In this in-depth Governance, Risk and Compliance (GRC) report
- Intro: Pulling it all together
- Is GRC software the right choice for your company?
- What's next for GRC
"When a bad process is automated, it just increases the efficiency with which that bad process happens," says McClean. "Risk professionals still need to create a framework for how risk is measured, who is involved, what processes are required and what decisions will be affected by these efforts. Then they can use technology to standardize these efforts and pull together information from a lot of different areas to improve oversight."
Bodies such as auditors, regulators and risk committees "more and more are concerned with the processes of risk and compliance as opposed to just the outcomes of those efforts," McClean says.
"For example, they're looking at how an organization is able to identify, measure and mitigate risks, with less concern for what those risks are."
One noteworthy trend Proctor sees coming in the market is a consolidation of GRC tools within organizations, tied in with a new approach to how some in the industry are viewing IT GRC and EGRC tools. The products have generally been treated as separate entities, but firms such as Gartner are beginning to rethink whether IT and enterprise GRC are in fact separate markets. Proctor says IT GRC software, which has traditionally focused on gathering IT-related data, has garnered a much smaller market than EGRC software and is just another aspect of what EGRC is all about. When CSOs are exploring capabilities for GRC, he says, they should consider whether they need a separate tool for IT GRC.
Some of the enterprises that are using GRC tools are running multiple versions because different departments and business units bought different tools--each with their own strengths--based on the needs of the individual department. Proctor says this approach misses the point of GRC software, which is to provide a singular view of governance, risk and compliance within the organization. "If everyone buys their own tool then they're only getting automation for their own processes or department," he says.
"Some organizations have as many as five of these tools, and in organizations where that happens they have no central oversight of this."
Rather than allowing multiple purchases of GRC software, or looking for GRC tools designed specifically for areas such as IT, Proctor says companies should aim to deploy multipurpose EGRC software that has strong IT functions and that can be used throughout the enterprise.
"We believe the EGRC tools are becoming more like ERP [enterprise resource planning] systems: big, overarching systems that help guide overall processes but have different modules that might be loosely connected," Proctor says. These modules cover areas such as technology, finance and risk management. (Read more about enterprise risk management.)
GRC technology implementations are taking more of a platform approach, says Forrester's McClean. "Organizations are still primarily looking for solutions to a few of their most pressing risk and compliance issues, but it's just as important to license technology that is flexible to address a wider range of requirements," he says.
"[That] may include building their own applications on top of the core capabilities of GRC platforms," for content management, workflow, relational database and reporting.
Proctor suggests that organizations adopting GRC software treat the various components that make up governance, risk and compliance as if they're interrelated. It's a strategy that hasn't typically been deployed at companies, and it's a different way of understanding the value proposition of GRC.
"When I describe this to a client, I usually say if you break GRC down, governance is how you make decisions, risk is how you prioritize your decisions based on how risky something is and compliance is how you address various mandates, be they external or internal," Proctor says.
"What GRC is really about is those three things actually tightly rolled up."
In the past, those functions usually were siloed and barely crossed paths, Proctor says. "Now organizations have figured out that those things are actually combined, so they need a repository in order to make decisions," he says. "They need some workflow capabilities and they need some data gathering function."
What new functionality will GRC products offer in the future? "Analytical capabilities are going to be increasingly important for GRC," McClean says.
"This includes more/better aggregation of risk and compliance data from other systems, and better analysis of that data, such as trending, forecasting and scenario analysis."
McClean predicts that other technical advancements will include mobile device support for tasks such as assessments, training and reports; better collaboration capabilities; and greater flexibility of delivery models such as software-as-a-service (SaaS) and other hosted services.
Vendors describing their product directions promise growth in a number of areas:
- better process connections between security, IT and business operations;
- integration of an ever-broadening array of applications and data sources;
- advances in the sophistication of quantifying and comparing different risks;
- and the ability to measure and improve the effectiveness and efficiency of business processes.
This last point is in some lights the Holy Grail of security tools. Determining the return on investment for risk management is a notoriously slippery problem. It's easier to sell a program of measurable operational improvements that also happens to offer security and risk management benefits.
This story, "GRC: trying to take the bite out of risk" was originally published by CSO.