Blogs
Establishing a Resilient GRC Strategy for Your Organization
- GRC
- 07 February 23
5 min read
Introduction
One of the major challenges confronting organizations today is that risk has become complex. Highly interconnected and interdependent, it cascades and intersects to create other risks, triggering a chain reaction whose ripple effect may not always be obvious or direct. Organizations today understand that risks cannot be understood or managed in isolation. As a result, we hear risk specialists talking about the butterfly effect or the chaos theory of risks. The basic premise is that risks are systemic and interlinked in ways we may not always anticipate.
Reportedly, large financial services firms deal with 257 regulatory change events every business day from 1217 regulators. In addition, organizations must also account for various types of risks—geopolitical, economic, energy, market and commodity risks, as well as internal ones.
At the 2022 MetricStream GRC Summit, Michael Rasmussen, explained the interconnectedness of risks and their cascading effect through the tree in the forest analogy. If the complex business environment is the "forest," then it's essential to know how the "forest" and "individual trees" fit together. This is because that minor vulnerability or exposure at the "tree" level can cascade and become a significant issue that sets the whole forest alight. To truly understand risk, we need to see the big picture and understand how individual risks can trigger a chain of other events.
For example, the COVID-19 pandemic was not merely a health and safety hazard. Instead, the remote work-from-home environment increased IP security and privacy risks, and created a fertile ground for darker risks like modern slavery, child labor, forced labor, bribery, and corruption.
What is a GRC Strategy?
A GRC Strategy is a comprehensive approach that enables alignment with business objectives while managing risks and ensuring compliance. By implementing a GRC strategy, organizations can improve governance, mitigate risks, and achieve their goals.
Getting Back to the Basics: A Quick Look at GRC
According OCEG, "GRC is the integrated collection of capabilities that enable an organization to achieve principled performance." The three key aspects that constitute GRC are governance, risk assessment, and compliance, and together they enable the organization to achieve its objectives reliably.
Governance
Governance sets direction and strategy for your organization to achieve its objectives reliably. It also sets the context for risk management, helping you evaluate your progress against defined objectives. Your goals may be high-level, like financial performance or ESG, or they could be divisional, departmental, project-level, or asset-level.
Risk Assessment
This component is closely connected with the governance function because assessing risks and measuring uncertainty would only be possible after determining the objectives. The worldwide risk management standard ISO 31000 explains risk as the influence of uncertainty on objectives.
Generally, when faced with risks, organizations typically follow one of the four routes:
- Accept the risk
- Avoid the risk (if possible)
- Transfer the risk (through hedging, derivatives, and insurance)
- Mitigate the risk
After defining the inherent risk, we can implement specific controls and accept the residual risk.
Compliance
Effective risk management requires compliance and controls. Compliance is not purely complying with laws and regulations but also the organization's values, ESG commitments, and contractual commitments. In addition, it ensures that the defined controls are effectively implemented with adequate follow-through from risk assessment.
It’s clear that each of the three GRC components is interconnected. For example, while governance consistently establishes the direction and strategy for the organization to achieve its objectives and creates a context for risk management. The latter manages and understands uncertainty by identifying, assessing, and monitoring risks. Finally, compliance follows through on risk treatment plans, helping decide whether the risk should be managed within limits and whether the defined controls are operational.
Organizational GRC Readiness
Many organizations today still hesitate to classify their activities as GRC. However, the fact is that, irrespective of the terminology used, most organizations practice GRC to some extent. The maturity of the GRC model may, however, vary. Broadly speaking, the GRC maturity model can be understood in the following levels.
- First stage: This is an ad hoc firefighting stage, where the organization is merely reacting to risk.
- Second stage: At this stage, the organization may have a broad understanding of assessment and manage several documents, spreadsheets, and emails across departments. However, these processes need to be integrated.
- Third stage: This is a more mature stage with intra-departmental integration.
- Fourth stage: At this stage, the GRC process gets more proactive and involves more inter-departmental integration.
- Fifth stage: At this point, the organization is agile, proactive, and responsive and evaluates security and performance in terms of how they meet organizational objectives.
Though many organizations may still view the final stage as aspirational, achieving it is possible with a concrete, well-crafted plan.
A Five-Step Plan to Strengthen Your GRC Approach
#1 Define the objectives
The first step is to assess your organization's capabilities and determine where you stand with your overarching goals. If these goals are yet to be established, it would be prudent to do so. If you're already engaging in GRC-related activities, evaluate your strengths and shortcomings and identify gaps. Once you've determined the long-term vision for your GRC strategy, it is simpler to create a road map for guiding the organization toward this target.
#2 Get the right people on board
With the right risk management team, organizations can strengthen their GRC approach. They can identify and evaluate potential risks, establish policies and procedures to ensure compliance with relevant laws and regulations, implement controls and processes to monitor and manage risks, and develop concrete strategies that align with business objectives.
# 3 Implement the right technology
The right technology helps you monitor and manage risks on an ongoing basis with minimal oversight. Most risk management technologies can be classified under one of the following functions: risk assessment, risk analysis, risk monitoring, or risk mitigation. Together, they offer several benefits, such as reducing time and effort through automation, integrating systems to provide a comprehensive view of risks, offering insights through data analytics, and enabling better collaboration among team members.
#4 Improve continuously
The typical stages for GRC projects include planning, implementation, testing, deployment, monitoring, review, and improvement. While this is a good project management strategy, breaking up a big GRC project based on objectives would be better.
