Blogs
How Autodesk Moved from Siloed to Integrated IT Risk and Compliance Processes
- GRC
- 16 May 24
3 min read
Introduction
At MetricStream’s flagship event, GRC Summit, Clyde Tsai, GRC Lead at Autodesk, shared how MetricStream has helped them implement an integrated framework for IT risk and compliance management programs. Autodesk is a leading provider of software products to architecture, engineering, construction, product design, manufacturing, media, and entertainment industries.
Here are the key takeaways from Clyde’s session at the summit.
Why MetricStream?
Clyde: One of the very special things about Autodesk teaming up with MetricStream is that we're trying to get FedRAMP compliant. We are in the midst of getting the authority to operate in FedRAMP – it is the ability to sell to the federal government. It’s a huge audit and continuous process. That was actually our main driver for choosing MetricStream.
Apart from that we're also doing compliance for a range of frameworks. We’re trying to infuse more of a culture of risk-aware decision-making. We have a small risk team and we’re trying to do as many risk assessments as we can. Automation really helps us with that.
The Journey So Far
Clyde: We’re two years into it. Specifically, the products – IT and Cyber Risk Management, IT and Cyber Compliance Management, and Policy and Document Management. All of our initial use cases are security use cases – security compliance, security risk, FedRAMP compliance, and security policies.
Key Challenges and Learnings
Clyde: We have this challenge with silos -- we have security, privacy, internal audit, ERM, IT, and legal. The challenge that I see here is understanding and being informed when something is happening in any of these areas that affects me as a GRC implementation person. To address this challenge, we are just learning how to do interdisciplinary working groups.
An example of this is our initiative to put together an information asset inventory, which is a requirement for ISO and other frameworks. This information asset inventory includes all organizational databases, EC2s, containers, and much more. To do it right, one should collect this data from other systems. But the challenge is determining the authoritative sources of truth and what the systems are, what data is in them, and then normalizing them if they're coming from multiple systems.
In such a situation, one should piggyback on other data consolidation efforts. And that's one thing that I've learned while putting together these interdisciplinary groups. I am communicating with these groups, and they have similar initiatives going on. So, I can put my requirements in there as they might have bigger teams for doing these things.
Another challenge is that we have some processes that are mature and some that are immature. MetricStream has a lot of these workflows already as out-of-the-box workflows. Therefore, you have an opportunity to just use that as your process and have the perfect alignment between your technology and your process, which is rare to have.
Business Value and Realized Benefits
Clyde: Regarding business value that we have realized:
- We now have a one-stop shop for product owners and other leaders on SOC2 and ISO compliance. We plan to do a lot of other frameworks, like SOX, which we have to comply with.
- We have a single source of truth risk register for Autodesk at least from the security perspective.
- Regarding security risk assessments, we are in the process of getting those onboarded on MetricStream.
- We have implemented an integrated framework and process for integrating all risk data
- We have a huge requirement around FedRAMP, which requires us to report to our sponsoring federal agency every month, such as, how we are doing against vulnerabilities, etc. We have achieved complete automation around FedRAMP Plan of Action and Milestones (POAM) tracking:
- Generation of monthly POAM Report to sponsoring agency
- Issues tracking for open vulnerabilities
- Parity checks to ensure more than 90% of assets are scanned
Going forward, our priorities include end-to-end compliance testing, integrated control framework, automated evidence collection, and security policy management lifecycle.
You can watch the complete session here:
Join us in our upcoming GRC Summit 2024 in Baltimore on June 17-18 to explore other real-world GRC implementation stories. To register, click here.
Jump to Topic
Related Resources
Blogs
GRC Summit 2024, Baltimore: Get to Know Our Speakers
- GRC
- 08 May 24
4 min read
Introduction
We're officially in countdown mode! With just six weeks to go until the 2024 GRC Summit, to be held on June 17th and 18th in Baltimore, excitement is high. This year marks the 12th anniversary of our GRC event, and our theme, "Experience the Power of Connection," aims to empower you to achieve more as you continue to thrive on risk!
MetricStream’s flagship event, the GRC Summit, has been a ‘must-attend event’ for the GRC community over the past decade. The GRC conference serves as a platform for networking, sharing insights, exchanging best practices, and setting the stage for the future of GRC. Whether it's exploring emerging technologies, discovering new processes, or dissecting new regulations impacting business operations, the summit is the place to stay ahead of the curve.
The two-day technology conference will bring together an influential gathering of 200+ GRC leaders and recognized industry experts to discuss the latest trends and best practices in Connected GRC, the risks and opportunities of artificial intelligence (AI) for GRC, GRC for AI and more.
Find out more: Explore the GRC Summit Agenda.
Meet Our Amazing Speakers
As a leading thought-leadership event in the GRC realm, the GRC Summit consistently showcases top-tier expertise in risk, compliance, cyber, audit, and operational resilience. This year, we're thrilled to present over 45 experts who will deliver insightful keynotes, offer valuable insights and best practices, and generously share their own GRC journeys.
Keep scrolling to meet some of our esteemed speakers and learn more about their areas of expertise.
- Mike Koenig, Global Chief Ethics and Compliance Officer, JBS, was before being named to this position, the Head of Ethics and Compliance for Pilgrim’s Pride. 25 years prior to joining Pilgrim’s, Mike represented and defended companies, individual executives, and public officials in federal and state criminal, civil and regulatory investigations and trials. In addition to private practice, Mike served as a federal prosecutor in the Justice Department’s Criminal Division, Fraud Section, where he prosecuted a variety of white collar crimes, with a primary focus on corporate fraud
- Michael Cover, Director, Blue Cross Blue Shield of Michigan, serves as Director within the Office of the General Auditor and Corporate Compliance division and is responsible for designing and implementing technology solutions to support regulatory compliance and risk management efforts across the enterprise. Prior to joining BCBSM, Michael was at Ernst & Young within their IT Risk and Assurance practice. While at E&Y he focused on enterprise application implementations, business process redesign and mergers and acquisitions. Michael is a Certified Information Systems Auditor.
- Faisal Siddiqui, Deputy Chief Compliance Officer, International Finance Corporation (IFC)/World Bank Group, works with IFC’s Business Risk and Compliance Department, which focuses on integrity, regulatory, international tax, regulatory, privacy, and other risks. Faisal also directly manages IFC’s integrity due diligence efforts (including anti-corruption, AML/CFT, and sanctions issues) and heads many of its crisis management teams.
