In today’s unpredictable and highly competitive business environment, it’s important to take a holistic view of governance, risk and compliance (GRC) — while focusing not only on the risks that can threaten value, but also the risks that an enterprise can take to create value. To do this, leaders should consider embedding a thoughtful awareness of risk and compliance into the very fabric of the organization. People, processes and technology should all work together to help the enterprise stay in control of the risks it chooses to take. Therefore, executives should also consider the following in all decision making processes: strategic risk, financial risk, cyber security threats, changing regulatory environment and evolving governance landscapes.
Governance, Risk and Compliance typically encompasses activities such as corporate governance, enterprise risk management (ERM) and corporate compliance with applicable laws and regulations.
- Governance describes the overall management approach through which senior executives direct and control the entire organization, using a combination of management information and hierarchical management control structures. Governance activities ensure that critical management information reaching the executive team is sufficiently complete, accurate and timely to enable appropriate management decision making, and provide the control mechanisms to ensure that strategies, directions and instructions from management are carried out systematically and effectively.
- Risk management is the set of processes through which management identifies, analyzes, and, where necessary, responds appropriately to risks that might adversely affect realization of the organization's business objectives. The response to risks typically depends on their perceived gravity, and involves controlling, avoiding, accepting or transferring them to a third party. Whereas organizations routinely manage a wide range of risks (e.g. technological risks, commercial/financial risks, information security risks etc.), external legal and regulatory compliance risks are arguably the key issue in GRC.
- Compliance means conforming with stated requirements. At an organizational level, it is achieved through management processes which identify the applicable requirements (defined for example in laws, regulations, contracts, strategies and policies), assess the state of compliance, assess the risks and potential costs of non-compliance against the projected expenses to achieve compliance, and hence prioritize, fund and initiate any corrective actions deemed necessary.