Like training for a marathon, we must systematically put systems and processes in place and progressively scale objectives. It also makes sense to quantify the value achieved at each stage before proceeding to the next step. These achievable and digestible stages help ensure the process is well-planned, effectively implemented, and continuously improved.
# 5 Prepare for change
The world is dynamic, and the threat landscape is constantly evolving. Organizations today must brave pandemics, wars, inflation, economic stress, strain, and recession. Understanding the ever-evolving nature of risks is critical because only then can organizations reach the aspirational stage to achieve agile and cognitive GRC.
The Future of GRC
We can expect to see a shift from the traditional, reactive approach to a proactive and strategic one. It will likely involve using advanced technologies, such as artificial intelligence and analytics, to enable real-time monitoring and decision-making. We can also expect a more significant integration of GRC activities across the organization.
Catch Michael Rasmussen's talk on developing robust GRC strategies. Watch the Video: Building the Best GRC Strategy.
Jump to Topic
Related Resources
Blogs
10 GRC Trends to Watch Out for in 2023
- GRC
- 17 January 23
1 min read
Introduction
For organizations, the past couple of years have been filled with challenges. Direct and indirect impacts from the COVID-19 pandemic, the continuing geopolitical crisis in Europe, and the threat of an economic downturn have led to major business disruptions, including supply chain issues, a fluctuating energy situation, talent shortage, and state-sponsored cyber attacks.
As organizations strive to build resilience and agility in an increasingly interconnected risk landscape, a robust governance, risk, and compliance (GRC) program serves as a vital foundation to successfully ride the waves of disruption. This makes it crucial for organizations to stay up-to-date with the latest GRC trends in order to maintain their competitive advantage.
At MetricStream, we are committed to helping you thrive on risk. Based on our conversations with customers and thought leaders and our own analysis of economic conditions, regulations, and various news events, here are our insights on the top GRC trends for 2023.
Stay Ahead with a ConnectedGRC Strategy
MetricStream’s ConnectedGRC products help you strategically manage risk in the interconnected risk landscape with an integrated and holistic approach to GRC. Designed with advanced analytics and AI capabilities at the core, it enables businesses to proactively identify, assess, manage, and mitigate various risks.
BusinessGRC connects across risk, audit, and compliance to bring insights that can be used to build resilience and as a strategic competitive advantage.
CyberGRC ensures active cyber risk and compliance management through improved visibility and a comprehensive IT and cyber risk and compliance framework aligned with recognized security standards.
ESGRC streamlines and automates ESG risk assessment, management, and monitoring across the enterprise and third-party ecosystem, while also simplifying ESG compliance and disclosures.
Interested to know more? Request a demo now.
Jump to Topic
Related Resources
Blogs
2022 Through the GRC Lens – A Year in Review
- GRC
- 05 January 23
6 min read
Introduction
2022 was a year of transformation and continued disruption. The COVID-19 pandemic showed signs of abating thanks to global vaccination drives. But the escalating geopolitical crisis in Europe had an impact that is still being felt across the world. 2022 saw continued loss of human life, geopolitical upheaval, supply chain disruptions, rising inflation, an enduring energy crisis, reduced business confidence, and even state-sponsored cyber attacks. Organizations across sectors are now operating in a highly uncertain business environment and a heightened risk landscape. From a GRC perspective, 2022 saw a sharper focus on a few key trends – operational resilience, cyber risk, and ESG.
Operational Resilience
In 2020, when the pandemic forced the world to go into lockdown, enterprises were forced to step up their operational resilience measures. Two years on, it is evident that merely protecting and preventing risk incidents is not enough, the enterprise must be resilient enough to recover from disruptive events and carry on with business as usual. According to the BCI’s Operational Resilience Report, 77. 9 percent of organizations already have or are developing their operational resilience strategy.
Strengthening operational resilience has also been a top regulatory priority in 2022. Both the U.S. Federal Reserve and the Hong Kong Monetary Authority reiterated that operational resilience would remain a supervisory priority for the foreseeable future given the disruptive risk landscape and its possible impact on businesses and national financial stability. The Australian Prudential Regulation Authority (APRA) announced a new prudential standard to fortify the management of operational risk in the banking, insurance, and superannuation industries. Singapore issued its Business Continuity Guidelines for financial institutions with a focus on operational resilience.
Regulators are focusing on measures to ensure operational resilience across the extended enterprise as well. In Europe, the EBA highlighted the importance of operational resilience for all banks that highlights cyber risk, as well as third-party risk.
The UK Prudential Regulatory Authority regulations SS1/21 and SS2/21 apply to not just banks, but even some investment firms, insurance companies, building societies, UK-recognized investment exchanges, electronic money institutions, and registered account information service providers. They also cover third-party vendors that these firms may be working with. The rules require organizations to identify critical services and prepare for disruptive events to ensure continuity and resilience. The British Standards Institution updated its British Standard on organizational resilience BS 65000:2022 Organizational Resilience – Code of Practice. This provides guidance on developing operational resilience against future threats.
The Global Resilience Federation’s (GRF) Business Resilience Council (BRF) issued the Operational Resilience Framework (ORF). This aligns with existing standards like NIST and ISO and aims to reduce operational risk and service disruptions while limiting the impact of threats and attacks.
Cyber Risk
54 percent of organizations have faced a cyberattack over the last year, and the global average cost of a data breach stands at an all-time high of USD 4.35 million. The situation is made worse by state-sponsored cyber attacks that have escalated in the wake of the war in Ukraine. In fact, according to the European Union Agency for Cybersecurity, the world is now witnessing a broader set of cyber attacks, ranging from zero-day attacks and hacktivist attacks to AI-powered disinformation campaigns and deep fakes.
