Managing governance, risk and compliance (GRC) is bread and butter for the legal operations team. The role of these all-important professionals in the modern governance organization is not just to collect and store entity data, documentation and other information related to the corporate record – today's governance and compliance managers must work hand in hand with risk managers to run reports and analyze structured data relating to the organization's performance.
They need easy access to swathes of data, both historical and real-time data, and they need to be able to interpret that data to see where the risk is, what the state of compliance is, where there are gaps in processes or danger signs out in the group structure.
As these professionals started to work more closely together, the discipline of GRC, or governance, risk and compliance, became the on-trend thing in the world of entity management. But technology has moved things along, and GRC must now encompass a wider look at operations than it may have once done. Into this breach, we now hear the term IRM, or integrated risk management.
Is there a difference between these two terms, or are they just two sides of the same coin? Let's look at each in turn, and then probe the similarities and differences between them.
However, they believe it goes beyond those three words taken in isolation; GRC is a 'shorthand reference to the critical capabilities that must work together to achieve Principled Performance ' the capabilities that integrate the governance, management and assurance of performance, risk and compliance activities.' This can include work done by departments such as internal audit, compliance, risk, legal, finance, IT and HR, as well as the lines of business, the executives and the board itself.
GRC is the result of governance, compliance and risk practices maturing to be fit for the modern world. It's a structured approach to aligning IT with business objectives, while effectively managing risk and meeting compliance requirements.
A well-planned GRC strategy comes with a lot of benefits, writes Kim Lindros in CIO magazine: improved decision-making, more optimal IT investments, elimination of silos and reduced fragmentation among divisions and departments, to name a few. Poor GRC can lead to higher costs, a lack of visibility into risks, an inability to address third-party risks, difficulty measuring risk-adjusted performance and too many negative surprises. Overall performance is not optimized.
Forward-thinking organizations view GRC as an integrated collection of capabilities to fuel sustainable growth. By definition, its scope doesn't end with the three elements of governance, risk and compliance management; it also includes assurance and performance management, and is getting further extended to information security management, quality management, ethics and values management, and business continuity management.
An important tool for managing the risks associated with operating in the modern world, IRM forms an important part of a best practice approach to modern governance. It's a set of practices and processes supported by a risk-aware culture and enabling technologies that, together, improve decision-making and performance by taking an integrated view of risk across an organization.
A lot of tools that were once marketed as GRC are now being called IRM systems, pushed partly by Gartner's decision in late 2017 to publish their first-ever Magic Quadrant for Integrated Risk Management. This is more than semantics, though; this is a functional shift in the industry. New risks, new technologies, more complex regulatory requirements and new demands from business forced a market evolution.
Today's governance, risk and compliance managers must think beyond the board and regulators, and start to think about how they handle things like third-party risk, business continuity and cybersecurity. Knowing and understanding risks across the organization as a whole ' including subsidiaries and operations in other jurisdictions ' can create opportunities for cost savings, competitive advantage and alignment.
Just as entity management systems support and drive subsidiary management, so too can your entity management system and board portal support tracking and storage of data for GRC and IRM. Helping organizations to centralize and manage their corporate subsidiary data management to simplify entity governance throughout the organization, these technologies can help legal operations teams to better manage and effectively structure their corporate record. This helps to ensure compliance, mitigate risk, drive governance best practices and improve decision making through creating a single source of truth for the organization's data.
Built to drive your modern governance needs, Diligent's suite of governance and compliance software seamlessly integrates to create the Governance Cloud, an all-in-one ecosystem for the modern organization. Get in touch and request a demo to see how Diligent can help your organization to think more strategically about governance, risk and compliance management.
They need easy access to swathes of data, both historical and real-time data, and they need to be able to interpret that data to see where the risk is, what the state of compliance is, where there are gaps in processes or danger signs out in the group structure.