- Joseph Hegge, Senior Audit Program Manager at Lockheed Martin Corporation, has been with the organization for over 25 years and has more than 15 years of experience as an Internal Auditor and risk professional. Joe oversees the Corporate Internal Audit Professional Services team and is responsible for the department budget and staffing, reporting, quality program, Business Leadership Program (BLP), and Risk Program.
- Bianca Forde, VP, Global Ethics & Compliance Programs, Otis Elevator Co., serves by the compliance philosophy that emphasizes the importance of corporate cultural values. To that end, she works to execute innovative, data-informed solutions that continuously improve corporate culture, and empower all colleagues to choose the ethical course when challenges arise. Bianca is the 2023 winner of the Compliance Innovator of the Year Award, sponsored by Compliance Week. She is also the author the book, Prosecuted Prosecutor: A Memoir & Blueprint for Prosecutor-led Criminal Justice Reform based on her experience as a former federal prosecutor at the U.S. Attorney’s Office – District of Columbia.
- Madiha Fatima, Executive Director - Global Head of Horizontal Risk Management, JPMorgan Chase, leads the horizontal risk and control management function overseeing Third Party Risk Management, Insider Threats, and Real Estate risk. In her previous role, she served as the Head of the Third-Party Risk Management Department at Angelo Gordon, where she was responsible for the development of the Third Party Risk Management Framework while enabling businesses to achieve their strategic objectives by utilizing vendors. Before joining Angelo Gordon, she served as the Head of Third Party Risk Governance & Oversight at DTCC. Madiha is a Certified Third Party Risk Professional (CTPRP).
- Xin (Cindy) Tu, Director of IT & Data Audit, Discover Financial Services, is an IT/Data Risk Leader who has over 17 years of audit experience. She is currently an IT Audit Director at Discover Financial Services managing IT and Data audit portfolio. Prior to joining Discover, Cindy has been with Fannie Mae and Sallie Mae with an overall 9 years’ experience in the Financial Services Industry. Cindy’s specialty areas include IT Audits, Data Governance Audit, and Agile Methodology.
- Eduardo R. Ortiz, VP, Global Head of Cybersecurity, TTI Group, Inc., is a change leader and one of the leading corporate authorities in building effective Cybersecurity programs for global operations. As Global Head of Cybersecurity for Techtronic Industries, Inc., a $13B global operation, Eduardo oversees a 28-member global team of direct-level IT engineers and analyst staff, and multiple CIOs representing divisions worldwide. Eduardo architected, deployed, and supervised the first full-scale global Managed Detection and Response program for Techtronic Industries. Eduardo is a frequently requested public speaker and a thought leadership guest on industry-related talk shows and podcasts.
Discover more about our speakers, along with the full speaker lineup.
Keynotes from our Co-CEOs and Executive Chairman
MetricStream leaders Gaurav Kapoor and Prasad Sabbineni, our Co-CEOs, along with Gunjan Sinha, our Co-Founder and Executive Chairman, will offer valuable insights in their keynote addresses and panel discussions.
Secure your ticket now, as they're going fast! Register now.
Stay tuned for more updates on speakers and exciting highlights of the GRC Summit. Bookmark this space!
Jump to Topic
Related Resources
Blogs
What It Takes to Be a Leader in Governance, Risk, and Compliance
- GRC
- 27 March 24
4 min read
Introduction
We had a fantastic start to the year at MetricStream, with global leading research and advisory firm Forrester recognizing us as a Leader in The Forrester Wave™: Third-Party Risk Management (TPRM) Platforms, Q1 2024.
The recognition comes on the heels of The Forrester Wave™: Governance, Risk, and Compliance Platforms, Q4 2023, which also named MetricStream as a Leader with the highest possible scores in the GRC Vision, IT/Cyber Risk Management capabilities, AI/ML, product roadmap, and partner ecosystem criteria. Being recognized as a Leader in GRC and TPRM by Forrester is a testament to MetricStream’s unwavering strive for excellence and our commitment to helping organizations thrive on risk.
MetricStream has been spearheading GRC innovation for 25 years now, enabling organizations across industries and geographies to embark on the GRC journey and achieve business excellence. Being validated by independent research firms consecutively for many years is no ordinary feat. It requires determination, hard work, and a lot of perseverance.
There are three key reasons that make MetricStream a leader in GRC:
1. Trailblazing Vision, Roadmap, and Strategy
MetricStream has been a trusted GRC partner for organizations across industries and geographies for nearly 25 years now. In our journey so far, we have experienced many “GRC waves” – the financial crisis in 2008, technological advancement with automation and mobile technologies around 2015, the global healthcare crisis due to the COVID-19 pandemic in 2020, and the AI revolution, particularly generative AI, in 2023.
What’s been a differentiating factor for MetricStream in all of these major global events was the ability to foresee and embrace the risks and opportunities they presented. The leaders at the helm of the company – Gunjan Sinha, Executive Chairman and Co-Founder, Gaurav Kapoor, Co-CEO and Co-Founder, and Prasad Sabbineni, Co-CEO – with their extensive experience and in-depth knowledge are uniquely positioned to guide the company’s GRC innovation roadmap and strategy to make it more relevant and forward-looking.
The product innovation roadmap and strategy are also continuously refined and improved based on customer feedback. The objective is to ensure that our products and solutions meet and exceed the needs of today’s modern enterprise. We regularly engage with our customers via dedicated product councils and special interest groups to understand customer pain points, challenges, and expectations.
2. Technological Excellence
The progressive vision and roadmap are brought to life via our product and platform releases. Especially in the past three years – starting from Arno to the most recent Euphrates release, we have enriched our products and solutions with advanced features and functionalities, such as low-code/no-code capabilities, connected insights, cloud-native technology, AI-powered issue and remediation management, advanced risk quantification capabilities, autonomous and continuous monitoring and testing of controls, and more. AiSPIRE, the most recent addition to our product suite, enables organizations to leverage the benefits of AI for optimizing their control environment.
But what does this mean for organizations? How are we helping companies thrive on risk?
The answer lies in the business value we deliver (based on customer responses and the GRC Journey Business Value Calculator):
- 67% improvement in risk reporting visibility and efficiency
- 90% reduction in the time taken to manage compliance activities
- 30% reduction in controls and control tests
Learn how we helped Zurich Insurance, Switzerland's largest insurer, revolutionize its compliance, policies, and enterprise risk management processes in this award-winning case study.
3. Proliferating Partner Ecosystem
MetricStream partners play an indispensable role in our success story by helping us expand our reach and enhance the depth of our cutting-edge solutions. Our partner program is built on the core values of driving innovation, accelerating time-to-value, and achieving GRC expectations of organizations. The concerted effort aims to empower organizations to make risk-aware decisions, improve efficiency, and build resilience.
