How governance surpasses compliance and risk management in the GRC program

Governance, compliance, and risk management are the three sections of a GRC program. Governance refers to forming and implementing information technology (IT) policies and procedures. risk management is defined as the process of identifying, defying, and responding to the cyber threats the organization faces. And last but not least, compliance is adherence to standards and frameworks applicable to the organization.

Every person has their own idea about which component among the three is pivotal in the organization. It is not uncommon among people in compliance to debate the importance of one over the other. Some consider risk management the most important factor because the organization must protect itself from security threats. While others regard compliance as an imperative factor, as non-compliance can lead to severe penalties and fines, even operational loss. 

However, governance is mostly underestimated. And in our view, without governance, all other cybersecurity efforts are futile. Don’t believe us? Read on for the reasons we think governance grabs the trophy for being the most critical part of the GRC triad among governance, compliance, and risk management. 

The dark side of governance neglect: consequences for organizations

Governance of IT assets is not just investing in them but using their every feature and making them beneficial for the organization. Many organizations make the mistake of investing in an asset, like a governance, risk management, and compliance software, and then forgetting all about the same or using the assets minimally. This creates a disconnect between the investment and benefits, thus reducing the return on investment (ROI).

On the other hand, sometimes organizations don’t follow the policies and procedures devised for securing themselves against cyber attacks. The policies and procedures are only on paper and not communicated properly to the employees. This might make the organization vulnerable to attackers and leaves the aftertaste of fines and penalties for the management. 

Whether it’s underutilization of assets or implementation of policies and procedures, all fall under governance. In fact, governance plays a much wider role than just these acts. What if there is a gap in governance in an organization? Let’s look at some of these challenges and the consequences of not having adequate governance in an organization in detail.

1. Hard to get a bigger picture

Every organization has defined business goals and IT goals that are used as a base to plan its day-to-day activities. These goals should be aligned with each other to ensure that they work in harmony. Without proper governance, the goals would be haywire. It would be difficult for the organization to progress in such a scenario.

Additionally, governance provides a framework for implementing and evaluating the progress made toward achieving the goals formed. Identifying the gaps in the systems becomes easier with robust governance policies. The organization can formulate improvement procedures after conducting the gap analysis.

For example, a financial services company wants to conduct a risk assessment to identify potential risks to its operations. The company has identified various areas of its business that could be impacted by risks, such as financial risks, operational risks, and cybersecurity risks.

The company conducts a risk assessment by evaluating the likelihood and potential impact of each identified risk. For example, the company determines that a cyber attack on its systems could have a high impact on its operations and a high likelihood of occurring.

Based on the risk assessment, the company develops policies and procedures to manage the identified risks. For example, the company implements a cybersecurity program to protect its systems from cyber attacks, which includes measures such as regular software updates, firewalls, and employee training on cybersecurity best practices.

The company also regularly monitors its compliance with the policies and procedures related to risk management. For example, the company conducts regular internal audits to ensure that employees are following cybersecurity protocols and identifies areas where improvements can be made.

Overall, conducting a risk assessment helps the company to identify potential risks, develop policies and procedures to manage those risks, and monitor compliance to ensure that the policies and procedures are effective in reducing the likelihood and impact of risks.

Figure: 

2. Difficulties in adherence to the three As – actionability, accountability, and achievability

The organization’s GRC program must adhere to the three As – actionability, accountability, and achievability.

• Actionability – One of the challenges that organizations face without good governance is the lack of actionability of the GRC program. The organization’s GRC policies and procedures should be communicated to the employees in plain and simple language. Complicated and long policy documents are often too much for the employees, so they avoid reading them carefully. Make the policy documents concise and to the point. This will improve readability and, thus, result in better implementation by employees. A clear, implementable plan can mitigate risks, improve compliance, and streamline the organization’s procedures.