2022 saw the cybersecurity industry and technology leaders of the world banding together to better address the heightened cyber risk landscape. A group of cybersecurity providers joined hands to launch the Operational Technology Cybersecurity Coalition which campaigns for company-agnostic, interoperable, and standards-based solutions and aims to work in partnership with key stakeholders to devise the best cybersecurity strategies. Another group of cybersecurity leaders launched an open-source project, called the Open Cybersecurity Schema Framework (OCSF), to facilitate faster detection and more effective prevention of cyberattacks.
Regulators are also working to protect organizations from rising cyber risks. In the US, the Securities and Exchange Commission sought to protect public companies with a set of amended rules on improving and standardizing disclosures on cyber risk management, governance, and incident reporting. Key security agencies including the CISA, NSA, and other international cyber authorities issued an advisory to protect managed service providers and their customers from cyber attacks. The Office of the Superintendent of Financial Institutions (OFSI) issued guideline B -13 that outlines the measures for federally regulated financial institutions to better manage technology and cyber risks. Banks now must report cybersecurity incidents to their primary federal regulator within 36 hours. This new tight deadline was announced amidst the government’s warning about the increased risk of state-sponsored cyber-attacks. And even the Senate passed a new bill to strengthen critical cybersecurity infrastructure.
In Europe, the focus is on collaborative and unified action to protect organizations and improve cyber resilience. The European Council Parliament adopted a new law to strengthen security and resilience across organizations. It aims to standardize security measures across the region as this is currently highly fragmented with regional variations that increase vulnerabilities. The European Systemic Risk Board (ESRB) issued recommendations on systemic cyber risks and a comprehensive European systemic cyber incident coordination framework. The recommendations were welcomed by three key European Supervisory Authorities – EBA, EIOPA, and ESMA. The European Council and European Parliament signed a provisional agreement to strengthen cybersecurity and resilience and the EU Digital Services Act also came into action this year to keep the internet safe. And in the UK, the Bank of England is working on new IT resilience rules for financial institutions.
ESG
Escalating climate change and a turbulent socio-cultural environment put the spotlight firmly on ESG. With the war in Ukraine and other geopolitical tensions, it is now evident that the organizations will continue to work in a highly fraught ESG risk environment for the next year. Consequently, today more than half of FTSE 100 companies have ESG Committees and 87 percent of business leaders intend to increase investment in sustainability over the next couple of years. The UK is demanding stringent climate stress tests for banks and insurers and global regulators are advocating external checks on bank climate data. Leading Canadian and American banks along with the Risk Management Association formed a consortium in 2022 to tackle climate risks, while European investors pushed for greater diversity on the boards of banks.
A number of new standards were announced across the world, including the Basel Climate Principles and the Climate Related Risk Management Principles by the US OCC. The Financial Stability Board issued supervisory and regulatory approaches to climate-related risks while the ISSB released a proposal to create a global standard of sustainability disclosures. The KBRA issued a framework for embedding ESG Risk Management in credit ratings.
In the US, the Biden administration reversed a Trump-era ruling to restore key elements of the National Environmental Policy Act that calls for federal scrutiny of the climate impacts of large infrastructure projects. The Federal Reserve proposed a plan for banks to manage financial risks related to climate change and the SEC proposed rules for standardized and improved climate disclosures for investors. And in a significant first step, the SEC charged a company for ESG fraud this year.
There was also increased focus on the issue of greenwashing. The European Financial Reporting Advisory Group (EFRAG) published a broad range of sustainability targets to combat greenwashing, and three European supervisory authorities announced a Call for Evidence on possible greenwashing practices within the EU financial sector. Meanwhile, the European Central Bank stepped up its pressure on banks to accelerate climate change-related activities. European banks are now required to make full climate-related disclosures as mandated by the EC. In the UK, the Bank of England conducted the second edition of the Biennial Exploratory Scenario on climate change-related financial risks, and the FCA announced that it was working on a Code of Conduct for providers of ESG data and ratings. And, Singapore issued a standardized format for corporate assessment of environmental risk.
As we step into 2023, parts of the world are witnessing a resurgence of COVID-19 while war rages on in Europe and the threat of an economic downturn looms large. Organizations will continue to operate in a heightened risk landscape in 2023. Regulations and standards will continue to evolve as the risk landscape changes, and there will be greater emphasis on mitigating the impact of a recession in addition to cybersecurity, ESG, and operational resilience.
Jump to Topic
Related Resources
Blogs
GRC Summit 2022: 5 Key GRC Predictions for 2023
- GRC
- 23 December 22
5 min read
Introduction
Blink and you’ve missed it. The MetricStream GRC Summit 2022 is over…and we’re still buzzing from the experience. This 2022 Summit was the 10-year anniversary of bringing together the GRC community. With 200+ risk, compliance, audit, and IT and cyber risk professionals from across the world participating in 40+ sessions, the event was a highlight for the GRC space.
Themed ‘Experience the Power of Connection’, the summit succeeded in bringing people together after two years of Covid disruptions to network, share experiences, learnings, and best practices among peers. We saw key topics such as Enterprise GRC, Integrated Risk Management, Operational Resilience, Regulatory Compliance, IT Risk, Cyber Risk, Security Risk, Third-Party Risk, and ESG discussed and debated.
I’ve wrapped up the top sessions and key themes below. Have a read and watch the videos as we get ready to welcome you at the next GRC Summit in the US!
