Integrity-Driven Performance. New Strategy for ... - GRC Resource

Accordingly, the model begins with an Envision activity. Grounded in the overall enterprise’sstrategy and risk management approach, Envision drives an understanding of the GRC requirements,objectives and existing capabilities, as well as development of a practical plan that can beimplemented in a well-controlled manner. Strategic assessments are essential to setting GRCobjectives. These activities help an organisation understand its GRC priorities and requirements.Current GRC environment and capabilities are evaluated in the context of GRC priorities to seewhere there may be gaps and to identify key action items to align capabilities with direction.Costs are evaluated to understand the value derived from current investments and to providecontext to additional investments that may be advantageous.Bringing the GRC vision of the enterprise to life in the organisation requires a strategic roadmap,prioritisation and targeted investments. These are expressed in the organisation’s strategic GRC planand include key GRC fundamentals such as roles and responsibilities, information flow, code ofconduct, risk approach and risk management methodology, compliance risk assessment andappetite, and so on. All of this activity is performed with a view toward stakeholder expectations,indicating alignment with the model’s starting point – the overall business vision and strategy.Key Questions to Understand GRC Priorities and Requirements:• What are our key business objectives, and how can we best ensure they are met?• Given our vision and objectives, what constitutes our risk appetite and risk tolerances? Forexample, how much earnings volatility are we willing to accept in pursuit of higher-risk, butpotentially higher-reward activities?• What core values will guide our decision making, and how will we build and strengthena values-based culture committed to integrity and ethics?• What events could either help us achieve our objectives, and therefore need to be seized,or present risks that get in the way of achieving our objectives, and therefore need to beassessed and managed?• What risk response strategies do we need to employ in order to effectively manage riskin a dynamic environment? For example, what is our risk response strategy to globalexpansion or business recovery? Based on our business model, business objectives, andthe requirements of key stakeholders (i.e., investors, regulators, customers), what levelof performance do we require?• What organisational structure, roles and responsibilities, and policies should we have inplace to ensure that risks are being actively managed and mitigated?41