• Accountability – Imagine an organization where the rules and regulations are laid out clearly, but there is no clear hierarchy. The employees are not held accountable if they fail to follow the GRC standards. It will be a chaotic situation where the employees carry on acting as they please. Good governance dictates the need for accountability. All the employees are aware of the rules and regulations they must follow and also of the consequences if they don’t. A clear hierarchy is defined where they are answerable to their superior for the actions they take. This, in turn, will ensure the successful implementation of GRC policies.

• Achievability – An organization sometimes overestimates its capacity to follow the GRC program, and that becomes a challenge for the successful implementation of the GRC program. For example, remaining aware of phishing emails is important, but does that mean the employees should not open emails from unknown sources? That would not be a practical solution. Therefore, there should be a balance between goals and realistic goals.

3. A gap in strong leadership

Many organizations have gaps in leadership, leading to partial or complete failure of the GRC program. In such organizations, it is crucial that the management identifies the gaps in leadership and address them for the successful implementation of GRC.

Robust governance is one section that can fill the gaps in leadership. Governance refers to the policies and procedures through which decisions are made. Governance clearly defines the guidelines to be followed in the decision-making process to help the leadership eradicate any predicament faced by the organization. The employees know exactly what is expected of them.

Secondly, good governance defines the roles and responsibilities of the employees along with the hierarchy, reducing the power struggles or confusion among the ranks. It enhances the accountability of the employees to reduce unethical behavior even in the absence of strong leadership.

To achieve this goal, the organization can introduce automated training for employees about the GRC process. This training can educate the employees about the best practices of GRC management, the GRC goals of the organization, and the consequences of failure to follow GRC policies. 

Finally, good governance promotes inclusion in the organization’s decision-making processes. It ensures that all hands are on deck during decision-making, which makes the decision well-rounded and rich. The relevant employees get a seat at the right table with good governance. An organization can share all the information in real-time via the GRC software. No more emailing the reports to colleagues. It is all available on the platform itself. 

Leading with compliance is dangerous to the organization

Compliance procedures are designed to improve the cybersecurity posture of the organization. However, treating them as the leading part of the GRC program can have disastrous effects. When an organization focuses too much on compliance, its approach becomes one-dimensional. It treats the GRC program as a tick-box exercise for the regulators. The regulators focus on meeting the minimum requirements set up by the applicable standards rather than thinking proactively about cybersecurity risks.

In addition to this, the regulators might also struggle to keep up with the ever-changing regulatory requirements landscape. They might not have enough expertise and experience to keep pace with additional regulatory requirements.

Instead of leading with compliance, organizations must focus on good governance for overall improvement in the cybersecurity posture of the organization. Compliance alone does not constitute good governance. 

Compliance is a byproduct of good governance. When the organization focuses on governance, it automatically churns out policies in sync with the compliance requirements.

Leading with risk has its own pitfalls

Many organizations around the world believe in leading with risk in their GRC program. This approach has many benefits, like

• Leading with risk can help organizations align their business objectives with risk management. This ensures that the organization is focused on managing risks that are most critical to achieving its strategic goals.
• Leading with risk helps to increase risk awareness across the organization, from senior management to front-line employees, creating a culture of risk management where everyone understands their role in managing risks.
• Leading with risk enables organizations to make better-informed decisions by considering risks as a key factor.

On the contrary, when an organization leads with risk vis-a-vis governance, its approach becomes narrow and reactive. The organization is so focused on identifying and mitigating risks that it misses growth opportunities and becomes purely reactive. 

Often, a risk-focused approach leads to a compliance-centric culture. A  compliance-driven culture can stifle creativity, limit flexibility, and result in missed opportunities. As the people in the organization just focus on the tick-mark activity of compliance, it creates a negative impact on the other activities of the organization.

Rather than leading with a pre-defined plan, the risk-focused approach involves running in different directions as different risks are detected. This approach is purely reactive. And thus, it limits organizational growth.

7 ways to lead the GRC program with governance

Leading the GRC program with risk or compliance is a tricky task. Leading it with good governance can bring a holistic cybersecurity approach to the organization. Here are some of the steps to follow if you want to lead with governance.

