Opening the Door to Better GRC
Governance, risk and compliance efforts can benefit
when CIOs apply waste-reducing, efficiency-promoting practices.
By
Leon Erlanger
The evolution of corporate governance, risk management and
compliance (GRC) may enable organizations to adopt a more
streamlined, or Lean, approach. Organizations that apply Lean
strategies to GRC processes find they can make those processes
faster, more effective and more cost-efficient. In this way, organizations
can reduce redundancy and poor alignment from their
organization's compliance and governance processes. This lets them
manage risk more effectively and reduce the number of resources
needed to develop and maintain the GRC solution.
This approach is called LeanGRC™ by the Open Compliance
and Ethics Group (OCEG), a nonprofit organization that helps
companies enhance their GRC efforts. LeanGRC isn't only about
greater efficiency, the organization says. Integration also plays a
vital role in helping corporate departments share preferred practices.
"One department might be strong in policy development and
distribution," says Scott Mitchell, Chairman and CEO of OCEG,
"while another is strong in detection and controls."
LeanGRC efforts are still in their early stages, as many companies
have instead tackled individual regulations and compliance activities
as they come along. While this is a valid approach to complying
quickly with international, governmental and industry regulations,
it can result in a great deal of overlap and repetitive processes. That's
because each team typically applies a unique set of methodologies,
controls, tests and technologies to various regulations.
"In many companies, you have silos of compliance activities with
very little communication or sharing of information," says Robert
Hansen, a Principal in the Audit and Enterprise Risk Services
Practice at Deloitte & Touche LLP (Deloitte & Touche). "So if a
company has five major compliance programs, chances are it also
has five unique evaluation and reporting processes. In many cases,
these programs are asking the same individuals in the organization
to provide the same information and perform the same tests
multiple times."