Integrity-Driven Performance. New Strategy for ... - GRC Resource

Understanding the GRC Operating ModelAt its highest level, the GRC Operating Model contemplates four key activities:• Envision• Improve• Operate• SustainEach key activity is applicable across industries, and is fundamental to the realisation of a superiorGRC capability across the enterprise.There also exists a more detailed set of capabilities that further define the model. They include:• Strategy & Assessment• Measurement & Improvement• Monitoring & Response• Reporting & AssuranceEach of the detailed capabilities can be mapped to a key activity. For example, Strategy & Assessment,is most directly related to Envision. Similarly, Monitoring & Response is most directly related toOperate. However, it is important to note that the model is not a traditional lifecycle methodology.Whereas traditional methodologies tend to flow in one direction and to call for the initiation ofone phase after the completion of another, the GRC Operating Model is more reflective ofday-to-day realities – which tell us that change does not always occur in such an orderly fashion.For example, a compliance failure can be seen as a breakdown in operations, that is, in theOperate aspect of the model. However, it could be that the “tone at the top” was not clear and/ordemonstrated throughout the organisation (a failure in Envision or Improve). It could be that theprocess or technology change was not properly rolled out or communicated (a failure in Improve).Or it could be that the failure wasn’t reported properly or on time, or that the impact of a newreporting requirement was not fully understood (a failure in Envision or Sustain). Perhaps it was acombination of some or all of these factors.For this reason, Strategy & Assessment, Measurement & Improvement, Monitoring & Response,and Reporting & Assurance are depicted in the model as actually flowing through the Envision,Operate, Improve and Sustain activities. For example, as new regulation is promulgated, theimpact of that regulation is examined from the model starting point, business strategy (becauseclearly we have seen regulation and deregulation impact business strategy), all the way throughits ultimate integration and its impact on the organisation’s people, process and technology. Webelieve that this dynamic approach is more reflective of the business environment organisationsfind themselves in today.More detail on the GRC Operating Model can be found on the following pages.39