currently $36 billion, and we expect it to grow to $50 billion over the next three years”

AMR Research Briefing“2007 GRC spending will hit $29.9B, growing 8.5% from last year; companies now expect to spend an additional 3.6%, or $31B, in 2008.”

AMR Research Briefing“2007 GRC spending will hit $29.9B, growing 8.5% from last year; companies now expect to spend an additional 3.6%, or $31B, in 2008.”

Gartner Research Briefing “By 2009, the annual worldwide total software spending for GRC will be about $14 billion.”

Gartner Research Briefing “By 2009, the annual worldwide total software spending for GRC will be about $14 billion.”

3/12/2009 (c) OCEG

90%

“We should adopt a consistent approach or methodology for similar activities in governance,

risk and compliance”

Agree or Strongly Agree

Source: 2007 OCEG Benchmark Series: GRC Strategy Study

Most Important

3/12/2009 (c) OCEG

Adverse Impact of failure to be consistent

Increased general operating expenses

Increased cost of reconciling disparate information

Reduced margins

Higher cost from suppliers

Higher cost of capital

Source: 2007 OCEG Benchmark Series: GRC Strategy Study

3/12/2009 (c) OCEG

Red Book 2.0

3/12/2009 (c) OCEG

GRC Taxonomy & Technical Standards

OCEG GRC Capability Model

Capability Model describes common elements of an effective program that integrates the principles of good corporate governance, risk management, compliance, ethics and internal control.

Content Domains provide topical or industry-specific information that integrates with and assumes that the a capability is in place

Taxonomy & Technical Standards define key entities and systems that comprise a GRC “backbone” and interface standards so that these systems more easily and effectively integrate.

3/12/2009 (c) OCEG

Component View of the OCEG GRC Capability Model

3/12/2009 (c) OCEG

INFORM &INTEGRATE

DETECT & DISCERN

ORGANIZE & OVERSEE

ASSESS & ALIGN

MONITOR & MEASURE

PREVENT & PROMOTE

RESPOND & RESOLVE

8 INTEGRATED COMPONENTS 8 UNIVERSAL OUTCOMES

Enhance Organizational Culture

Increase Stakeholder Confidence

Prepare & Protect the Organization

Prevent, Detect & Reduce Adversity

Motivate & Inspire Desired Conduct

Improve Responsiveness & Efficiency

Optimize Economic & Social Value

Achieve Business Objectives

Element View of the GRC Capability Model

3/12/2009 (c) OCEG

Element Contents

• Principles• Common Sources of Failure• Practices• Related Requirements• Key Deliverables • Technology Modules from the GRC-IT

Blueprint

3/12/2009 (c) OCEG

3/12/2009 (c) OCEG

Effectiveness is a term of art• Design Effectiveness• Operating Effectiveness

We want to keep it that way!

Effectiveness Performance The law does not demand

anything beyond effectiveness

– BUT shareholders (stakeholders) expect more!

High-Performance

EFFECTIVE

EFFICIENT RESPONSIVE

O U T C O M E S

ACTIVITIES

Principles and Needs

IT for GRC Principles• Integration – it is unlikely a single

application can enable all GRC activities. Create a “GRC Backbone” of integrated parts

• Simplification – Simplify the architecture and use common components to enable multiple risk areas

• Reuse – Leverage existing investments and only buy when you must

• Automation – For repetitive or complex tasks, but sometimes human judgment is required

• Information – Sharing information about performance, risks, controls, incidents and resolution is fundamental to GRC. The ability to analyze this information alongside business information is the essence of GRC.

Common IT Needs for GRC:• Legal and regulatory requirements

management• Policy and procedure management• Communication management• Organization and responsibility

management• Process and control libraries or

frameworks• Risk libraries• Training and attestations• Risk and impact assessments• Audit and assurance activities• Incident and action plan

management• Alignment with the business• Visibility for process owners• Visibility at the business unit and

enterprise levels

3/12/2009 (c) OCEG

The GRC-IT Blueprint

The Blueprint defines 72 GRC Technology Modules and organizes and maps them in several ways as follows:

• To Each of the Elements of the GRC Capability Model

• Within Three Technology Levels – Business Applications– GRC Core Applications– Infrastructure

• Within Nine Technology Arenas – Assurance and Audit

Management– Business Intelligence– Business Process Management– Corporate Governance– Enterprise Content

Management– Enterprise Resource

Management– Enterprise Risk Management– Human Resources

Management– Security Management

3/12/2009 (c) OCEG

Sample Element Page

3/12/2009 (c) OCEG

Next Steps for OCEG

• Release of final Red Book 2.0 – March 2009• Release of final GRC-IT Blueprint – March 2009• Release of GRC-IT Roadmap (a process guide for

maturing use of IT for GRC with self-evaluation tools) – June 2009

• Development of GRC-XML – ongoing through OCEG Technology Council

• Launch of broader GRC-IT Community in OCEG site – June 2009

3/12/2009 (c) OCEG

A few key take aways

• The use of technology for GRC is not an option, it is a necessity

• Using the OCEG Red Book and GRC-IT Blueprint can help you benchmark against an independent standard and other companies

• There are barriers beyond budget – people like their spreadsheets; data hoarding has perceived benefits

• But don’t attempt to boil the ocean – look for small quick wins and build support for more

3/12/2009 (c) OCEG

OCEG Resources

• For more information and to access some key OCEG resources, go to: https://www.oceg.org/subscribe/FEI

• 15 days demo subscription• Download OCEG Illustrations (from the GRC Illustrated Series)

– IT ROADMAP FOR GRC– How Do We Integrate IT to Enable GRC?– HOW DO I ASSESS RISK?

• Download from the OCEG Whitepaper Series “Critical Conversations” - CFO AT THE CENTER

3/12/2009 (c) OCEG