A proactive, risk-based approach to IT governance, risk management and compliance (GRC) lets a company control compliance costs and automate more of the work. GRC has long mattered to public companies and regulated industries. Over the past decade it became urgent, as executives had to answer to Sarbanes-Oxley, Basel I and II and HIPAA, and to shareholders and the public demanding stronger internal controls.
Corporate scandals early in the decade erased billions of dollars in shareholder value and made the point plainly: governance and compliance belong in the core of how a public company runs, alongside product development and sales. GRC is becoming a business discipline of its own, though people still disagree about what it covers and whether it should be managed at the enterprise level.
What is GRC?
Michael Rasmussen of Corporate Integrity, LLC defines GRC this way:
- Governance is the culture, policies, processes, laws, and institutions that define the structure by which companies are directed and managed.
- Risk management is the coordinated activities to direct and control an organization to realize opportunities while managing negative events.
- Compliance is the act of adhering to, and demonstrating adherence to, external laws and regulations as well as corporate policies and procedures.[1]
Definitions vary, but most people who study GRC agree that it runs on process and IT. Its success depends on whether IT has its own GRC processes in order, and on how well IT helps other departments manage theirs and roll them up into one enterprise view.
GRC touches marketing, operations, suppliers and partners, but financial GRC and IT GRC make up most of the work.[2] Those two areas carry most of the legal and regulatory requirements for handling and protecting data. IT GRC also affects how efficiently IT supports the rest of the business.
For IT, this cuts both ways. It raises IT’s profile. It also adds to a full workload: IT is already asked to deliver more services, faster, on tight budgets, and new services often bring more approvals, more complex processes and more regulation. The complexity of IT GRC can drive up the cost of IT just when budgets are constrained.
What is IT GRC?
IT has its own GRC requirements, plus the job of supporting GRC across business units. A simple definition of IT GRC:
- Using IT to manage an organization’s governance, risk management and compliance processes.
- Making sure governance, risk management and compliance are carried out correctly for every system and IT process that supports the business.
- Managing IT GRC as one coordinated program, so processes are efficient, visible and accountable.
In practice it is rarely simple. IT departments run distributed networks and answer to several sets of regulations and many internal and external audits.[3] A large organization can face audit requests from 20 or more internal and external bodies and have 500 to 800 general IT control requirements. Partners and customers may add their own conditions, such as ITIL, COBIT or ISO 27001/27002, and many enterprises must also check that their suppliers meet those standards.
Because GRC is a relatively new focus, many enterprises still lack a formal, automated way to track IT GRC controls. That is the piece they need most. Paul Proctor, vice president of security and risk management at Gartner, put it this way:[4] “People are doing IT GRC, whether they are calling it that or not, but they are often document-centric solutions, using spreadsheets and other documents in some kind of shared repository.”
Rasmussen is blunter: “Spreadsheets are a recipe for disaster. Eventually, they outgrow this; they don’t have proper audit trails and it becomes unmanageable.”[5]
Analysts and risk specialists agree on the need for a formal, automated approach. In IT Risks: Turning Business Threats Into Competitive Advantage, George Westerman and Richard Hunter describe the foundation it needs as “a well-structured foundation of IT assets—an installed technology base of infrastructure and application technologies, and supporting personnel and procedures—that is well understood, well managed, and no more complex than absolutely necessary.”[6]
IT compliance expert Daniel Magid lists six tools for cost-effective IT compliance. The most important, he says, is putting compliance processes into an automated system, which may mean bringing in new technology.[7]
Several products now do this. Most are expensive, and many fail Westerman and Hunter’s “no more complex than absolutely necessary” test. They often require IT to map every existing GRC process, or redesign those processes to fit the tool. If the tool doesn’t integrate natively with existing IT management and security systems, automating the assessment and remediation of technical controls can take extensive custom programming.
IT compliance and Kinetic Request
IT has two options. It can ask management for an expensive new compliance system and absorb the implementation, testing and administration that come with it. Or it can build on the systems it already runs.
For organizations with an established IT service management (ITSM) platform, the second option is usually cheaper and faster. The ITSM platform already holds data about IT assets and processes in a secure repository. Tools that run on top of it can use that data to automate compliance workflows at lower cost, and with less administration, than a purpose-built compliance system.
Consider a large international life insurance, pension and asset management company. Its compliance applications were mostly homegrown and were struggling under Sarbanes-Oxley, Basel I and II and other new U.S. and European mandates. The underlying technology was old and hard to support. IT staff had more than 400 compliance tasks to run on daily, weekly, monthly or yearly schedules, tracked mostly in spreadsheets. As the task count grew, the process took more time and exposed the company to compliance risk it could not accept.
The company decided it needed an automated way to test processes and systems and produce evidence of computer controls for audits, which were requested by several divisions and by business partners. After reviewing its options, it chose third-party tools that worked with its existing ITSM system. That kept compliance in a stable, familiar environment and avoided the cost and learning curve of a new, purpose-built one.
The tool it chose was Kinetic Request, a request management portal that integrates natively with the company’s ITSM system and ships with Kinetic Task, a workflow engine. Together they added automated workflows and approvals for the company’s existing compliance activities on top of the ITSM system. Kinetic Request now triggers each of the more than 400 scheduled compliance tasks and the approvals attached to them.
The company reported these benefits:
- Compliance work moved into a stable, known ITSM environment with no new hardware or IT management software.
- Less time and expense to complete compliance tasks.
- Clear records of dates and approvals for reporting to different auditors.
- Lower auditing and reporting costs.
Summary
The company’s approach matches Daniel Magid’s first recommendation: put compliance processes into an automated system. Where it differs from larger compliance suites is in how it got there. It mapped existing compliance tasks to workflows and approvals in Kinetic Request and kept its existing ITSM platform as the system of record, without building or buying a new compliance environment.
Sources
- Corporate Integrity, http://www.corp-integrity.com/about/grc.html
- CA Community, http://community.ca.com/blogs/iam/archive/2009/11/17/it-grc-towards-a-common-definition.aspx
- CSO Online, “IT GRC tools: control your environment,” http://www.csoonline.com/article/674709/it-grc-tools-control-your-environment?page=1
- CSO Online, ibid.
- CSO Online, ibid.
- SearchCompliance, http://searchcompliance.techtarget.com/feature/Chapter-excerpt-The-Three-Core-Disciplines-of-IT-Risk-Management
- S-OX.com, http://www.s-ox.com/dsp_getFeaturesDetails.cfm?CID=2501#author1840