The MetricStream partner ecosystem includes some of the biggest names in the industry, such as Amazon Web Services (AWS), Deloitte, HCL Technologies, Infosys, PwC, KPMG, and many others.
The Journey Ahead
As the GRC landscape continues to evolve and become more interconnected, complex, and dynamic, organizations will need true GRC systems and programs with an integrated and connected approach supported by AI, cloud, and continuous capabilities. And we are hard at work to bring these next-generation solutions to you and help you advance on your GRC maturity curve.
If you’re looking to embark on the GRC journey and want to understand how MetricStream can help, contact us today!
Get your complimentary copy of The Forrester Wave™: Governance, Risk, and Compliance Platforms, Q4 2023 by clicking on the link.
Jump to Topic
Related Resources
Blogs
Navigating GRC Trends and Strategies in 2024
- GRC
- 21 March 24
5 min read
Introduction
In today's rapidly shifting business landscape, where uncertainty seems to be the only constant, Governance, Risk, and Compliance (GRC) strategy, process, and technology are more critical than ever. This era is marked by a kaleidoscope of challenges: geopolitical instabilities, economic volatility, and a relentless pace of technological innovation. In my recent webinar with MetricStream’s Patricia McParland, GRC Trends and Strategies to Accelerate Risk, Compliance, and Audit Programs in 2024 and Beyond, I had the privilege of diving into this whirlpool of change to explore emerging GRC trends and strategies for 2024 and beyond.
Watch now: GRC Trends and Strategies to Accelerate Risk, Compliance, and Audit Programs in 2024 and Beyond
When I reflect on the state of global business today, I see a world grappling with unparalleled complexities. These complexities are not just passing clouds but signify a profound transformation in how businesses operate and how risks are perceived and managed. In our interconnected global economy, the ramifications of geopolitical shifts are felt almost instantaneously, economic uncertainties loom large, and the digital revolution continues to redefine the landscape. Against this backdrop, traditional GRC programs and risk intelligence methodologies are undergoing a stress test. The question arises whether our current tools and frameworks are robust enough to navigate this dynamic and sometimes tumultuous environment.
In the webinar, I endeavored to peel back the layers of these complexities, offering a nuanced perspective on the future of GRC; this includes:
- Business-Integrated GRC (GRC 6.0). From a technology perspective, we are moving to what I call GRC 6.0. An evolution that signifies a deep integration of GRC into the very DNA of business processes. This approach transcends traditional compliance models, aligning GRC with the broader canvas of business objectives.
- Risk Management = No Surprises! It is critical that organizations approach risk management in a strategy that minimizes the unpredictability inherent in achieving business objectives. It involves a comprehensive understanding of the uncertainties tied to these objectives and devising proactive and responsive strategies.
- Orchestration of GRC Across the Enterprise. Organizations need a harmonious approach to GRC management across various departments. This orchestration is akin to a symphony conductor ensuring every section contributes to a cohesive performance. Such an approach is critical for a comprehensive view of organizational risk.
- Geopolitical Risk Management. Understanding and managing geopolitical risks have become paramount with the global business environment becoming more interconnected. Adopting a systematic and agile approach to these risks is now a key component of effective GRC strategies.
- Risk Agility and Resilience. Organizations must develop the capabilities to identify and navigate risks before they materialize and recover from unexpected setbacks. These capabilities are crucial in a constantly and rapidly changing business world.
- ESG Integration into GRC. GRC is how ESG gets done, and it requires integrating ESG into GRC strategy processes, which is enabled by technology. ESG commitments should be deeply embedded in organizational values and go beyond mere tokenism or box-ticking exercises.
- AI and GRC. The application of Artificial Intelligence (AI) in GRC is a game-changer, particularly in areas like regulatory change management and internal control monitoring. I differentiate between AI governance (AI GRC) and the use of AI to boost GRC processes (Cognitive GRC), both of which are critically needed within organizations.
- Elevated Accountability in GRC. There is a growing trend toward increased individual accountability within GRC. Senior management and executive teams are increasingly expected to take personal accountability, not just responsibility, for decisions around compliance and risk.
- GRC in a Diverse Cultural Context. Implementing effective GRC strategies across different cultural landscapes, especially in multinational corporations, presents its own set of challenges. It requires a sensitive and adaptive approach.
- Building a Human Firewall and Cultivating Business Champions. Each employee plays a crucial role in GRC, and it is important to nurture business champions at all levels within an organization to create a strong and pervasive GRC culture.
As I discussed these themes with Patricia McParland from MetricStream, it became increasingly clear that the future of GRC is a multifaceted and stimulating realm. It demands an integrated, agile, and technology-empowered approach. Organizations that embrace these emerging trends and fortify their GRC frameworks will be well-equipped to navigate and capitalize on the opportunities presented by the complexities of today's business world. This webinar offered a platform to share comprehensive insights and practical strategies for organizations looking to enhance their GRC frameworks in these transformative times. It was an enlightening experience to contribute my thoughts and engage in a meaningful dialogue on the future of GRC.
Watch now: GRC Trends and Strategies to Accelerate Risk, Compliance, and Audit Programs in 2024 and Beyond
Jump to Topic
Related Resources
Blogs
How to Automate GRC and Its Benefits
- GRC
- 13 March 24
10 min read
Introduction
In the dynamic landscape of modern business, the need for effective Governance, Risk, and Compliance (GRC) processes has never been more critical. As organizations navigate the intricate risk and regulatory landscape globally, a robust GRC strategy becomes paramount not just for business success but also to ensure Business As Usual.
MetricStream, a market leader in GRC software products and solutions, underscores the crucial role of automation in GRC programs, enhancing efficiency and ensuring compliance in highly regulated industries. This article explores GRC automation, its importance for organizations, and the steps to seamlessly integrate automation into existing processes.
What is GRC Automation?
GRC Automation is an automation technology that streamlines processes such as risk and compliance management frameworks. It helps to enhance the efficiency of the process, reduce manual errors and ensure real time compliance.
GRC automation tools leverage advanced technologies, such as artificial intelligence and machine learning, to enhance decision-making and mitigate risks effectively. These tools provide a unified platform that enables organizations to manage governance, assess risks, and ensure compliance seamlessly. The automation process involves the use of software solutions to replace siloed, manual, and time-consuming processes, reducing errors and improving overall operational efficiency.
Why GRC Automation, and Why Now?
Recent developments in the business world highlight the increasing significance of streamlining GRC processes and the need for automation in this sphere.
