By Monique Batterham
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
Take a look the challenges of fragmented reporting systems in organizations and advocates for a Single Source of Truth (SSoT) in Governance, Risk, and Compliance (GRC). This outlines the benefits of centralizing data for improved accuracy, decision-making, and efficiency, while addressing operational considerations like design and access control to enhance GRC effectiveness.
Current Reporting
Reporting within many organisations is split into a vast array of channels. Risk Events may be reported within a separate system, Compliance events, such as breaches and incidents, complaints, conflicts of interest, data breaches, employee misconduct/HR reporting, related party transactions etc, may be reported into a separate compliance system but each linked to a separate policy or procedure and then captured separately.
Looking at it from the business perspective, when an event occurs they need to potentially read one or more policies to decide what type of event has occurred and whom and where it needs to be reported.
The risks here are:
- The business makes an incorrect classification
- The event potentially meets various thresholds and requires multiple reporting, which either does not occur or if it does occur, creates duplication and version control issues.
GRC Systems
As the Chief Risk and Compliance Officer who inherited a hotchpotch of systems and registers, I was looking to create scalability, flexibility, robustness and efficiencies. I wanted a system that we could enter our data into just once and from that centralized database create the outputs we needed, i.e. Committee and Board reporting, regulatory reporting, trend analysis, risk metrics, etc. I went to market looking at the GRC systems available and was frustrated at the offerings. Many positioned themselves as either a compliance solution or a risk solution. One GRC system provider even told me they don’t have a breach reporting module as they were a compliance system provider and breach reporting was a functionality solely for risk systems.
Single Source of Truth
A single source of truth (SSoT) provides an authoritative, trusted, centralized, comprehensive, and easily accessible data repository.
Maintaining a SSoT is something universally recommended across the business, yet something that GRC departments and GRC systems have not yet identified as a priority.
A better solution would be to look at this more simplistically. A “Risk Event” should be entered and updated once by the business owner into a central register. From there, stakeholders should be able to access that information for their own purposes.
Benefits
- Consistency and accuracy: apart from the initial capture of the risk event, these are then managed over time. Where the business is the key contact, they need to provide ongoing updates on the status. Having a SSoT means every stakeholder has access to the same information creating consistency and accuracy.
- Improved decision making: If data is so powerful in our roles to help quickly detect trends and hopefully prevent an extreme risk event from occurring, then it only makes sense that we should be capturing all relevant data.
- Increased efficiency and Productivity: there are numerous efficiency and productivity gains, both on the input side and in producing reporting. With data readily available in one location, less time is spent searching for information across multiple systems, saving time and boosting productivity.
- Streamlined processes: This also makes it so simple for the business. Currently, the business needs to read multiple policies and procedures to try to understand what needs to be reported, to whom and where. With a centralized database the business can be confident knowing everything is reported in this one spot. SIMPLE! Everyone is a winner. Making it simple to report means the business will be more inclined to report which benefits the business as well as GRC teams who are constantly battling to encourage the business to report.
- Scalability and Flexibility: As organizations grow or evolve, having a centralized source of truth allows for more effortless scalability and adaptability. New processes, systems, or departments can seamlessly integrate into the SSoT framework.
Operational Considerations
- Design considerations: In a perfect world the central register should be akin to a smart form, whereby dependent on the responses, more fields or questions are then required. For instance, the risk event may relate to a complaint, which then requires you provide specific information.
- Access control: it does make sense that not everyone can access all information. There needs to be careful consideration around access controls both when entering, updating and accessing information.
- Risk event classifications: The risk event is entered into the system by the business and the relevant GRC professional who is the subject matter expert can review and make the necessary determinations as to how it should be classified and reported.
Conclusion
Given we are operating in the data age, it is time we consider how as GRC professionals we can better move into the data age to maximise the value we can generate. Having a SSoT is one clear way we can do this. To thrive in this new age, every organization needs a complete view of its data — real-time insight, with the ability to take real-time action.