GRC Journey Awards
We continued to celebrate the success of our customers with the GRC Journey Awards. The awards recognized our customers and partners - individuals and teams - who are leading their organizations’ GRC journey, championing GRC programs, and achieving superior business performance and high-value impact through GRC.
- GRC Program Excellence Awards: Nordea, London Stock Exchange Group, and Shell won GRC Program Excellence Awards for their clear, connected GRC vision, which facilitates collaboration across multiple lines of defense and a high focus on innovation. They have also displayed how their program makes a significant impact on their business and are active in addressing emerging issues in GRC.
- GRC Journey Awards: Thomson Reuters won the GRC Journey Awards as they have made exceptional progress along their GRC Journey, and achieved an integrated, high-value, and sustainable GRC program.
- GRC Visionary Awards: Robert Taylor, Head of Enterprise Risk, LSEG (London Stock Exchange Group), Adam Ennamli, Vice President Risk Management, Thomson Reuters, Simon Wallis, Head of Operational Risk, M&G, Neil Wilson, Director of Risk and Investment, Wessex Water, Jane Knight, Executive Director Risk Change, Group Compliance, Regulatory & Governance (GCRG) UBS won the GRC Visionary Awards for the passion for GRC, a strong vision for their organization’s GRC Journey, and the perseverance to see it through. They are the driving force behind the GRC programs in their organizations, inspiring their teams to achieve a common goal. They also give back to the industry by sharing their experiences and best practices.
- GRC Practice Leader Awards: Sarah Harman, Leader ERMF & Risk Systems- Nationwide Building Society, Richard Rengasamy, Director, Thomson Reuters, Vivek Singh, Risk Systems Director, LSEG (London Stock Exchange Group) won GRC Practice Leader Awards for their passion and drive in the adoption of GRC programs across their organizations. Backed by deep expertise in GRC, these leaders understand their organization’s GRC vision, and lead its implementation.
Listen to this year’s winners describe their GRC journey here.
Customer Advisory Councils
During the summit, we also hosted Customer Advisory Council (CAC) meetings. The council members—CROs, Heads of Risk, Senior Risk and Technology professionals, Chief Security Officers, and Heads of Cyber Risk—provided inputs in terms of where the market is headed, their priorities, and what they would like to see in the product. The discussions helped create an initial ‘market standard’ framework and an automation architecture that will serve as an excellent reference point for organizations.
5 Key Trends for 2023
1. Manage Interconnected Risks by Building Operational Resilience
Gaurav Kapoor, Co-CEO, Co-Founder, MetricStream, Jacob Holmehave, Head of Group Risk Office, Nordea, Gavin A. Grounds, Senior Director Governance, Risk and Compliance, Meta, and Xavier Barde, Group Chief Risk Officer, Pictet, discussed the criticality of managing interconnected risks and regulations in a rapidly evolving macro landscape.
The importance of adopting an integrated and connected risk management approach to manage both current and emerging risks can’t be stressed enough. To build resilience, organizations will need to take important steps such as proactively practicing risk management utilizing horizon scanning, amplifying the focus on not just risks but other aspects of GRC as well, actively reducing the likelihood of risks occurring, ensuring a consolidated process view, moving ahead with risk quantification although there is currently no market-adopted standard, and ensuring that the right data sets are available for coherence in risk management.
Learn more by watching this session: Connecting the Dots: Managing Interconnected Risks and Regulations in a Rapidly Evolving Macro Landscape
2. Blend Technology and People Together for Optimal GRC Efficiency
Jacqui McDonald, Managing Director – CIO Group Finance, RFT Technology, Barclays, Roshan Shetty, Chief Revenue Officer, Sonata Software, David Ward, Corporate Functions Technology Director, CITO, M&G Plc, Joy Bhowmick, Head of Research and Development, MetricStream discussed the role in utilizing technology the right way to accelerate GRC programs.
It’s clear that enterprises need to look at GRC holistically not in isolation. Technology can and will evolve processes, but it’s also important to get alignment across the business to support GRC programs. Looking beyond the management of tasks we’re seeing that regulation and society require both human and technological risks to be brought together into one view. They do not sit alone. Data drives quality decisions and organizations are wanting to have more data-driven risk management.
Gain deeper insights into the topic by watching this session: Utilizing Technology the Right Way to Accelerate Your GRC Program
3. You Cannot Spend Your Way Out of Cyber Risk
Joseph Martinez, Chief Security Officer, Aon, addressed the challenge of how to keep up with the constantly evolving enterprise and cyber risk environment and how the management of controls should not only be efficient but also effective. He also discussed in detail on the best practices and standards that will organisations to look at GRC and cyber risk holistically ensuring that their processes are effective.
Hear more on how Aon successfully manages their enterprise and cyber risk: Best Practices for Modernizing Enterprise and Cyber Risk Management
4. Advancements in AI and Automation Enable GRC Professionals to Work Smarter, Not Harder
Prasad Sabbineni, Co-CEO, MetricStream, along with Joy Bhowmick, Head of Research and Development, MetricStream and Raghuram Srinivas, SVP Product Management, MS Innovations, MetricStream, spoke in length on how technologies such as AI, ML, and natural language processing (NLP) are transforming the efficiency of GRC processes by simplifying the management of massive volumes of data and expediting decision-making. They also discussed the importance of establishing a positive risk-aware culture and how the right technology can equip the three lines to establish a common language while achieving transparency on the risk and controls.