In the United States, where regulatory frameworks continue to evolve, enterprises are grappling with the complexities of compliance. The Securities and Exchange Commission (SEC) has been actively tightening regulations, emphasizing the importance of robust internal controls and risk management. Similarly, in the United Kingdom and Europe, post-Brexit, companies are navigating new regulatory landscapes, necessitating agile GRC processes to adapt to changing compliance requirements.
While the business environment continues to evolve, the advent of Generative AI has brought opportunities for automation to organizations but also posed new problems, such as data privacy and data governance challenges. When a few thousand users in and around the organization are all exposed to new and powerful AI tools, what prerogative must be set to ensure they all operate within the legal framework of the company?
Governance, then, extends beyond compliance with existing norms alone and should take on the ability to predict and plan for changes to a future that is also evolving simultaneously. Specifically, automating the GRC process gives business leaders an opportunity to accurately capture changes both within and outside the organization, make key decisions in time by observing and validating patterns, and set their company up for success and stability at all times.
Benefits of GRC Automation
The business landscape is evolving at an unprecedented pace, with regulatory requirements becoming increasingly complex. Organizations face the challenge of maintaining compliance while simultaneously dealing with intricate governance structures and managing risks effectively. Here are just a few advantages of GRC process automation:
- Efficiency and accuracy: GRC automation tools eliminate manual processes, reducing the likelihood of human errors. Automated workflows ensure consistency in data collection, analysis, and reporting, leading to more accurate results.
- Real-time monitoring: Automation enables real-time monitoring of compliance status and risk exposure. This allows organizations to proactively address issues and implement corrective measures promptly, minimizing the impact of potential risks.
- Enhanced decision-making: GRC automation frameworks leverage advanced analytics to provide actionable insights. This empowers decision-makers with comprehensive data to make informed choices that align with both business objectives and regulatory requirements.
- Resource optimization: Automation frees up valuable human resources by automating routine tasks. This allows skilled professionals to focus on strategic initiatives, adding value to the organization.
- Adaptability to regulatory changes: Regulatory requirements are dynamic, and organizations must adapt quickly to stay compliant. GRC tools are designed to be flexible, making it easier for organizations to adjust their processes in response to changing regulations.
GRC Automation: 8 Key Aspects to Consider
-
Stakeholder involvement and mapping locus of control
Identifying key stakeholders is crucial to the success of GRC automation. These stakeholders may include technology officers and managers, implementation partners for various initiatives, end-users and report validation providers, Chief Risk and Compliance Officers, and IT leaders.
Understanding their roles and responsibilities is vital in mapping the locus of control. Conducting workshops and interviews can help unravel the intricate web of relationships and dependencies. By fostering collaboration between IT, risk management, and compliance teams, organizations can gain a holistic perspective, ensuring that diverse viewpoints contribute to the decision-making process. -
Establishing a clear roadmap for GRC automation
After outlining the importance of optimizing controls for risk management, the next crucial step involves establishing a clear roadmap for GRC automation. This includes defining key milestones and expected outcomes, crafting a comprehensive program management plan, and delineating specific responsibilities. Automation constitutes a lengthy endeavor, necessitating alignment from senior leadership, a cultural shift, and leveraging supporting technology to forge a durable alliance for sustained success. -
Understanding limitations in existing systems
Conducting a thorough assessment of existing systems and processes requires a comprehensive understanding of the organization's technological and hierarchical landscape. Engaging business leaders, IT professionals, and system architects in this process ensures a nuanced evaluation.
It is important to remember that automating a function as diverse as GRC must not be hurriedly carried out in a single phase. Phase-wise planning and execution are helpful, and experts in GRC automation must be roped in early on in the process to help focus on aspects that are important.
Prioritizing feature deployment involves collaborating with end-users to identify key pain points and critical needs. Establishing a cross-functional team, including representatives from risk management, IT, assurance, and compliance, can provide valuable insights into the order of priority for deploying features that address compliance and risk management challenges. -
Solution selection and integration
Selecting a GRC automation solution demands a nuanced evaluation of organizational needs. This involves not only understanding the technical requirements but also considering the cultural aspects of the organization.
When choosing an integrated GRC solution do consider if the vendor has experience delivering projects in the same industry or in a similar context as your organization.- How well the various GRC processes can be managed in a single tool?
- How long is the learning curve?
- How can you, as a customer, contribute and influence future innovations?
- Is there a forum or customer community where you can discuss industry best practices and learn from each other?
- What challenges were the other customers able to solve with the implementation?
- How does the vendor approach projects of this nature?
- Can they help support end-user training needs?
- Are they familiar with greenfield and brownfield implementations in large and complex projects?
- Can the tool provide agility and support us in our GRC automation maturity journey in the future?
- How flexible is the tool to integrate with your other tools and data sources?
- What data security measures the vendor takes to ensure your data is safe? Does it the have required certifications?
- Does the vendor provide enough support- both technological and GRC domain-specific?
Additionally, pilot testing and phased implementations can help identify potential challenges and streamline integration.
-
Planning for known-unknowns and unknown-unknowns
Identifying potential risks and consequences of poor GRC automation necessitates a comprehensive program risk assessment. Engaging risk management experts and legal advisors can shed light on potential legal and business implications.
Establishing contingency plans involves a collaborative effort between risk management, legal, and IT teams. Proactive monitoring mechanisms, such as regular audits and automated alerts, can provide early indicators of potential issues.Emphasizing the importance of compliance involves communicating the potential consequences to all stakeholders and fostering a culture of accountability and responsibility. -
User training
Developing a comprehensive training program requires collaboration between training professionals, subject matter experts, and business users. Identifying key users and stakeholders in each department ensures that training programs are tailored to specific needs. Providing ongoing support involves establishing a dedicated helpdesk or support team. Regular communication and feedback sessions help address user queries and concerns. Fostering a culture of continuous learning involves creating a repository of training materials and resources, enabling users to stay updated on system changes and enhancements. On-demand training videos and ensuring in-app contextual help with AI chatbots can significantly enhance user support and experience.
Why is training important, especially with automation in the picture? Often, we notice that the ROI on automation projects is lower than projected, and a major cause of this is end-users not being able to leverage the solution to its full potential. Effective training, then, is not only about having the right kind of material and modules but intervening at the right time to support a successful implementation. -
Fine-tuning the automation process
Regularly assessing the performance of GRC automation processes involves establishing key performance indicators (KPIs) and metrics. Engaging data analysts and performance experts can provide insights into system efficiency. Fine-tuning the system based on user feedback requires creating feedback loops and involving end-users in the improvement process.
