Integrity-Driven Performance. New Strategy for ... - GRC Resource

Other characteristics of a robust enabling technology environment include:• Risk and compliance obligations are actively assessed and managed. The process ofaddressing risk and compliance obligations and ensuring new requirements is integratedinto the existing business environment and is actively managed. As new obligations areidentified, they are assigned to appropriate personnel for assessment, planning and action.A consistent process is applied to create, approve and update policies and procedures.The linkage between obligations, policies and procedures/controls is enabled to facilitateanalysis and reporting (e.g., the ability to determine which policies and procedures helpaddress privacy obligations).• Issues and incidents arising from non-compliance are actively identified, monitored andreported. Policies and procedures are applied, and events are identified and raised foraction. Capabilities within existing systems are optimised to identify events (e.g., EnterpriseResource Planning [ERP] applications are better leveraged for improved controls and exceptionreporting capability). Integration technologies are used to bring together information fromdisparate source systems in order to identify events. Technology is used to administer andmonitor risk control self-assessments and other surveys.• Accountability is built into the management and reporting of events. Business processmanagement and business rules engine technologies help ensure action by creating a “closedloop” environment. Traditional reporting is an “open loop” system – providing informationbut not requiring that action be taken. A “closed loop” environment assigns ownership andaccountability to each issue and incident, ensuring that action is taken.• Better information, more quickly delivered. From process metrics to key performanceindicators, information is available to all levels of the organisation in accordance withpre-defined information flows. Business intelligence technologies are leveraged to allowfor visualisation and analysis.33