SAP - TINET - Tarragona Internet

Figure 1-2 shows the way that the three core activities of governance, risk

management, and compliance interact.

Figure 1-2 shows GRC from the top down. Governance guidelines, which are

the policies and rules of the game for a company that explain how the com-

pany will be run to best meet its obligations and pursue the business strategy,

are set forth by senior management. The operational executives then carry out

programs and put in place controls that ensure compliance, frequently with the

help of consultants or auditors who are expert in applying GRC. Risk manage-

ment results in the creation of mechanisms so that risks can be brought to the

attention of senior managers who then take steps to reduce them.

So although Figure 1-2 shows a top-down structure, in most companies, GRC

is actually implemented from the bottom up, like this:

1. The company puts in place controls to make sure that compliance
   requirements are satisfied so that no laws or regulations are violated.


2. After the controls are in place, which may take a year or more to achieve,
   the next task is to analyze what has been done to make it more efficient
   and effective and to reduce costs associated with compliance.
   At this stage processes for governance may begin to be developed as
   internal policies are added to external requirements and the company
   looks at its compliance activities from the top down.

Risk management processes may be added at any time during this cycle,

depending on how worried a company is about risks connected to a particu-

lar strategy or about unforeseen risks. With this cycle in mind, in the next few

sections, we explain the activities involved in each area of GRC in greater

The Disciplines of GRC

Governance

• CEO/Board and
  line management


• Strategy


• Policies

Compliance

• Business owners


• SOX project


• Corp. sustainability
  reporting

Plan & Scope

Dir

ec

t & Exe

cute

Measu

re & Refine

Risk management

• Business risk owners


• Analyze risks


• Coordinate responses

Figure 1-2:

Interaction

between

processes

for

governance,

risk, and

compliance.

24 Part I: Governance, Risk, and Compliance Demystified