Implementing continuous improvement measures involves establishing a feedback mechanism and a dedicated team to address identified areas for optimization. This iterative approach ensures that the GRC automation system evolves in tandem with organizational needs. -
Leveraging artificial intelligence (AI)
Today, there is no conversation on technology without a conversation on AI. With the advent of the era of Generative AI, there are both pitfalls and opportunities specific to GRC. Even a task as seemingly straightforward as end-user training can benefit from a purpose-build ‘GovernanceGPT’ of sorts. Analytics and reporting can take a giant stride forward if they were to bring conversational capabilities into how users interact with the reports generated for them.
Needless to say, the use of AI brings the need for more expertise into the picture, and a good automation tool is self-reliant in how it brings these various stakeholders together to achieve cohesive results.
Evaluating the role of artificial intelligence in enhancing GRC processes involves collaborating with data scientists and AI experts. Understanding the specific requirements of the organization and the GRC domain is crucial in determining the appropriate use of AI.
Leveraging AI for predictive analytics requires training machine learning algorithms with historical data and engaging domain experts to validate outputs. Integrating machine learning algorithms for data-driven insights and decision support involves close collaboration between data scientists, IT professionals, and GRC experts. This holistic approach ensures that AI is applied judiciously to enhance the overall GRC automation framework.
Challenges in GRC Automation
A thing of beauty is a joy forever, and that holds especially true for complex implementations such as GRC automation. When done right, GRC automation brings forth a multitude of benefits for organizations aiming to navigate the complex landscape of governance, risk, and compliance.
That said, points of failure are many, and a project of this nature can quickly crumble if not led by an able governance team. Here are just a few challenges that could arise.
- Integration complexity: Integrating GRC automation tools with existing systems can be complex and may require significant effort.
- Resistance to change: Employees may resist the transition to automated processes, requiring effective change management strategies.
In both these cases above, clear communication on the need for such automation in ways that resonate with each stakeholder often solves the problems before they begin to take root. Every consideration should be taken into account and designating a concerns manager could be an important way of ensuring success well before the project begins. - Cost considerations: The initial investment in GRC automation tools and training may pose financial challenges for some organizations.
That said, even in the context of a global recession, the needs and methods of doing business do not take a backseat, and organizations find that the return on investment of GRC automation is far higher than the upfront cost of implementation. Please reach out to us to help calculate the ROI of GRC automation for your specific use-case. - Data security concerns: Handling sensitive data in an automated environment raises concerns about data security and privacy.
As a core mandate for us at MetricStream, all our automation solutions are designed with data privacy as a core priority and not just a bolt-on afterthought. - Customization requirements: Organizations with unique GRC needs may face challenges finding automation solutions that align perfectly with their requirements. However, with the right solution provider, these integrations are more than just possible.
Power Your GRC Automation Journey with MetricStream
In the dynamic landscape of modern business, the adoption of GRC automation is not merely a choice but a strategic imperative. MetricStream's emphasis on providing comprehensive GRC automation solutions underscores the growing importance of leveraging technology to enhance governance, manage risks, and ensure compliance.
Careful consideration of limitations in existing systems, solution choices, and integration with existing tools is essential for a successful implementation. The consequences of poor automation underscore the need for a meticulous approach, emphasizing user training, fine-tuning, and the judicious use of AI in the GRC context.
By embracing GRC automation, organizations can unlock efficiency, improve risk management, and navigate the intricate web of compliance requirements with agility. The road to automation may present challenges, but the long-term benefits far outweigh the initial hurdles, positioning organizations for sustained success in an ever-changing business environment.
Our Enterprise GRC solution automates risk and compliance data from across the enterprise and third-party vendors into actionable business intelligence for risk-aware decision-making.
Interested to learn more? Request a customized demo now.
Jump to Topic
Related Resources
Blogs
International Women’s Day 2025: Embracing Diversity, Equity, and Inclusion at MetricStream
- GRC
- 05 March 24
4 min read
Introduction
At MetricStream, diversity, equity, and inclusion (DEI) are not just buzzwords; they are the cornerstone of a thriving and innovative workplace. Established as core to our organizational culture, DEI principles have helped in driving innovation, empowerment, and collective growth. As we celebrate International Women's Day (IWD) on March 8, 2024, it's an opportune moment to reflect on not just the importance of recognizing and amplifying the achievements of women worldwide but also actively working towards creating a more equitable and inclusive future for all. It also calls attention to the IDW theme for this year, #InspireInclusion, which emphasizes the need to create a world where everyone, regardless of gender, is included, respected, and valued.
As leaders in governance, risk management, and compliance (GRC) software solutions for 20+ years, we recognize the invaluable contributions of women to our success. Women play a pivotal role in driving innovation and ensuring organizational success at MetricStream. We are proud that today, women make up 33% of our workforce. Globally, women make up about 28% of the tech workforce.
In the dynamic landscape of technology, women bring different perspectives, experiences, and approaches to problem-solving, which can lead to more comprehensive and effective solutions to complex technological challenges. UN Women notes that bringing women into technology "results in more creative solutions and has greater potential for innovations that meet women’s needs and promote gender equality." Gender diversity fosters a more inclusive work culture where diverse voices are heard and valued. This not only enhances employee satisfaction but also promotes creativity and collaboration within teams.
Ensuring A Thriving Environment for Women in Tech
MetricStream's commitment to DEI is deeply ingrained in our organizational DNA and reflected in our women-friendly initiatives. We run programs all through the year tailored specifically for women in tech to ensure that they have the support and resources needed to succeed.
GROW (Growing Relationship Opportunities for Women), the employee resource group focused on women, is one such initiative. As a group of women and allies for women, GROW meets once a month to support each other and learn new skills. It is a place where women (and men) can be unapologetically ambitious, expand networks, and help each other achieve goals. GROW sessions have covered various interesting topics such as Centered Leadership, Drop the Ball: Doing More of What Matters, 5 Habits to Extreme Productivity, etc.
The MetricStream Mentorship program #YouMatter@MetricStream, designed to support and celebrate our employees and provide the opportunity to develop mentor relationships with senior-level leadership, has helped women employees to learn, grow, and foster their own personal and professional growth. It also provides a platform for senior women leaders to give back and mentor junior employees. The enthusiastic responses we've garnered from women employees across the three sessions conducted to date highlight the immense value of connecting with senior leadership—regardless of gender. These interactions have proven to be incredibly beneficial for women seeking support in both career advancement and personal development.
Our hybrid /flexible work policy is a testament to our commitment to understanding the challenges women employees may encounter, especially in unique circumstances such as upon returning from maternity leave or when required to be caregivers for family. This model not only accommodates their specific needs but also adds value by fostering a healthier work-life balance.
