Enterprise GRC in Asia-Pacific: Trends, Challenges, and Opportunities

Introduction

With Asia-Pacific’s (APAC) economic growth surpassing expectations, businesses have much to be optimistic about. However, as regulations and risks in the region grow more numerous, the need for effective governance, risk, and compliance (GRC) has never been more pressing. APAC GRC professionals are being called upon to spot emerging risks, connect the dots, and help their organizations adapt swiftly to regulatory changes. GRC solutions that can help meet these demands at scale and speed will make all the difference.

I recently had the chance to host GRC Design Workshops in Malaysia and the Philippines in association with our strategic partners - HCLTech and Expleo respectively. The workshops, led by Michael Rasmussen, GRC Analyst & Pundit, GRC 20/20 Research, delved into a range of GRC areas, including the evolving risk and regulatory landscape in APAC, GRC challenges faced by organizations in the region, how technology and automation can help, and more.

Here are some of the key takeaways from the workshops, providing insights into the trends and opportunities likely to be encountered by GRC professionals as they gear up for the road ahead.

1. Constantly Changing Regulations

Keeping pace with regulatory change is no small feat. In the past three years alone, Singapore, Hong Kong, and Australia have either revised or issued new standards and guidelines around operational risk management and resilience.

Meanwhile, India enacted its first comprehensive data protection law in 2023 – the Digital Personal Data Protection (DPDP) Act, even as Japan substantially amended its own Act on the Protection of Personal Information (APPI), a year earlier.

Climate change too has been enveloped in a flurry of regulatory activity. Vietnam’s Law on Environmental Protection took effect in 2022, followed by Malaysia’s Energy Efficiency and Conservation Act in 2023.

2. Risks Galore

In addition to juggling regulations, APAC GRC professionals also have to navigate a growing variety of risks – including the Ukraine and Middle East conflicts that have strained global supply chains; extreme weather events like the floods in China and drought in India; the risks of deep fakes and misinformation associated with AI; and of course, the constant threat of a cyberattack. Incidentally, APAC experienced the highest year-on-year surge in weekly cyberattacks during Q1 2023, with an average of 1,835 attacks per organization.

Risks come from within the organization too – from changes to business objectives, structures, processes, employees, and technologies, as well as from the extended enterprise of suppliers, vendors, contractors, dealers, and distributors.

Getting these risks under control is key to strengthening organizational resilience and performance.

3. Connecting the Dots

If there’s anything we’ve learned over the past few years, it’s that everything is connected. A data breach in a third-party service provider’s system can disrupt entire supply chains, damage business reputations, trigger hefty regulatory penalties, and sometimes even shut down operations for days.

That’s why it’s so important to be able to see the big picture – to understand how risks impact and influence each other, how they affect compliance, and how they hinder or help the achievement of business objectives. 

GRC offers that perspective. It enables organizations to understand the road ahead more clearly, make better-informed decisions, and capitalize on the right opportunities at the right time. In other words, GRC shouldn’t be seen as an afterthought, but an enabler of the business.

Challenges and Roadblocks

APAC GRC professionals tell us that these are some of the GRC challenges they face:

• Data silos: Risk and compliance data is scattered across disparate systems and business functions. So, organizations don’t have a clear view of their GRC universe.
• Inefficient processes: GRC data is manually managed through spreadsheets, emails, and other cumbersome tools that slow down risk efforts and limit efficiency.
• Lack of forward-looking risk visibility: When an organization’s sights are only fixed on the rear-view mirror, they aren’t able to anticipate emerging risks. Issues are managed reactively rather than proactively.
• Limited agility: With manual and siloed GRC processes, organizations can’t adapt quickly to regulatory and business changes. Nor can they coordinate and integrate GRC across business functions.
• Forgetting the G in GRC: Many organizations forget that GRC begins with governance – i.e., the achievement of objectives. Whether it’s an enterprise objective or a process objective, that’s what risks and compliance should be measured against.

The GRC Playbook: Six Winning Practices

Here are six ways to overcome the above challenges, and create a truly world-class GRC program:

• Automate wherever possible: Toss out those spreadsheets, and unlock new efficiencies by streamlining and automating your GRC processes. With automation, you can monitor risk exposure and compliance status in real time, and respond more proactively when issues Also, automating routine GRC tasks frees up more time for your teams to focus on value adding and strategic activities like risk analysis.
• Build a single source of GRC truth: Break down silos, and unify all your GRC data in a single system of record. Enrich that data by integrating information from other systems like ERP platforms, social media, transaction systems, threat and vulnerability scanners, and regulatory content feeds. The idea is to have complete horizontal and vertical GRC visibility across your enterprise through one platform. This can help you make better-informed decisions that optimize risk-reward trade-offs.
• Understand risk interconnectedness: Map your GRC data in such a way that users understand the relationships between various risks, regulations, policies, controls, third parties, ESG (environmental, social, and governance) elements, strategic objectives, audits, incidents, and cases. Having a connected view of GRC will help you target your risk management efforts and resources in the right place, in the right way, at the right time.
• Foster risk awareness across teams: Bring together your risk managers, compliance professionals, and auditors on one platform where they can seamlessly collaborate and exchange GRC insights. Empower your front line with simple, intuitive GRC tools to capture issues and risks as they arise.
• Enable continuous control monitoring and regulatory horizon scanning: Chances are that you can’t manually monitor all your controls and regulatory changes all the time – even though you need to. So, choose a continuous control monitoring (CCM) tool that can automate the process. Go from periodic, sample-based testing models to always-on monitoring of full control populations. Couple that with regulatory change management software that can automatically capture alerts on proposed and anticipated legislation, as well as regulatory updates. So, you can adapt your compliance program faster.
• Use AI for richer insights: AI-powered analytics can unlock the full potential of your GRC and transactional data by connecting with multiple data sources, and drawing out insights faster. Use it to enable predictive and data-driven decision-making. You can even train AI models to identify risk and control deficiencies, patterns of over-testing and under-testing, and duplicate risks and controls that can be removed.

Transform your GRC program with MetricStream

MetricStream ConnectedGRC helps you build an automated, truly integrated, and collaborative approach to GRC. Reduce risk exposure with streamlined assessments and mitigation. Enable consistent compliance with robust control testing and reporting tools. Finally, achieve your objectives with ease using strong governance and policy management mechanisms.

MetricStream products are packed with best practice workflows, content, AI, and analytics to help you:

• Drive business growth and strategic differentiation through your GRC program
• Connect risk, compliance, audit, cybersecurity, and sustainability on one platform
• Improve GRC efficiency, reduce costs
• Protect your digital business from cyber risks and evolving threats
• Grow with purpose using ESG best practices

To learn how MetricStream can help you on your GRC journey, request a personalized demo today.