Learn more by watching this session: Incorporating Risk Quantification, AI and Automation into Your CyberGRC Strategy
Interested to Know More?
You can watch the rest of the summit videos here.
You can also request a demo to gain greater insight into how your organization can leverage risk-informed decisions to accelerate business performance.
Jump to Topic
Related Resources
Blogs
Experience the Power of Connection
- GRC
- 14 December 22
3 min read
Introduction
It feels great to get back on the road and travel to see customers face to face. I have logged more than a hundred thousand miles and visited more than ten countries in the past three months. With all the technological advancements in the world, the inherent value of being face to face with customers is immeasurable. Trust me when I say, if you are not back in the office you may have forgotten what you are missing. The collaboration and productiveness alone are worth it. Even more, when people come together, they start to share ideas and cast a vision for the future.
We recently held two Customer Advisory Councils during the GRC Summit in London. The Councils were attended by CROs, heads of risk, senior risk, and technology professionals from several global financial institutions, energy, telecommunications, and technology companies from around the world.
I walked away with a healthy optimism and a view of the many things we are doing well and a few we can do better. What was clearest throughout my conversations is the vision we have for MetricStream resonates with our customers and that ConnectedGRC is not just a concept, it's a critical aspect of our customers' GRC strategy and the lens that every CXO should be using when considering risk.
What Does a ConnectedGRC Strategy Mean?
It's simple. A ConnectedGRC strategy empowers organizations to pursue an integrated approach to GRC and ensure collaboration between risk, compliance, audit, cybersecurity, and sustainability teams. It enables businesses to better identify, assess, manage, and mitigate strategic risks whether operational risks, IT and cyber risks, third-party risks, or ESG.
Critical to the pursuit of a Connected strategy are simplicity, automation, and predictive capabilities. These are the three core innovation areas where we are focused: Continuous, Cognitive, and Cloud.
With rapid regulatory changes and market conditions, workflow and sample-based assessments are no longer enough. Customers need real-time continuous assessments that are hyper-automated. They also need the ability to access the full population of data, rather than a sample, from various data sources. Recent advancements in Continuous Control Monitoring are making this possible.
Over the years organizations have collected vast amounts of data across risk, audit, and compliance programs. Cognitive capabilities including AI-centric workflows enable predictive and prescriptive capabilities. That means having a deeper understanding of emerging risks, the real cost of compliance violations, and monetary impact so that they can prioritize investments and resources.
Cloud is no longer about hosting in the cloud or cloud-native architecture. As businesses demand high performance and faster turnaround, low-code/no-code GRC platforms are the future. Without an army of high-skilled programmers, organizations can create and configure GRC applications with hyper-automated workflows and connected insights. The result is applications that are 10X faster, easier, and more secure. The cloud is the catalyst for radical changes in the way GRC application development, maintenance, and upgrades are implemented.
Empowering Risk Professionals is Critical to Achieve Success
This is all great but critical to long-term success is the need to empower risk professionals. As the business environment intensifies across all aspects of risk, risk professionals are being faced with an unprecedented level of pressure. Innovation can bring us only so far. There is great strength in banding together as a profession to bring about positive change and clarity of focus. This is precisely what we did at the recently held GRC Summit and will continue to do in the future as well– Experience the Power of Connection. We bring together global experts to share insights, and best practices and learn from each other but most of all use the time to problem solve and gain focus and clarity about the future of GRC.
I have been in this industry for more than 20 years, and what has been constant is the need to remain agile and flexible to change. If you think about it, it's probably the single most important attribute of a risk professional. But, today, with a ConnectedGRC lens you can not only remain agile and flexible, but you can add a predictive and proactive nature to your profile.
Jump to Topic
Related Resources
Blogs
GRC News Digest November 2022 – Top Stories in Governance, Risk, and Compliance
- GRC
- 01 December 22
8 min read
Introduction
Strengthening operational resilience, enhancing self-reporting and disclosure mechanisms, seeking greater fourth-party verification, and a renewed focus on the G in ESG made it to the top GRC news stories in the month of November 2022. In the background, the magnitude, velocity, and complexity of risks continued to evolve. Ransomware still remains the top cyber risk confronting companies today, with third-party risks and automated threats also becoming an important cause for concern. In addition, the Ukraine crisis has heightened concerns about full-scale cyber warfare, with the Gartner 2023 Annual Audit Plan Hot Spots Report warning against "new geopolitical conflicts and the heightened prospect of state-sponsored attacks."
At the recently held MetricStream GRC Summit 2022 in London—our 10th anniversary event— we saw GRC thought leaders, visionaries, and industry experts highlight the most significant trends and best practices in GRC, compliance, cyber risk, and environmental, social, and governance (ESG). Here are three top insights identified by our leaders.
“It’s time to reimagine what’s possible in GRC and pivot from uncertainty to clarity and focus.” Gaurav Kapoor, Co-CEO and Co-Founder, MetricStream
“Enterprises need to look at GRC holistically and not in isolation.” Prasad Sabbineni, Co-CEO and Chief Technology Officer, MetricStream
“Talent risk is a top threat to the enterprises—ahead of many other risks.” Gunjan Sinha, Co-Founder and Executive Chairman.
What other challenges must GRC practitioners be aware of, and what are some emerging best practices in the industry? Scroll down to read our monthly roundup.