Our Women's Day panel discussions, featuring accomplished women in various fields, have consistently stood out as the highlight of our International Women's Day celebrations each year. Their extraordinary personal journeys of triumph and resilience, coupled with their valuable insights into fostering inclusivity and driving positive change through policies and practices, have been truly inspiring.
Another Women's Day initiative that has received overwhelming support from both women and men at MetricStream is the "Walk for Women," held concurrently at our numerous global locations. We also frequently extend invitations to our women employees to address events such as our Town Hall and All Hands, creating opportunities for them to share their experiences and nurture a sense of community and empowerment.
Last but not least, supportive men are integral allies in the journey towards gender equality. At MetricStream, our male leaders, managers, and mentors have actively participated in fostering an inclusive environment and advocating equal opportunities. By championing diversity and inclusion, we collectively create a workplace where everyone can thrive.
The Path Forward
As we look to the future, MetricStream remains steadfast in our commitment to diversity, equity, and inclusion. We will continue to champion women in tech, expand our DEI initiatives, and strive towards creating a workplace that celebrates and empowers individuals from all backgrounds.
At MetricStream, we are proud to stand alongside women as allies and advocates, driving positive change within our organization and beyond.
Jump to Topic
Related Resources
Blogs
Selecting the Best GRC Solution: What You Need to Know Before Investing
- GRC
- 15 February 24
6 min read
Introduction
Key Considerations for Buying a GRC Software Solution
As organizations grow and scale their operations, they are required to upgrade their governance, risk, and compliance (GRC) programs and activities accordingly. While a traditional approach to GRC involving spreadsheets, emails, and/or point solutions would have somewhat worked in the past, expanding business operations together with the fast-changing risk and regulatory landscape compels organizations to consider investing in GRC tools and software solutions.
Finding the right solution is daunting considering the growing number of GRC software vendors in the market, each promising their unique value proposition. Gartner notes that the GRC vendor selection process is also complicated due to the wide range of requirements of various stakeholders involved in the process, such as BU heads of enterprise risk management, corporate compliance, IT and cyber security, credit risk management, and others.
Organizations are increasingly seeking a one-stop solution that is connected, scalable, and cognitive, as well as one that meets the expectations of various stakeholders. On these lines, what are the specific capabilities that the decision-makers must keep in mind before choosing a GRC solution?
In this blog, we discuss the key considerations for buying a GRC software solution – from a buyer’s perspective. Let’s break it down.
1. Connected: Integration and Interoperability
While exploring various GRC solutions, organizations would definitely find terms like ‘integrated approach,’ ‘integration,’ ‘unified approach,’ ‘holistic approach,’ etc., again and again. What does it mean?
More often than not, organizations find themselves managing governance, risk management, and compliance activities in a disjointed manner, depending on the maturity of each process and evolving business requirements. This inevitably results in organizational silos, which lead to duplication of efforts and data, blind spots, and high cost of compliance. Particularly in the era of amplified interconnectedness of risks and shared controls, it hampers an organization’s ability to accurately understand risk relationships and impact on effective decision-making.
An integrated approach is nothing but a cohesive approach to managing governance, risk management, and compliance activities across business units, geographical locations, and the extended vendor network. It requires firm-wide common GRC taxonomy, shared risk and control libraries, enterprise-level and business unit-level risk appetite allocation and risk aggregation, and standardized and streamlined processes across GRC activities. Most importantly, it requires buy-in from all key stakeholders.
Deploying a single, technology-driven GRC solution, with capabilities for establishing standardized taxonomy and centralized risk repository, can help an organization:
- Gain a single source of truth for all stakeholders
- Eliminate duplication of efforts and reduce costs
- Improve efficiency by automating repeatable tasks
- Enhance risk visibility and foresight with real-time, actionable insights
Interoperability is the ability of the GRC software to securely exchange information with other systems. While the integrated approach calls for the implementation of a single system, it is important to ensure that the system supports interoperability to capture and aggregate risk information from various sources. For example, integrating with regulatory content providers, risk rating providers, threat intelligence providers, and others via APIs or connectors.
2. Cloud: Agility and Scalability
The solution must be flexible to scale up or down depending on changing business conditions and requirements. A cloud-based GRC solution offers this much-needed agility and flexibility with high security, greater efficiency, and easier upgrades compared to on-premise solutions. Furthermore, opting for a cloud-based solution is also aligned with the ongoing digital transformation initiatives at organizations. McKinsey estimates that most companies will aim to allocate 80% of their IT budget toward cloud computing by this year.
In this context, low-code/no-code capabilities are also gaining popularity. By enabling organizations to configure and personalize the solution to meet their specific needs without the need to depend on the software vendor, a solution with low-code/no-code capabilities can significantly accelerate GRC program productivity and outcomes.
3. Cognitive: Artificial Intelligence and Continuous Innovation
There is no denying that artificial intelligence (AI)-infused workflows are the future. We are already seeing more and more applications of AI in GRC processes, such as scanning the regulatory horizon, managing issues, providing remedial action recommendations, optimizing the control environment, scanning policies and documents, and many others. With its promise to provide actionable insights quickly, AI can help organizations accelerate decision-making, create bandwidth for teams, and gain a competitive edge.
To better meet the needs of today’s dynamic enterprise, GRC solutions need to go beyond just being a workflow-driven automation tool to a more comprehensive tool that’s cognitive and intelligent. A ‘single pane of glass’ view has become the industry norm for reporting GRC metrics. In this context, organizations are increasingly looking for solutions that support cross-product reporting, which allows importing relevant data from various products to build one comprehensive report.
When considering a GRC solution, organizations should evaluate the technological prowess of the vendor. This requires examining not only the current capabilities and functionalities offered by their solution but also their innovation roadmap. Continuous innovation is essential for ensuring that the GRC solution is relevant and ready to adapt to the evolving business and technological landscape.
4. Continuous: Autonomous and Always-On
A periodic approach to managing governance, risk, and compliance management activities and processes is no longer effective in the digital era. Organizations today operate in a highly dynamic business environment, where they must protect their IT infrastructure, data, and assets from cyber risks, stay on top of threats, vulnerabilities, and other emerging risks, and be compliant with a multitude of industry regulations and standards. Relying on human effort for these tasks will not only result in a lag where risk, compliance, and audit teams struggle to meet expectations but also leave the organization vulnerable to risks and blind spots.
An autonomous, always-on approach is one that is continuously running in the background and requires minimal human intervention. Before choosing a GRC solution, organizations must explore if it supports autonomous capabilities, such as continuous testing and monitoring of controls to proactively identify control weaknesses and gaps and compliance with relevant regulations. Ideally, the solution should collect evidence, generate automated reports, and notify appropriate personnel for remedial actions.