1. Develop a clear mission statement

Your mission statement is the first step to begin leading with governance. It is based on your ideals, the regulations applicable to your organization, and the industry you are in. There can’t be a common mission statement that applies to all organizations. It is unique to every organization. 

2. Establish policies and procedures

Policies and procedures are keys to governance. They are dependent on the goals – IT and non-IT – that the organization wants to achieve. A clear, well-defined organizational policy and procedure can bridge the gaps, if any, in the organizational structure. Your policies and procedure should cover all types of scenarios ranging from detection to responding to threats. 

Review the laws and regulations applicable to the organization, and ensure that your policies and procedures are aligned with them. Define a clear scope for the implementation of the policies and procedures. After the implementation, evaluate the policies to identify any gaps. Fill in these gaps as soon as possible. 

3. Appoint a board of directors

The board of directors (BOD) is responsible for implementing the policies and procedures set up in governance policies. If the policies are not implemented properly, the BOD is accountable. 

An organization should take the following steps while appointing the BOD for GRC:

• Define the roles and responsibilities of the BOD, including its oversight and strategic direction for the GRC program.
• Determine the composition of the GRC board depending on the size, complexity, and industry of the organization.
• Appoint the members of the board as per their expertise and experience. Establish term limits and plan for succession.
• Schedule regular meetings. Define the frequency of meetings in advance.
• Establish the process of reporting the effectiveness of the GRC program to the management based on key performance indicators (KPIs).
• Have regular training sessions for the board of directors to allow them an opportunity to upgrade their knowledge.
• Assess the board and identify the areas of improvement. Update the policies to reflect changes.

4. Implement internal controls

Internal controls are the crux of governance in the GRC program. An organization should identify the risks that the GRC program is expected to manage. It should develop and implement a control framework depending on the industry standards but tailored to fit its own needs. Every individual should be assigned specific roles in the control framework with appropriate accountability. This control framework should be targeted at eliminating the identified and expected risks.

The organization should regularly monitor the control framework for effectiveness by monitoring compliance violations, control failures, and reviewing performance metrics. A specific pre-defined process for escalating control failures and compliance violations should exist. 

Don’t forget to identify new risks and add them to the control risks. Refine the controls to accommodate the newly identified risks.

5. Communicate transparently

While communicating with the stakeholders about your GRC program, be clear and concise. Remember, simplicity is key here. An overly complicated program and policy documents can throw off the employees’ interest. Jargon and technical terms should be avoided to maintain the understanding of the stakeholders.

Provide the context about GRC and alert the employees about the consequences of failing to follow the GRC program. Encourage transparency about the risks and threats the organization faces and how it plans to address them. This will help you develop trust with all your employees. 

6. Foster a culture of accountability

Once you have formed, communicated, and implemented the internal controls, foster a culture of accountability to ensure proper implementation. Penalize the employees who are negligent in following the GRC program. This will increase the dedication towards the program.

On the other hand, encourage employees to report any issues they find to their supervisor. Create a safe environment where the employees can safely report their concerns. 

7. Monitor and evaluate the performance

The last step is to monitor and evaluate the performance of the GRC program. Once improvement opportunities are identified and prioritized, organizations should monitor and report their progress in implementing them. This could be done through regular status updates, performance reports, or GRC meetings, where stakeholders can discuss the progress, issues, and lessons learned from the GRC program. Monitoring and reporting the progress of a GRC program helps to ensure accountability, transparency, and continuous improvement.

Conclusion

Every person has their own idea of which component of the GRC trio is the most important one. According to us, governance is the most crucial factor of GRC management, and after reading the article, you will see why. Without governance, an organization faces challenges in getting a bigger picture, adhering to the three As of GRC (actionable, accountable, and achievable), and having strong leadership. 

Leading with compliance can make the organization follow a tick-box approach, and leading with risks can make the organization react rather than act. However, leading the GRC program with governance can balance out any errors in the other two components. It can streamline the process of cybersecurity for the organization.

FAQs