How to Achieve a Successful GRC Implementation

Step No. 3: Determine the most logical entry point and develop a phased approach 

The GRC space covers a broad spectrum of functions and activities. However, a GRC-related project can be much more focused. It is possible, and in many cases preferable, to focus on a discrete area with opportunity to expand the program in the future.

For example, compliance management represents an excellent starting point because many enterprises are struggling with the growing complexity of regulatory compliance. Additionally, compliance management—while sometimes costly to initiate and sustain—can be leveraged for process improvement.

Specifically, many core ITIL (Information Technology Infrastructure Library) and ISO (International Organization for Standardization) work streams have direct relationships to regulatory mandates. Take ISO 27000, the specification for Information Security Management Systems, as an example. Generally, 20 to 30 percent of an enterprise's SarbOx-related controls will overlap or complement the specifications presented in the ISO 27000 series. From an IT vantage point, this represents either an alternate or parallel entry point to leveraging a GRC solution because risk and compliance are being addressed at the same time (by meeting the requirements of a single set of specifications). 

Therefore, managing IT security investments and processes within a GRC platform—whether or not the IT organization wants to attain or maintain ISO 27000 compliance (in whole or part)—can help achieve the same benefits found within the overall corporate compliance program. With this approach, the GRC project leader is in a position to align IT security initiatives to the overall governance strategy, as well as to the risk mitigation priorities for the business.

The most important thing to remember at this stage is that some organizations may want to consider a phased approach to GRC. Sometimes garnering buy-in from the broader stakeholders in the organization requires a GRC project leader to pick one entry point as a starting place. The end goal should, of course, be a unified and centralized GRC management platform. But, in many cases, addressing one element at a time can set the team on the best path for success and help the group see the true benefits of the GRC program.

Next: Establish a Clear Business Case >>