How MetricStream is Leading the Way
MetricStream’s core innovation focus is on making its products and solutions more Cognitive, Continuous, Connected, and Cloud-based. We are a recognized industry leader in GRC, empowering organizations across industries and geographies to thrive on risk for 25 years now. Here’s what sets MetricStream apart in the GRC space:
- Future-ready products and solutions built on top of a low-code/no-code integrated GRC platform that empowers all stakeholders to follow a consistent and collaborative approach
- Intelligent AI-powered capabilities for managing issues, recommending action plans, scanning of SOC2 and SOC3 reports, and AiSPIRE, an AI-based knowledge-centric tool for GRC
- Autonomous capabilities that enable continuous testing and monitoring of controls across on-prem and cloud environments
- Truly connected products that allow secure sharing of data across MetricStream platform as well as external third-party GRC systems
- Forward-looking product innovation roadmap and strategy that leverages peer-to-peer discussions on industry trends and best practices through customer forums and advisory boards
If you want to understand how MetricStream can help you embark on the GRC journey, request a personalized demo today.
Jump to Topic
Related Resources
Blogs
What’s Next in GRC and Risk Regulations? 10 Key Focus Areas for 2025
- GRC
- 03 January 24
10 min read
Introduction
Like the French proverb says, the more things change, the more they stay the same – except when they speed up! Of course, I added that last part. But when it comes to regulatory change, there does seem to be one constant: expansion. Thomson Reuters says there were more than 230 regulatory alerts a day in 2022. That’s not hard to believe with the escalating levels of regulatory activity around operational resilience, artificial intelligence (AI), cybersecurity, data privacy, and ESG, among others.
In 2023, we saw some key cybersecurity and digital operational resilience regulations crystallizing in the U.S. and the European Union, setting a precedent for other regions. The regulatory momentum seen in 2023 will continue and likely become more intense in 2024.
So what’s on the horizon for 2024, and what should you prepare for? Here’s a look at 10 key regulations and focus areas we are watching.
1. AI-Focused Regulations
The growing regulatory focus on AI in recent months is not surprising, considering the exploding use of AI and generative AI (GenAI) across industries. The trend is expected to continue well into 2024 and beyond.
In January 2023, the National Institute of Standards and Technology (NIST) released the NIST AI Risk Management Framework (AI RMF 1.0), which aims to “improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.” Another major development was the Executive Order published by the White House on the safe, secure, and trustworthy development and use of AI.
The European Union is also taking steps to regulate the use of AI. In December 2023, EU officials reached a provisional agreement on comprehensive rules to ensure safe and trustworthy use of AI. According to a report from BBC, the EU Parliament will vote on the AI Act proposals this year, with the legislation to not take effect before at least 2025. Additionally, China, Canada, Brazil, South Korea, Singapore, the UK, and the UAE are all in various phases of rolling out AI-related regulations, which are likely to be adopted sooner rather than later.
Like AI itself, we expect to see these regulations to continue to develop and evolve just as the technology itself does – and as we as an industry employ new use cases of AI for GRC.
2. SEC Cybersecurity Rules
Cyber risk is a top risk faced by organizations today. The risk of cyber attacks and data breaches has been further amplified by the widespread and easy accessibility of AI-based tools, which can be leveraged by cyber criminals to launch attacks on massive scale. Regulatory authorities are hard at work to ensure organizations have necessary measures in place to protect organizational assets and interest of all relevant stakeholders.
The U.S. Securities and Exchange Commission (SEC) adopted Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Rules in July 2023. The focus of these rules is for public/listed companies to
- Implement a robust incident management process with direct reporting to the SEC
- Periodically disclose details of the expertise of their board and senior management and also their cybersecurity risk management processes/procedures in place
For risk management, strategy, and governance disclosure requirements, public-listed companies are required to provide the disclosures beginning with annual reports for fiscal years ending on or after December 15, 2023.
To learn more about the SEC’s Cybersecurity Rules, read our blog "Achieve Compliance with SEC’s New Cybersecurity Rules ".
3. NIST Cybersecurity Framework (NIST CSF)
In addition to regulations, regulators and standard setting bodies also issue guidelines and frameworks to help businesses manage cyber risks effectively. The NIST Cybersecurity Framework is one of the most widely used frameworks by organizations. First published in 2014, the framework provides “a structure that organizations, regulators and customers can use to create, guide, assess or improve comprehensive cybersecurity programs.”
The National Institute of Standards and Technology (NIST) released a revised draft of the framework for public comment in the latter half of 2023. The draft update or Framework 2.0, it said, “reflects changes in the cybersecurity landscape and makes it easier to put the CSF into practice — for all organizations.” According to the official announcement, the final version of CSF 2.0 will be published in early 2024.
To learn about what’s new in the revised version and how you can achieve compliance, read our blog "Demystifying NIST CSF 2.0: What's New and Why it Matters ". Also, explore how MetricStream can help you get started with NIST CSF with pre-packaged content.
4. Cybersecurity Maturity Model Certification (CMMC)
Another major cybersecurity standard and certification model is the U.S. Department of Defense’s Cybersecurity Maturity Model Certification (CMMC). CMMC is designed to “enforce protection of sensitive unclassified information that is shared by the Department with its contractors and subcontractors.”
The CMMC final rule is also expected this year. In 2023, the Department of Defense sent the draft rule, CMMC 2.0, to the White House’s Office of Information and Regulatory Affairs (OIRA) for review. CMMC 2.0 is a comprehensive framework that aims to protect the defense industrial base’s (DIB) sensitive unclassified information from advanced persistent threats (APTs). The final rule includes some key changes to the CMMC 1.0 and is expected to considerably simplify compliance, reduce assessment costs, enhance accountability, and more.
Learn how MetricStream can help you achieve CMMC compliance.
5. NYDFS Cybersecurity Regulations
Financial sector is one of the primary targets of cyber adversaries given the amount of data and financial assets at stake. So, the intensifying regulatory focus on this sector doesn’t come as a surprise.
The New York Department of Financial Services (NYDFS) finalized the amendments to its nation-leading Cybersecurity Regulation in November 2023. Enacted in 2017, the regulation requires covered entities, including banks, insurance companies, and other financial services institutions regulated by DFS, to have effective cyber risk and governance measures in place, including a cybersecurity program for protecting consumers’ private data, well-document policies, a CISO to help protect data and systems; and effective controls, among others.