As these professionals started to work more closely together, the discipline of GRC, or governance, risk and compliance, became the on-trend thing in the world of entity management. But technology has moved things along, and GRC must now encompass a wider look at operations than it may have once done. Into this breach, we now hear the term IRM, or integrated risk management.
Is there a difference between these two terms, or are they just two sides of the same coin? Let's look at each in turn, and then probe the similarities and differences between them.
What do we mean by Governance, Risk and Compliance (GRC)?
Governance, Risk and Compliance, or GRC, is the 'integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity,' says the OCEG, originally known as the Open Compliance and Ethics Group, the organization that first coined the acronym.However, they believe it goes beyond those three words taken in isolation; GRC is a 'shorthand reference to the critical capabilities that must work together to achieve Principled Performance ' the capabilities that integrate the governance, management and assurance of performance, risk and compliance activities.' This can include work done by departments such as internal audit, compliance, risk, legal, finance, IT and HR, as well as the lines of business, the executives and the board itself.
GRC is the result of governance, compliance and risk practices maturing to be fit for the modern world. It's a structured approach to aligning IT with business objectives, while effectively managing risk and meeting compliance requirements.
A well-planned GRC strategy comes with a lot of benefits, writes Kim Lindros in CIO magazine: improved decision-making, more optimal IT investments, elimination of silos and reduced fragmentation among divisions and departments, to name a few. Poor GRC can lead to higher costs, a lack of visibility into risks, an inability to address third-party risks, difficulty measuring risk-adjusted performance and too many negative surprises. Overall performance is not optimized.
Forward-thinking organizations view GRC as an integrated collection of capabilities to fuel sustainable growth. By definition, its scope doesn't end with the three elements of governance, risk and compliance management; it also includes assurance and performance management, and is getting further extended to information security management, quality management, ethics and values management, and business continuity management.
Understanding IRM
By contrast, integrated risk management homes in tightly on the 'R' of GRC, namely risk, but looks at risk in the context of every part of an organization. IRM aims to improve decision-making and performance through an integrated view of how well an organization manages its unique set of risks, and how those risks interplay and interact with each other.An important tool for managing the risks associated with operating in the modern world, IRM forms an important part of a best practice approach to modern governance. It's a set of practices and processes supported by a risk-aware culture and enabling technologies that, together, improve decision-making and performance by taking an integrated view of risk across an organization.
How Do GRC and IRM Differ?
Certainly walking hand in hand, there are some subtle differences between the disciplines of GRC and IRM ' but they're only subtle.A lot of tools that were once marketed as GRC are now being called IRM systems, pushed partly by Gartner's decision in late 2017 to publish their first-ever Magic Quadrant for Integrated Risk Management. This is more than semantics, though; this is a functional shift in the industry. New risks, new technologies, more complex regulatory requirements and new demands from business forced a market evolution.
Today's governance, risk and compliance managers must think beyond the board and regulators, and start to think about how they handle things like third-party risk, business continuity and cybersecurity. Knowing and understanding risks across the organization as a whole ' including subsidiaries and operations in other jurisdictions ' can create opportunities for cost savings, competitive advantage and alignment.
Keeping track of data to drive both GRC and IRM
Whatever your take on the issue ' whether you call it GRC or IRM; whether you think they're two sides of the same coin or separate theories and practices ' one thing is clear: you need strong, robust and secure management of entity data to drive the process.Just as entity management systems support and drive subsidiary management, so too can your entity management system and board portal support tracking and storage of data for GRC and IRM. Helping organizations to centralize and manage their corporate subsidiary data management to simplify entity governance throughout the organization, these technologies can help legal operations teams to better manage and effectively structure their corporate record. This helps to ensure compliance, mitigate risk, drive governance best practices and improve decision making through creating a single source of truth for the organization's data.
Built to drive your modern governance needs, Diligent's suite of governance and compliance software seamlessly integrates to create the Governance Cloud, an all-in-one ecosystem for the modern organization. Get in touch and request a demo to see how Diligent can help your organization to think more strategically about governance, risk and compliance management.
