I learned the importance of focusing on the real goal and not being overly distracted by and reliant upon procedural gyrations early in my very short chess-playing career. I joined the Chess Club in high school. I wasn’t particularly good at it, but got to be on the team because another player was out sick. Here I was, confronted with a much more experienced player. After his first move, he flipped the timer and proceeded to write down the move on a form. I hadn’t done that before. However, not wanting to appear a novice, I made my move, flipped the timer and then spent the next five minutes diligently entering my move on the sheet. I was still struggling with documenting my third move when my opponent declared “check mate!” I wasn’t invited back on the team.
However this experience provided me with a good lesson for business. The goal of the GRC exercise is to manage risks rather than to have a showcase process. Granted you need the policy and controls in place, but they alone do not guarantee effective risk management.
This is what I think occurred with the latest fiasco in financial services. Institutions placed enormous emphasis on the procedures and tools of GRC, in part due to perceived requirements of the Sarbanes-Oxley Act, encouraged in their pursuit by many accounting and consulting firms. But somehow companies lost focus on the whole purpose of the exercise, which is to provide stakeholders with the optimal balance of return and risk, and avoid the flame-outs of Enron, Andersen and others.
Popularity: 1%
One Comment
I agree with your article and have some additional thoughts. I think the GRC exercise does quickly become form over substance because many companies try to lead with a technology solution and then design their processes to support that solution. First and foremost, GRC processes should be designed to support the business and ultimately be integrated with decision-making processes within the business. Then, technology should be employed to streamline the processes to create additional efficiencies. While most folks are focusing on converging the G, R & C, they are leaving out the most important element – the B (the business that is).