Integrity-Driven Performance. New Strategy for ... - GRC Resource

Successful GRC Process IntegrationGRC integration implies a consistency in actions taken by management and employees in thecourse of business. Signs of integration with business processes include:• GRC is practised and reflected in an organisation’s control environment. GRC is a process,effected by an entity’s board of directors, management and other personnel, applied instrategy-setting and across the enterprise, and designed to identify potential events thatmay affect the entity, manage risks to be within its risk appetite and provide reasonableassurance regarding the achievement of entity objectives. 11 In environments where GRC isfully implemented, processes are in place to provide timely information to managementand the board of directors on business opportunities and the most significant risks, as wellas how these risks are being managed. Most importantly, employees understand their GRCroles and responsibilities and are exercising due diligence in managing risk effectively.• Real-time monitoring at appropriate levels, reporting and incident management capabilitiesare in place and operating effectively. Key elements of an effective programme exist,including monitoring mechanisms, multiple avenues for confidential reporting to the boardas well as senior management and GRC functions, escalation protocols, investigativeprocesses and disciplinary procedures. Information flow is accurate and timely, and facilitatesstrategic decision making. Responsibilities and expectations for monitoring and reporting areintegrated into policies and procedures. Ownership and accountability are designed intoprocesses, which also support ongoing performance measurement. All process designincludes the creation or modification of related policies and procedures.• Policies map the course of action and explain what needs to be done. Policies andprocedures set a framework within which employees can operate effectively to meet theexpectations of internal and external stakeholders by defining how the organisation is to goabout its business. Policies are the translation of business strategy into day-to-day operations,and are therefore derived from the organisation’s mission, strategies and critical successfactors. They are made legitimate through formulation and measurement of specific metrics.Compliance policies are defined to address specific regulatory requirements, as well asother desired behaviours and activities, including code of conduct and best practices. Whenseen from this perspective, compliance with policies and procedures is absolutely critical.Accordingly, a clear set of measurements and metrics needs to be developed, reported andmanaged. In an effective GRC operating model, compliance policies and procedures havebeen embedded into the business process such that they are part of the organisation’s coreoperating procedures.11 Enterprise Risk Management Framework (Exposure Draft), 2003, prepared by PricewaterhouseCoopers for theCommittee of Sponsoring Organizations of the Treadway Commission (COSO).24