By Tania Narciso
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
This article explores the evolution of Governance, Risk, and Compliance (GRC) frameworks, emphasizing the importance of resilience in organizational design. It highlights four key components of resiliency: organizational purpose, culture, wellness, and connections. By integrating these elements, organizations can enhance their GRC effectiveness and better navigate challenges. Key questions for aligning risk management and compliance activities are also provided to guide organizations on their GRC journey.
So often organizations point to their Compliance Framework and their Risk Management program and their governance structure as evidence of an effective Governance, Risk and Compliance (GRC) framework. There is an assumption that the component parts add up to a whole, when really, the initial purpose of a GRC framework was to bring together these respective disciplines in some organized way. The evolution of GRC from the inception of the term to present day practice, goes even further, beyond bringing together the respective functional areas, to being intentional and coordinated, which is sometimes referred to as integrated risk management. The intentional and coordinated integration across functions and verticals is what drives the value of GRC activities, but is also what challenges organizations, big and small. Going back to basics and starting with the “why” GRC came to be, may help us better understand the potential challenges, and help us design strategies for success. So, what is the “why”? Resiliency; an effective GRC should be designed to enhance the organization’s ability to withstand or recover quickly from difficulties and adapt to change.
Resiliency is the aggregate of: i. an organization’s purpose and objectives; ii. organizational culture; iii. wellness or baseline health; and iv. connections. Building a GRC framework for resilience requires that the organization’s business purpose and objectives are well understood, and that each functional area has applied those objectives against their specific activities to assess whether their processes are aligned to purpose and objectives. Understanding business objectives also help with the identification and alignment of risks that an organization faces or may face. Having a common understanding of the risks an organization faces, and a common understanding of where the organization wants to go, helps keep the ship sailing in the right direction even through turbulent waters and ambiguity.
Organizational culture is a key component of resiliency and key driver of an effective GRC framework. We can learn a lot about organizational culture but observing how knowledge flows within a business unit and across business units and functional areas. Also, observing how decisions are made in an organization, particularly knowledge and decisions with respect to key risks, controls, and issues, can tell us where mind and management lie within the organization, and how that shapes culture. For example, a forum for discussing risk and compliance matters that bring together cross functional subject matter experts with deep business knowledge is a good example of a culture that takes steps to actively remove knowledge gaps and bias from decision making. Other things like organizational structure, and resources available to respond to changing environments, and how change management and new initiatives are managed, can tell us whether an organization is willing to learn and adapt, and to what extent they encourage risk taking.
A third component of resiliency is organizational wellness. General organizational health is important for cross-functional integration of risk management activities, and an effective GRC. Things such as financial pressures, technology or data issues, or poor employee engagement may be indicators of poor baseline health which should be addressed before or at least in tangent with integration efforts. Poor health may be observed in general across an organization or within specific business units and may be identified through independent monitoring and testing and oversight activities. Having unstable variables or weakness in critical areas make planning and implementation of any integrated risk management more difficult since dependencies and critical paths may change more frequently.
Connection is a fourth and critical element of resiliency. Connection emphasizes collaboration, equality, and transparency. These elements create shared meaning and drive accountability across the organization. Connection can be embedded in policies and mandates, but more importantly, is evidenced through information sharing and decisioning processes and discussions. Things like shared tools and systems for flowing information across an organization, and decision making flows or processes can illustrate how and where connections are made.
Ultimately, designing and implementing an effective GRC means designing for organizational resiliency and requires the integration of risk and compliance activities within and across functional areas. We discussed four critical components of resiliency and how they can be incorporated in a GRC framework by design. To that end, I leave you with a set of questions to ponder on your GRC journey: Is there cross functional alignment on purpose and risks? Is there readiness for coordination and integration across functions or are there some weaker links that need to be brought up to an acceptable standard or baseline? Are structures and systems set up for optimal information sharing and unbiased decision making? And lastly, does the organization operate in a connected manner, collaboratively and transparently?