Integrity-Driven Performance. New Strategy for ... - GRC Resource

More documents

Recommendations

Info

Cost ManagementThe term “Total Cost of Compliance” refers to all costs incurred by an organisation to be incompliance with external and internal rules, regulations and standards, including costs to respondto and remediate compliance failures. It is composed of three cost groups:• Cost of Maintenance – representing investments made to perform and promote compliancethroughout the organisation. These costs include both direct and indirect costs, (i.e., thosebudgeted as compliance costs, such as staff costs for compliance officers, as well as costsembedded in other budgets but allocated to the function of compliance). These costs includethe indirect staff and administrative costs associated with the percentage of employee timespent on compliance versus business productivity – one of the largest cost-of-compliancebuckets and an area where gaining efficiency represents an untapped source of value.• Cost of Non-Compliance – costs incurred by an organisation as a result of not being compliantwith external rules and regulations or internal standards and policies. These costs aregenerally reactive in nature and are often more difficult to manage after a failure hasoccurred. Depending on the nature of the non-compliance issue, these costs can befinancially and reputationally devastating. Additionally, Cost of Maintenance can turn intoCost of Non-Compliance if the maintenance activity is deemed ineffective by regulators.Consider, for example, the cost of regulatory examinations in financial services organisations.The routine examinations themselves, which would normally be included in the Cost ofMaintenance, can be significant on their own. If the examinations find deficiencies, however,the associated remediation that is required becomes a Cost of Non-Compliance andcan be several multiples of the cost of the initial maintenance activity.• Cost of Governance – representing investments made by the organisation to direct themanagement oversight of the business. For example, these may include board maintenance,legal and related costs, investor relations and other communication costs.Value is ultimately derived through the proper management of the Cost of Maintenance and Costof Governance. These costs represent the investment of the organisation, and have significantimpact on the control and reduction of the Cost of Non-Compliance. 13Performance ManagementPerformance management influences organisational behaviour through the establishment ofperformance targets, and through consistent management against those targets. This is particularlyimportant for GRC initiatives, as it helps drive responsibility and accountability into every part ofthe organisation. Organisations can use performance measurement systems for translating broadstrategies and vision into tactical objectives for which key performance indicators (KPIs) can beestablished. Stretch targets can be set for these KPIs, cascading down the organisation throughGRC scorecards or through the embedding of GRC measures into existing operational scorecards.Figure III-4 shows an example of such a scorecard.2813 PricewaterhouseCoopers considers cost a critical programme component and has developed a value managementapproach and a proprietary Compliance Value tool that can help organisations identify, assess and managegovernance and compliance costs.
Figure III-4: A Sample GRC ScorecardPERFORMANCE MEASUREMENTORGANISATION, PEOPLE& CULTUREPROCESSES“Is the organisation ready?”“Are we doing the right things,and doing things right?”Measures the level of organisationalawareness and readinessMeasures the effectiveness ofinternal GRC processesSTAKEHOLDERSVALUE“Are we meeting stakeholders’expectations?”“How are we delivering value tothe organisation?”Measures how stakeholdersview the organisation’sGRC effortsMeasures the efficiency andbusiness value of the GRCprogrammesPerformance must be measured in order to evaluate the results of GRC initiatives. Organisationsshould be able to respond to questions regarding the effectiveness of their compliance efforts andhow these are contributing to the overall business value – just as they would for any other criticalaspect of performance.To better link compliance process effectiveness, quality assurance and value performance, manyorganisations are moving to quantitative process improvement techniques to maximise theeffectiveness, efficiency and value performance of key GRC processes.Achieving Effectiveness by Leveraging TechnologyHistorically, businesses have not made GRC technology investments a high priority relative to othertechnology objectives. However, in the current business environment, where access to real-timeinformation can be critical in nature and the burden of regulatory compliance continues to trendupward at an accelerated pace, technology must be viewed as a key enabler for addressing therising demands of stakeholders. Ultimately, we view technology as an essential component forsuccess in applying an integrity-driven performance approach.29
Page 6 and 7: Governance Reforms: A Snapshot of R
Page 8 and 9: Through our research and client wor
Page 10 and 11: An integrated approach to GRC prope
Page 12 and 13: As shown in Figure II-2, a new visi
Page 14 and 15: In our view, a leading GRC capabili
Page 16 and 17: Integrating GRC into Core Business
Page 18 and 19: Interestingly, many of the technolo
Page 20 and 21: PricewaterhouseCoopers developed th
Page 22 and 23: • The organisation deploys proces
Page 24 and 25: Governance ProcessesIn order to exe
Page 26 and 27: Successful GRC Process IntegrationG
Page 28 and 29: GRC performance enables greater bus
Page 32 and 33: Organisations face an abundance of
Page 34 and 35: The Emerging Role of Technology: En
Page 36 and 37: Interestingly, in many organisation
Page 38 and 39: IV. The Governance, Risk & Complian
Page 40 and 41: The GRC Operating Model is both sca
Page 42 and 43: Envision Performance Driven by Inte
Page 44 and 45: Improve and Measure SuccessDevelop,
Page 46 and 47: The GRC Operating Model promotes op
Page 48 and 49: Implementing a sustainable reportin
Page 50 and 51: Appendix: Governance, Risk and Comp
Page 52: www.pwc.com/governance© 2004 Price

Integrity-Driven Performance. New Strategy for ... - GRC Resource

Create successful ePaper yourself

Delete template?

Save as template?