In the World of Enterprise and Operational Risk, Regulation, and Resilience
Operational resilience has emerged as a global and industry-wide priority. The Operational Resilience Framework (ORF), along with NIST and ISO, has been developed by the Business Resilience Council after nearly a year of consultation. It ensures critical services run during a crisis. In KPMG's first UK Regulatory Barometer, operational resilience ranked in joint third place, alongside ‘Regulating digital finance’ and behind ‘Maintaining financial resilience’ and the top regulatory theme was ‘Delivering ESG and sustainable finance.’ The Federal Reserve also emphasized the need for a supervisory approach to operational resilience at the US Senate Committee on Banking, Housing, and Urban Affairs.
- The McKinsey Global Institute released its discussion paper ‘Global flows: The ties that bind in an interconnected world,’ which offers a view of the flows driving global integration, an assessment of interdependency and concentration risks, and the vital role of multinational corporations. The study is the result of studying over 30 global value chains and about 6,000 globally traded products.
- Disclosure has emerged as a key theme, with the Financial Reporting Council (FRC) finding that more than half of FTSE 350 companies provided limited insight into their corporate governance and reporting in line with the UK Corporate Governance Code. For example, a treated wood and chemicals distributor in the US was asked to pay $1.3 million to the Securities and Exchange Commission (SEC) for its disclosure failures. Businesses take varying approaches when self-reporting to regulatory agencies, which can lead to differing results regarding cooperation credit.
- A panel discussion on compliance readiness for 2023 and beyond was held at Compliance Week Europe in Edinburgh, Scotland. The discussion centered around dealing with risks relating to artificial intelligence (AI); diversity, equity, and inclusion (DEI); and shortfalls in staff, training, and expertise.
- The International Data Corporation (IDC) has published its Future of Connectedness predictions for 2023 and beyond. It highlights how hybrid work and distributed workforces have necessitated seamless anytime, anywhere digital interactions, prioritized connectivity programs, and increased investments in connectedness.
- Despite geopolitical threats, high inflation, and poor economic growth, global security partnerships, financial integration, supply chain resilience, and migration will remain top priorities according to the '2023 Economics & Country Risk Outlook' Report.
- Risk management is a recurring concern globally, with experts agreeing that it cannot be a static, one-time task. According to Healix's Risk Outlook 2023 Report, the energy crisis, political polarization, cyber risks, and global extremism could be the top risks for 2023. Further, the Federal Reserve Bank of New York has clarified the common misunderstandings that often derail risk management efforts.
- Financial service providers have always been at the forefront of adopting cybersecurity measures. A recent paper, Corporate Governance Principles for Banks, notes how the increased regulatory scrutiny on compliance requires compliance officers to step up within their companies. Three key pieces of legislation will heavily impact the financial sector in the EU. The APRA’s risk culture survey calls for a continued focus on improving risk management practices and behaviors.
In the World of Cyber GRC
As the world races toward greater digitalization, organizations are likely to be more vulnerable to cyberattacks. Since 2019, three of four large firms have been impacted by some form of cyberattack. Ransomware remains the top cyber risk, but automated threats are becoming increasingly common, especially among e-commerce players.
Organizations are seeking ways to fight back. In the EU, financial firms have been pushing for standardized cybersecurity laws. The rules empowering EU countries to meet stricter supervisory and enforcement measures and harmonize their sanctions were approved by MEPs. Introducing cyber insurance, building a national cybersecurity strategy, and boosting cyber resilience can help combat the dangers of the dynamic threat landscape.
- The Cybersecurity and Infrastructure Security Agency (CISA) outlined three areas of focus for improvement. First, its guide for categorizing vulnerabilities by stakeholders seeks to automate mitigation by making the data about vulnerabilities machine-readable. It has also released cybersecurity performance goals to reduce the risk and impact of adversarial threats.
- Cyberthreats and IT governance are top risk areas for internal auditors to address in their audit plans for 2023, according to Gartner’s 2023 Audit Plan Hot Spots Report. The ten worst cybersecurity threats until 2030 were identified and ranked by ENISA (the European Union Agency for Cybersecurity) after an eight-month foresight study.
- To mitigate the cybersecurity concerns of various stakeholders, The National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence (ODNI) released a set of guidelines.
- Financial institutions are frequently the target of numerous attacks. As a result, the New York Department of Financial Services (NYDFS) has proposed several changes to its cybersecurity regulations and requested the public to provide recommendations. The new regulations will strengthen the threat landscape as cyber regulatory pressures continue to mount for banks.
- The Dobbs decision, the risk from third parties, and the increasing interconnectedness of healthcare are some of the biggest HIPAA compliance challenges today. Poor cybersecurity initiatives could result in complete blacklisting. As of September, third-party vendors were responsible for seven of the ten most significant healthcare data breaches disclosed to OCR this year.
- The role of cybersecurity staff and their contribution to the overall culture of the cybersecurity industry was the highlight of Forrester’s APAC predictions for 2023.
- As the digital landscape becomes increasingly complex, so are vendor relationships. While many organizations are still dealing with third-party risk, the discussion is shifting to address fourth-party risk
In the World of ESG Regulations and Risks
Reporting and disclosure are vital to keeping abreast of evolving ESG trends and building climate resilience. Across the world, companies face pressure to incorporate Environmental, Social, and Governance (ESG) measures into their core business strategies, take accountability for public statements, and follow concerted ESG initiatives.
The EBRD put out its third annual report based on the framework for voluntary reporting set up by the Task Force on Climate-Related Financial Disclosures (TCFD). TCFD reporting can deliver significant business benefits beyond compliance. As disclosure standards become more comprehensive and consistent, companies will have a solid base from which to measure their ESG impacts and outcomes and compare themselves to their peers.
