Integrity-Driven Performance. New Strategy for ... - GRC Resource

V. Conclusion: A Time to ChangeAt the outset of this paper, we suggested that business is at the edge of a dramatic shift in the waycorporate governance, business ethics, risk management and compliance are viewed – a shift from acost-absorbing function to a value-adding fundamental that is part of an organisation’s DNA.Later, we examined how boards and management are dealing with this new environment and thechanging expectations that boards, investors, regulators and other key stakeholders have of theorganisation.In our view, a multi-faceted approach to this business challenge is required. It includes:• Governance built on principles of ethics, independence, transparency, integrity andaccountability.• Enterprise risk management mechanisms to identify, assess and mitigate risk while seizingbusiness opportunity.• An integrated approach to GRC management that views ethics and compliance as criticalbusiness risks and safeguards of reputation – “compliance as an outcome, not as a function”.• A new definition of compliance, encompassing internal as well as external compliancerequirements rather than external requirements only.• A GRC operating model that shows a roadmap to an exemplary GRC capability.Beyond describing such a GRC capability, the PricewaterhouseCoopers GRC Operating Modeldoes the following:• Begins with overall business objectives as the starting point for an effective enterprise,business unit or topical (e.g., privacy) GRC programme.• Describes a path to excellence by considering and optimising people, processes andtechnology throughout GRC activities.• Recognises that many of the building blocks for GRC exist in-house today and canbe better leveraged, but also acknowledges that where change is required it must beapproached in a disciplined manner using proven change and programme managementtechniques and methods.• Shows the importance of requiring that GRC performance be measured and monitored –including gaining an understanding of the total cost of GRC, so that capital can be allocatedto its best possible use.We have seen how the marketplace views GRC integration as a value-creating proposition. Butwe also know that the traditional approach to GRC presents a significant gap or barrier to realisingthat value. We believe that this barrier can be crossed, and that by applying the concepts discussedwithin this white paper, organisations can better realise their value potential through their ownjourney toward achieving integrity-driven performance.47