The amended regulations mandate enhanced governance requirements, more regular risk assessments, additional controls to protect information systems from unauthorized access, updated notification requirements, and much more. It is important for organizations to keep an eye on the NYDFS Cybersecurity Regulation as it is expected to set a precedent for other states and municipalities.
Regulated entities need to be compliant with the new regulations by April 29, 2024.
6. Operational Resilience
The regulatory interest and activity on operational resilience of financial sector organizations continues to gain momentum. In the UK, the Bank of England (BoE), Financial Conduct Authority (FCA), and the Prudential Regulation Authority (PRA) jointly published a consultation paper on “Operational resilience: Critical third parties to the UK financial sector (PRA CP26/23 and FCA CP23/30)” last month. The deadline for sending feedback comments is March 15, 2024. The regulators also intend to consult on a joint statement of policy regarding the use of their disciplinary powers over critical third parties.
Explore how the MetricStream Operational Resilience solution can help you navigate today’s fast-evolving risk landscape.
In the EU, the Digital Operational Resilience Act (DORA) aims to strengthen Information and communications technology (ICT) and digital risk management with focus on third parties, and promote digital operational resilience in the region’s financial sector. Key requirements span various ICT-focused areas such as risk management framework, incident management and reporting, and digital operational resilience testing program, among others. Adopted by the European Parliament in November 2022, the act requires regulated entities to comply by January 17, 2025. This means that the countdown has already begun – financial sector organizations have just 12 months to ensure compliance with DORA.
Given the growing focus on operational resilience across industries, DORA is a landmark regulation and expected to act as a harbinger of what other sectoral and federal regulatory authorities are likely to follow.
To learn about the DORA requirements in detail and understand how it impacts your organization and how you can ensure compliance, download our eBook “Demystifying DORA - Understanding and Preparing for the EU’s Digital Operational Resilience Act”.
7. Data Privacy
Protecting Personal Identifiable Information (PII) continues to be a top focus area for regulatory authorities worldwide.
In the US, the enforcement of the new California Consumer Privacy Act (CCPA) regulations has been deferred until March 29, 2024. In 2020, California voters passed the California Privacy Rights Act (CPRA), which amended the CCPA and introduced additional privacy protections. CPRA established new standards for the collection, retention, and use of consumer data as well as imposed “new obligations governing personal information, including requirements that businesses adopt certain mechanisms permitting consumers to opt out of data sharing.”
CPRA created the California Privacy Protection Agency (CPPA) to implement and enforce the law by July 1, 2022, with enforcement not to begin until July 1, 2023. However, the agency completed only the first set of regulations under the CPRA on March 29, 2023.
In the wake of this delay, a California court postponed the enforcement of the new regulations by twelve months. That said, statutory changes under the CCPA went into effect on January 1, 2023, and remain in force.
In November 2023, the CPPA also proposed a new regulatory framework for “automated decision-making technology” (ADMT), which defines key protections related to businesses’ use of these technologies. The agency has also published the revised draft regulations on risk assessments and cybersecurity audits.
Discover how MetricStream can help you strengthen CCPA compliance.
In the UK, the Department for Science, Innovation and Technology published a statutory instrument in September 2023 to amend the references to ‘fundamental rights and freedoms’ in the data protection legislation. The amended language is to refer to rights recognized under UK law, rather than retained EU law rights. If approved by the UK Parliament, the amendment is expected to come into force in early 2024.
8. Gramm-Leach-Bliley Act (GLBA)
Another key regulation focused on protecting sensitive data, specifically consumer financial privacy, is the Gramm-Leach-Bliley Act (GLBA). It requires financial institutions to explain their “information-sharing practices to their customers and to safeguard sensitive data.”
In October 2023, 20 years after the GLBA Safeguards Rule first came into effect, the Federal Trade Commission (FTC) amended the rule. As per the latest amendment, non-banking financial institutions will be required to report data breaches to the FTC, affecting at least 500 consumers. The entities must notify the agency “as soon as possible, and no later than 30 days after discovery of the event.”
The amendment will come into effect 180 days after its publication in the Federal Register. As per reports, this is likely to happen in 2024.
9. Payment Card Industry Data Security Standard (PCI DSS)
Another major standard aimed at protecting sensitive data, specifically cardholder data, is the Payment Card Industry Data Security Standard (PCI DSS). The globally recognized standard, applicable to organizations across industries that store, process, and/or transmit cardholder data, provides a set of technical and operational requirements intended to protect cardholder data.
The latest version of PCI DSS will come into effect on March 31, 2024. The PCI Security Standards Council (PCI SSC) published version 4.0 of PCI DSS in March 2022 and gave organizations two years to understand the changes and implement any updates as needed.
According to the official release, “PCI DSS v4.0 replaces version 3.2.1 to address emerging threats and technologies and enable innovative methods to combat new threats.”
Explore how MetricStream can help you streamline and strengthen PCI DSS compliance.
10. Fairness and Sustainability
Diversity, equality, and inclusion (DEI) and sustainability are increasingly becoming top agenda items not only for organizations but also for regulators worldwide. In the US, 22 states updated the minimum wage on January 01, 2024. Later in April, the Department of Labor (DOL) is expected to release its final rule amending the regulations on the “white collar” exemptions from the overtime and minimum wage requirements of the Fair Labor Standards Act (FLSA).
Furthermore, a revised rule by the DOL requiring establishments with 100 or more employees in designated high-hazard industries to submit injury and illness information electronically to the Occupational Safety and Health Administration (OSHA) also took effect on January 01, 2024.
In the EU, the European Parliament adopted the Corporate Sustainability Reporting Directive (CSRD) in November 2022, with member states required to implement the new rules 18 months later. The CSRD introduces more detailed reporting requirements, enabling investors and other stakeholders to make better-informed decisions on sustainability issues.
“The CSRD introduces more detailed reporting requirements and ensures that large companies and listed SMEs are required to report on sustainability matters such as environmental rights, social rights, human rights and governance factors,” the European Council said.
The application of the regulation will be staggered between 2024 and 2028. In the first phase, companies already subject to non-financial reporting directive (NFRD) will be required to report in 2025 on the financial year 2024.
These are just a few of the regulations businesses should closely watch this year. To successfully navigate the fast-changing regulatory landscape, organizations need an integrated, streamlined, and technology-driven approach to compliance that helps them stay on top of regulatory changes and reduce costs while improving visibility into the overall compliance posture. MetricStream Compliance Management helps organizations get their compliance program up and running quickly and ensure adherence to relevant regulations and industry standards.
Explore how MetricStream can help you strengthen your compliance function – request a personalized demo today!
Jump to Topic