However, while transparency in the ESG journey has been steadily increasing, the EY Global Corporate Reporting and Institutional Investor Survey found a significant reporting disconnect with investors on ESG disclosures. Stakeholders pointed out that their expectations for transparency still needed to be met.
- A Gartner survey found that customers’ pressure encourages organizations to increase their sustainability investments, and over 87% will increase their investment over the next two years.
- According to Forrester, environmental sustainability presents both an opportunity and risk and will become a strategic imperative that ushers in a green market revolution. The US has issued a draft of the Fifth National Climate Assessment, a tool that shows climate and sustainability progress and provides risk management decision-makers with the latest information.
- According to Deloitte’s 2022 Global Third-Party Risk Management Survey, the extended enterprise lacks a formal mechanism to manage and prioritize ESG issues properly. Organizations must also work on reducing emissions by prioritizing supply chain sustainability. In the infrastructure sector, suppliers need to provide different levels of disclosure for reporting compliance based on whether they are beginners, intermediates, or leaders.
- ESG encompasses the environmental, social, and governance aspects; all three elements need equal attention, but according to the Harvard Business Review, governance, in particular, is getting shortchanged. There is also a question of whether cybersecurity does not deserve its identity in the ESG framework.
- The financial sector has been making special efforts with its ESG initiatives. According to a new World Bank Group report, investing 1.4% of the annual GDP would reduce emissions by 70% by 2050 and boost resilience in developing countries. The European Central Bank is pushing banks to speed up climate change work. The Dubai Financial Services Authority’s (DFSA) Task Force on Sustainable Finance (TFSF) issued a Climate and Environmental Risk Management publication to kickstart an open dialogue on sustainability within the UAE. Insurers, too, are committing to integrating ESG into their operational and investment choices to reduce their carbon footprint and achieve net zero.
- To avoid a "ruin scenario," firms must plan for low-likelihood, high-severity risks and adjust faster, according to an Institute and Faculty of Actuaries (IFoA) report with the Climate Crisis Advisory Group (CCAG).
- Nearly 70% of more than 500 global corporations report higher-than-expected financial returns on climate initiatives, proving that pro-climate actions do not impact profitability.
What’s Next @MetricStream
Don’t forget to register for the following webinars:
- MetricStream Partner Forum Glimpse of Euphrates: Day in the Life of a Partner Developer, Part II Dec 01, 2022 7.30 pm PST | 03:30 pm GMT
- A UK and European Roadmap to Compliance and Regulation Dec 15, 2022 3.00 pm UK Time | 4:00 am CET
Missing out on top GRC stories? Subscribe to our blog and newsletter.
Jump to Topic
Related Resources
Blogs
MDOS: Enabling Resilient GRC for Dynamic Enterprises
- GRC
- 24 November 22
4 min read
Introduction
In today’s digital-first world, companies continuously organize and reorganize via corporate divestiture, diversification, merger, or acquisition to gain efficiencies and market share. Re-structuring, changes to roles and responsibilities, updates to project teams, addition of third parties, and more happen continuously. As the organization evolves and changes its footprint, its internal structure becomes increasingly complex with multiple layers of hierarchy. These hierarchies could span across business units, business functions, geographical locations, legal entities, and similar dimensions.
In a multi-hierarchical organization, it is critical to maintain continuous visibility into the risks and compliance functions at the granular level during and after the transition. While each of the underlying dimensions can be viewed independently, it is critical to understand their points of intersections, interdependencies, and interplays. As the organization restructures, it is important to not forget the impact of these changes on the risk and compliance aspects.
A robust GRC process should be able to function with these multi-hierarchical structures:
- Risk teams, business management, and business functions should be able to view and manage risks across the enterprise, i.e., have visibility into the risk data sliced by business, region, risk category, or global function
- Business functions should be able to report risks across locations, regions, and businesses
- Business units should be able to manage risk and perform compliance checks across the locations they operate in
- Regions should be able to manage risk and carry out compliance activities across the businesses operating within their region
An organization model such as the Single Dimensional Organization Structure (SDOS) falls short of meeting these requirements that arise in a dynamic hierarchical organization. SDOS typically supports a relatively flat structure with little access to the granular data and cannot adapt to the dynamic changes. Clearly, it is time for a complete redesign of the compliance modeling from grounds-up.
Enter the Dynamic MDOS
Realizing the growing needs of a complex multi-hierarchical organization, MetricStream built MDOS - Multi-Dimensional Organization Structure (patented), capability in their industry-leading MetricStream Platform. This innovative functionality supports multifarious organizational structures with a flexible data model that supports up to six dimensions. Using MDOS, enterprises now have the ability to set up several multi-hierarchy configurations that map directly to their real-world hierarchical structures. Each of these multi-hierarchy structures can now be treated as a dimension of the overall organizational makeup.
These dimensions are fully configurable: users can decide what dimensions they want to include depending on their needs.
Given an enterprise, a user can map up to six dimensions (or attributes) like company, legal entity, business function, location, line of defense, restrictions, language, or any other. Each dimension can be linked to the organization’s single source of data.
For example, a company “ABC” with operations across say Europe, can select function, location, and legal entity as the dimensions. Now the user will be able to select any combination of the three to view the relevant details, for instance, the compliance function in Germany for its subsidiary, the “XYZ” legal entity.
