Publications.
Understanding GRC information systems by Springer Nature LinkGRC IS): The experts view
Although Governance, Risk and Compliance (GRC) is an emerging field of study within the information systems (IS) academic community, the concept behind the acronym has to still be demystified and further investigated. The study investigates GRC systems in depth by (a) reviewing the literature on existing GRC studies, and (b) presenting a field study on views about GRC application by professional experts. The aim of this exploratory study is to understand the aspects and the nature of the GRC system following an enterprise systems approach. The result of this study is a framework of particular GRC characteristics that need to be taken into consideration when these systems are put in place. This framework includes specific areas such as: goals and objectives, purpose of the system, key stakeholders, methodology and requirements prior to implementation, critical success factors and problems/barriers. Further discussion about the issues, the concerns and the diverse views on GRC would assist in developing an agenda for the future research on the GRC field.
The GRC Concept and Frameworks
Recent studies on GRC have highlighted the lack of scientific research in integrated governance, risk and compliance (Racz et al. 2010b). While the area of GRC implementations has been an emerging one, especially within the last few years, most of the frameworks developed so far cannot give a clear view of integrated GRC and specifically the implementation of it. Furthermore, these frameworks cannot provide a roadmap for the organizations with regard to the GRC implementation process and how they can strategically benefit by aligning GRC technological infrastructure with their business objectives. A few frameworks were identified presenting models with reference to integrated GRC solution.
GRC Software Implementation
GRC software implementation typically involves complex installations that include vendor negotiation and coordination of data between the vendor’s technical team and multiple departments in the organization, including business, IT, security, compliance and auditing.
Major challenges include integrating data and other relevant information from internal departments and external organizations into useful GRC information and ensuring all GRC system users are properly trained to obtain maximum benefit from the software.
Changes in the corporate culture might be needed to accommodate the collaborative nature of the new GRC system. Periodic testing of GRC software is essential to ensure internal departments are using it properly. Like other critical systems, GRC software must be added to technology disaster recovery (DR) plans to ensure it remains operational in a disruptive event.
The following tips can help organizations deploy GRC:
- Set clear goals. Organizations must establish specific business objectives and try to pinpoint what they hope to achieve with the GRC efforts.
- Identify operational gaps. Businesses should review data quality, analyze the maturity of each process and identify any operational gaps by doing a gap analysis after acquiring the relevant data on existing GRC practices.
- Get the team on board. To cultivate acceptance of the GRC program, businesses should align themselves with the GRC plan and budget, thereby establishing a top-down focus for the program.
- Test the GRC framework. Before organization-wide adoption, the organization should conduct small-scale testing on a particular business unit or process. This makes it easier to determine whether the selected GRC framework is in line with the objectives and, if not, to make the necessary adjustments.
- Define clear roles and responsibilities. In the realm of GRC, success hinges on a collaborative team approach. Senior executives set important policies, but legal, financial and IT teams also share responsibility for the success of GRC. Individual duties should be clearly defined to promote accountability and speed up the reporting and resolution of GRC issues.
