By Shilpa Konkar
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
This article explores the parallels between the Mahabharata and modern Governance, Risk, and Compliance (GRC) frameworks. It emphasizes the importance of strong governance, transparent communication, and ethical conduct in risk management. With the enactment of the Digital Personal Data Protection Act (DPDPA) in India, the need for an integrated GRC approach to data privacy and security has never been more crucial for businesses navigating today’s digital landscape.
Reciting the following very famous quote – ‘There is a child inside all of us’, which I am strongly believe and would prefer to start my writeup with small storytelling, which is more interesting, relatable and at the same time, impactful.
Let’s start with, very epic and well-known Indian saga of Mahabharata, which closely relates with the modern days Enterprise Risk management model – GRC, commonly adopted by all the organizations.
To elaborate further, strong Governance of Lord Krishna, helped Pandavas to counter and conquer throughout multiple risky situations. In business as always, it’s important to stay grounded, and realistic about risks and plan strategies.
Miscommunication or withholding of information (not disclosing with relevant stakeholders) may increase Risk. Karna’s ignorance of his parental connection and not sharing with his team as except Arjun, he won’t kill any of Pandavas’s brothers, leads to inconsistent planning and result we all know. In Business, transparent and effective communication is key to manage risk, ensure everyone is aligned and aware of potential threats and responses.
Compliance should not be an afterthought. In Mahabharata, unethical acts of Kauravas, invariably leads to downfall and disaster. In Business, unethical conduct can cause reputational risk, leads to legal and regulatory penalties and so on.
Governance, Risk and Compliance, three pillars of modern organization, rather these are important milestones everyone must achieve, abide and sustain. Organizations has to be risk aware and responsible towards strong Governance and Compliance.
Organizations to ensure effective Governance, the basic PPTs (People, Process, Technology) should be well structured, aligned with existing regulations, guidelines and standards set by Regulators, Industries. This should be regularly reviewed to ensure emerging changes are adopted and followed. Next level to achieve effective implementation, is to have strong Awareness strategy at all levels in the organization including internal and external stakeholders. In addition to this, one of the good citing of strong Governance, is to have effective reporting to all stakeholders.
Risk management, though its financial, Regulatory, technological, has to be well vetted and strongly aligned with Business strategies, and objectives. Effective risk treatment plan, strategically assessed Risk appetite and regular review of the same with change in operating environment, keeps the organization in safe zone.
Moving ahead with Compliance part, is to assess and ensure control effectiveness is a key. Regularly remediate gaps and report Compliance status with key metrics.
With Data Privacy Act, – DPDPA (Digital Personal Data Protection Act) 2023, enacted in India, strong framework as GRC is needed to manage Data Security and Privacy risks.
In today’s Digital world, businesses are collecting, processing, sharing and storing data more than ever before, which is need of an hour with the introduction of emerging technologies as AI, ML, etc., With more power, comes more responsibility and with the DPDPA enacted in India and all other existing and upcoming Privacy laws worldwide, brought new challenges to Businesses to stay compliant, while protecting privacy for customers and employees.
By effective implementation of Security, Data Privacy and GRC, businesses can have common posture and plan effectively, versus siloed approach for Risk management for Cyber Security, financial risk, data risk individually.
By incorporating data privacy in GRC, businesses can assess their data assets by having an overview of what they have, who owns certain data, where it’s located, and how it’s being used. It also highlights the potential risks associated with the data and plan accordingly.
Referring specifically DPDPA 2023, an Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.
An individual – data principal (to whom the personal data relates to) has empowered with certain rights.
Data fiduciary (who decide purpose to process the data s any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data) obligated with certain responsibilities.
There is specific mention of Digital office, means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode.
Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
Overall, to perform in compliant manner and effective sustenance, organizations must have effective GRC framework.