The negative effect of excessive scrutiny is another objection to increased
monitoring of the sort that comes with an integrated approach to CPM and
GRC. Some companies argue that they don’t want to make employees feel
that Big Brother is watching them as they pursue their activities. Although
it may be true that expressing distrust of employees can be damaging to
morale, collecting more information doesn’t have to be negative. Expressing
clear KPIs and KRIs along with targets for performance can provide employ-
ees with a sense of relief because they have clear guidance about what is
expected of them.
Instrumenting the enterprise............................................................
Perhaps the best way to understand the convergence of CPM and GRC is
to step back and take an abstract view. The goal of both CPM and GRC is to
monitor other activities and then provide information to help improve their
effectiveness, efficiency, and form. Both CPM and GRC collect data that sum-
marizes the activity of the business processes of the enterprise. To a large
extent, CPM is looking to quantify certain activities (How much revenue? How
much expense? How efficient was a process?). GRC is frequently looking to
see that certain activities took place (Was a credit check obtained and was
the process followed?) as well as quantities (Is too much purchasing flowing
through a single supplier, creating a risk?).
In both cases, after the information is gathered and analyzed, a process of
informing someone may be initiated that reports on the failure or success
of the business process in meeting its goals. In this way, the information
collected by both CPM and GRC leads to the creation and execution of new
processes for reporting and problem resolution.
The goal of most efforts at improving CPM and GRC is also the same; that is,
to take point activities and merge them into an integrated whole. The infor-
mation both CPM and GRC provide is much more valuable when it is timely.
But in many cases, information for both CPM and GRC is collected through
manual processes that create data that is stale, weeks or months behind the
actual performance of the enterprise. Using such data is like attempting to
drive a car by looking in the rearview mirror.
To avoid delays in creating high-quality information, the process of collecting
the data must be built into the business processes. This is the goal of most
improvement programs for CPM and GRC. But the highest level of efficiency
is obtained when the needs of both CPM and GRC are taken into account
when designing a fully instrumented business process. When this happens,
information about both CPM and GRC is available as soon as possible, which
allows quick reaction time to solve problems or manage risks. Efficiencies
from this integrated approach result from the fact that common data, activi-
ties, and people are leveraged across both CPM and GRC.
286 Part IV: Managing the Flow of Information
