Software and Services strategy for Governance, Risk and Compliance

2008-10-06T09:48:00.000-07:00

Governance, Risk, and Compliance or "GRC" is an increasingly recognized term that reflects a new way in which organizations can adopt an integrated approach to these three areas. However, this term is often positioned as a single business activity, when in fact, it includes multiple overlapping and related activities within an organization, e.g. internal audit, compliance programs like SOX, enterprise risk management (ERM), operational risk, incident management, etc.

Governance is the responsibility of senior executive management and focuses on creating organizational transparency by defining the mechanisms an organization uses to ensure that its constituents follow established processes and policies. A proper governance strategy implements systems to monitor and record current business activity, takes steps to ensure compliance with agreed policies, and provides for corrective action in cases where the rules have been ignored or misconstrued.

Risk Management is the process by which an organization sets the risk appetite, identifies potential risks and prioritizes the tolerance for risk based on the organization’s business objectives. Risk Management leverages internal controls to manage and mitigate risk throughout the organization.

Compliance is the process that records and monitors the policies, procedures and controls needed to enable compliance with legislative or industry mandates as well as internal policies

While there are several on premise GRC solutions available in the market for example ‘Paisley’, one of the successful GEC strategies for SMEs could be to go for an ‘On demand’ or hosted solution along with GRC implementation and professional services. I call it ‘Software plus Services’ strategy.

Software plus Services describes the idea of combining hosted services with capabilities that are best achieved with locally running software. It describes composite applications created by combining traditional software with remote services to provide consistent and seamlessly integrated user experience across devices and form factors. Software plus Services is a concept that Software As A Service (SaaS) complements the traditional packaged software running on both client or server by services adding value.

SaaS GRC Software (on-demand) Vendors:
Some of the hosted GRC applications with the capabilities of best IT/GRC teams are:
1, Axentis
2, Favored Solutions
3, Paisley

Software-as-a-Service (SaaS) Benefits:
With the increasing use of internet and due to heavy maintenance cost the latest trend is On-demand software, often referred to as ‘Software-as-a-Service’ (SaaS), is rapidly gaining attention of not only SMEs but large corporations as well and some of the benefits of ‘SaaS’ model are:

1. Anytime, anywhere access.
2. Subscription based.
3. Cost effective.
4. Easy to maintain.
5. Automatic, off-site backups.
6. Secure.

.

On Demand Compliance

Software and Services strategy for Governance, Risk and Compliance