SAP - TINET - Tarragona Internet

Systematic application of a GRC solution leads to a process that constantly

deepens management’s understanding of what is going on in a business and

increases their confidence that risks are being managed. Figure 1-7 shows

how this leads to a closed-loop system of constant improvement of GRC

processes.

With such a process of continuous improvement in place, companies get the

most important benefit that they are seeking from GRC—the peace of mind

that comes from knowing that financial information is accurate, risks are

being managed, regulations are being complied with, and that the probability

of nasty surprises is as low as it can be.

1. Risk Identification

• Identify risks
  and controls

6. Prevention and Continuous
   Monitoring

• What-if analysis


• Deficiency prevention

5. Testing and reporting

• Control testing


• Progress
  monitoring


• Report on
  exceptions and
  deficiencies

Risks

Controls

Financial GlobalTrade IT GRC

Environment,

Health, and

Safety

2. Automated Risk Analysis

• Implement risk rules
  based on controls &
  organizational goals

4. Remediation and Mitigation

• Resolve identified
  control violations


• Document mitigating
  controls

3. Detect

• Detect violations


• Remediation

Figure 1-7:
A closed-
loop
process
of GRC
improve-
ment.

Chapter 1: The ABCs of GRC 37