Governance, risk management and compliance, or GRC, can help organisations address risk and compliance, which are growing increasingly complex, in an increasingly regulated environment. Governance is the framework and policies of the company, applied towards achieving its business objectives. Good governance includes ethics and accountability, transparency of documentation and reporting, and sound resource management. Risks challenge organisations on a daily basis; addressing it effectively minimises potential and actual losses and shores up value. Compliance means following internally and externally administered rules and regulations, in the jurisdictions where the business operates.
Separate tools, including advanced technology, may be applied to manage each of these components but an integrated solution works best, allowing firms to optimise their resources to maximise the benefits that the GRC approach offers. Advantages of this include reduced compliance costs while being able to maximise opportunities. The terminology associated with GRC is not new; the separate components have existed for a while but GRC generally refers to the approach that integrates all processes concerned into one solution, allowing the organisation to develop a complete, holistic view of its business management, while it monitors and manages all aspects simultaneously.
This helps the organisation effectively identify and evaluate risks, and comply with the standards and regulations which apply at that point, while maintaining transparent, efficient management. Viewing transparency, accountability and integrity simultaneously supports the development of a culture of business integrity and ethical values, and enables more robust Board oversight. Research has shown that organisations with effective GRC oversight tend to score highly in terms of business performance and sustainability, and generally invest with the intention of creating long-term value, rather than immediate gains.
They are also more in tune with stakeholder interests, and inclined to adopt Climate Change and Principle-based Taxonomy (CCPT) practices. The Board plays a pivotal role in driving GRC and CCPT practices in the organisation, as the adoption of these is policy-based, and spurred by the tone from the top. The CCPT is a framework that facilitates robust and consistent climate change related assessments of economic activities, and how these impact on the environment and sustainability. It helps entities categorise their economic activities and assess the extent of the negative impact these may have on the environment.
Effective application of GRC requires coordination and cross-functional collaboration of the organisation’s various levels, including the different departments and business units as well as subsidiaries abroad. This involves the identification of stakeholders, and seeking their cooperation to work together to ensure business continuity and organisational sustainability. A major challenge faced by GRC is the silo environment experienced in many companies which could lead to a general reluctance to share information. This could stifle the effective application of the GRC framework, particularly as it requires an in-depth understanding of company policies and processes.
Knowledge of company policies, processes – and culture – ensures that organisational objectives are defined and fine-tuned, and workflow structures are designed for optimum efficacy. The danger of siloes in organisations is that they contribute towards unproductivity and could stunt growth. Staff could resist improvements to the company and their own performance in the mistaken belief that working independently is better than sharing information or collaborating. They may not realise their role in the organisation’s strategy and how they could be more effective in their jobs through more openness and cooperation.
Companies today need to boost conventional risk management and regulatory compliance methods in an increasingly dynamic environment. They need to keep up with regulatory compliance, for instance, which is constantly changing. They need to protect themselves and their stakeholders from negative incidents like data theft, hacking, and cybersecurity breaches. Additionally, they need to work with third parties, which increases their risks and could make their operations more complex. They also have to deal with the rising costs of doing business securely. These multiple challenges can affect their profitability, reputation and stakeholder confidence.
Some firms may decide to use GRC tools in their efforts to be more effective and efficient, including governance, risk management and compliance software but implementing integrated GRC solutions is about establishing a people-centric approach, and ensuring that the right people receive the right information at the right time, that will enable them to make the correct decisions which may affect thousands. Besides enabling correct decision-making, implementing GRC in the organisation also improves efficiency and reduces duplication of effort. It helps the company stay abreast of applicable regulations and standards, reducing the risk of fines, sanctions and penalties.
Organisations which want to align themselves more closely with Environmental, Social and Governance (ESG) principles especially, may want to combine the benefits of GRC and CCPT frameworks. GRC helps in the identification and evaluation of risks and compliance with standards and regulations; CCPT facilitates the assessment of a firm’s economic activities, and clarifies how these create an impact on the environment, and ultimately, the firm’s sustainability. Taken together, they give an accurate picture of the position of the company, point out where it should improve, and document information accurately so that activities can be measured and monitored.
Today, more than ever before, companies are faced with risks that are as diverse as the companies themselves, which can arise from anywhere – financial uncertainty, technology, legal and regulatory requirements, policy, strategy, workplace accidents, management error, or natural disasters. Stakeholders are demanding more of organisations in the way they operate, insisting on more accountability, transparency, and integrity. The focus is on ethics and doing the right thing; the onus is on the Board. Solutions using GRC and CCPT frameworks are likely to support greater organisational efficiency, improve decision-making and regulatory compliance, for sustainability and competitiveness.