The MDOS framework also allows consolidating various similar but siloed functions under one common corporate unit. As an example, a business conglomerate owns, say eight different companies, with each company having its own HR department. For one HR function, navigation of eight different organizational units would be required. With MDOS, all HR units can be consolidated into a single HR entity under a common corporate functional unit without any loss of granularity. Clearly, this drastically reduces the complexity and makes compliance monitoring simpler.
MDOS enables:
- Managing complex organizational structure
MDOS helps reduce the number of nodes in the organizational hierarchy by eliminating duplication without sacrificing the details. The platform ensures completeness and avoids issues due to the lack of mutual exclusivity in the current structure
- Selecting values from any combination of the dimensions
Users have the flexibility of selecting values from any combination of dimensions in a unified single screen. This helps in accurately gauging the organizational risk profile and performing the risk assessments for a specific dimension. This functionality is key to creating customized reports for actionable insights
- Visibility into the hierarchical structure
The framework provides a hierarchical visualization of the organization structure to the users. It also gives the users the ability to search on each dimension instead of an expensive ‘contains’ search.
- Setting granular privileges for the business needs
In this framework, users are mapped to an MDOS Organization Role combination, and access is driven based on this mapping.
MetricStream has recently secured patent rights for MDOS. It is the only GRC platform capable of modeling complex, multi-dimensional organizational structures. This facilitates setting up specific and targeted risk response and restrictions across the enterprise.
MDOS assists companies in rapidly re-tooling their GRC solution in response to an organizational change, thus minimizing downtime and preserving visibility into risk and compliance functions. The framework also provides useful add-ons like MDOS widget, granular access control mechanisms, Universal Search with MDOS based security.
As an example, a large financial institution in North America with more than 300 decentralized organizations across eight geographical regions recently deployed the MetricStream Platform supported by the MDOS capability. With the implementation, the company went from the previous 310 organizational units to a rationalized structure with 113 organizational units and saw a 30 percent improvement in reporting and analytics for legal entities and a lower overall cost of ownership.
“Change is constant in the business environment and systems need to ebb and flow with major organization changes or organizations will be left vulnerable in transition.”
- Vidyadhar Phalke, Chief Technology Evangelist, MetricStream
Jump to Topic
Related Resources
Blogs
Enhancing Business Agility and Accelerating GRC with Low-Code/No-Code Configurations
- GRC
- 17 November 22
3 min read
Introduction
Today, organizations are highly dependent on software solutions to address specific business challenges. With regard to the management of governance, risk management, and compliance (GRC) processes, there are a number of GRC solution providers in the market today.
The software implementation part of the GRC program could span multiple months based on the complexity of the requirements for each department involved in the program. Some of these changes could involve extensive customizations to the software to make it suit the specific needs, which brings with it the cost of expensive upgrades and maintenance. Organizations are usually recommended to stick to the standard out-of-the-box offering in order to keep these costs low. There is effectively a trade-off between running an efficient GRC program and dealing with the small nuances that are needed in the software to make the GRC adoption easier.
One way to get around this problem is to adopt a platform that contains the GRC best practices embedded into the software along with the flexibility to make configuration changes or extensions easy to implement and maintain on an ongoing basis. A low-code/no-code platform is one that provides a wide array of tools to configure and extend the product’s functionality and enable the customer to adapt the product to their specific needs.
The Need for This Change
Agility has been a key requirement for all enterprises to be able to adapt to the rapidly changing business, regulatory, and security landscapes. Traditional approaches to software and service delivery are no longer enough to keep up with these ever-changing needs. The need for agility has also forced many organizations to adopt cloud and SaaS in order to be nimbler in their responses. SaaS software usually comes with a predefined set of features and offers an inflexible model to cater to an enterprise’s unique needs. One way of dealing with this was to engage the software vendor’s service teams to tweak the software to the specific needs and requirements.
Customization of the software involves additional costs in terms of making the changes, testing, deployment, and maintenance of the software. There is a huge dependency introduced on the availability of technically competent personnel either from the software vendor, or a partner or training in-house resources to maintain the software. Customizations also introduce complexity when upgrading the software to future versions, and most enterprises postpone these upgrades because of the time, effort, and cost involved, which leaves them behind in terms of adopting the latest innovations and features.
If the software has built-in configurability options along with a simple-to-use set of tools, with a reduced learning curve for the implementation team, this can expedite the app delivery and reduce the dependency on expert developers to make the changes required to the software. Low-Code/No-Code cuts total IT expenses while increasing productivity and efficiency due to the increased degree of automation reached.
In addition to the faster implementation times, Low-Code/No-Code tools also bring efficiencies in upgrading the software with minimal effort, enabling customers to adopt upgrades to the software more frequently and stay current with the changing trends.
MetricStream’s Low-Code/No-Code Capabilities
MetricStream’s recent Euphrates release brings out key features to enable customers easily configure our products using a low-code Domain Specific Language (DSL) to define and create business rules. This helps customers in faster adoption of the platform and products while supporting them to modify the products with minimum or no customization thus reducing the implantation cost and time significantly. The configurations and extensions are maintained in a separate layer enabling customers to adopt subsequent upgrades to the product more quickly without extensive upgrade effort.
For MetricStream’s implementation partners and customers with in-house delivery teams, this release promises a faster learning curve while empowering them to configure and extend the products to suit their specific needs. The Low-code DSL approach to defining business rules significantly brings down the need for learning niche languages like PLSQL or Javascript.
Low-Code/No-Code in conjunction with upgrade safety is a key differentiating factor, a new frontier in digital transformation for customers.
To learn more about MetricStream’s Euphrates release, click here.
Jump to Topic
