Creating, Managing, and Measuring GRC Culture

A strategic approach to Governance, Risk Management, and Compliance (GRC) is necessary.
While a strong GRC framework provides the foundation, the development of a GRC-focused culture truly sets an organization apart.
This culture prioritizes risk awareness, accountability, and a commitment to ethical practices. It’s where everyone, from leadership to frontline employees, understands their role in upholding a strong GRC framework, ensuring sustainable success.

1. Creating, Managing,
and Measuring GRC
Culture in
Organization
Seta A. Wicaksana
www.humanikaconsulting.com

2. Lead Consultant
SETA A. Wicaksana
Direktur Utama Humanika Institute
Business & Professional:
•Pendiri dan Direktur Humanika Consulting dan hipotest.com
•Dosen Tetap & Peneliti di Fakultas Psikologi UP
•Business Psychologist
•Wakil Ketua Asosiasi Psikologi Forensik Indonesia wilayah DKI Jakarta
•Anggota Komite Nominasi dan Remunerasi Dewan Komisaris ASKRINDO
Professional Certification:
•Certified of Assessor Talent Management
•Certified of Human Resources as Business Partner
•Certified of Risk Professional
•Certified of HR Audit
Pendidikan:
•Ilmu Ekonomi dan Management (MSDM) S3 Universitas Pancasila
•Fakultas Psikologi S1 & S2 Universitas Indonesia
•Sekolah Ikatan Dinas Akademi Sandi Negara

3. Culture is A
Key

4. Nurturing a Culture of
Excellence
•Leadership Commitment and Communication: Strong leadership is
crucial for creating a GRC-focused culture. When leaders are fully
committed, they communicate GRC principles clearly, ensuring everyone
understands the importance of managing and mitigating risks in an
organized manner. By integrating GRC into strategic goals, leaders drive
significant changes across the organization.
•Data-Driven Decision Making: Use of GRC data analytics to inform
strategic decisions. Invest in technologies that enable data collection,
analysis, and reporting for all levels of the organization, helping leaders to
make informed decision based on a comprehensive understanding of risk
and compliance implications.
•Agility and Adaptability: Don’t let your GRC program become rigid.
Embrace agility to navigate emerging risks and regulatory changes. Establish
clear protocols for swift response to new challenges and cultivate a culture
that values flexibility and quick decision-making.
•Continuous Improvement: It’s essential to regularly review your practices,
find ways to improve, and make small changes over time, following a
“kaizen” approach. This continuous assessment and improvement are vital
for a strong GRC program. By regularly evaluating and refining processes,
you can ensure that your risk management strategies are effective.
Additionally, breaking down communication barriers between different parts
of the organization promotes a more holistic approach to risk management.

5. Nurturing a Culture of
Excellence
•Interconnectedness and Cross-Functional Collaboration:
Break down silos! A strong GRC culture thrives on collaboration
between departments. Recognize every department as a vital
node in the GRC network, promoting open communication and
information sharing.
•Employee Participation: Employees are the eyes and ears of the
organization. Involving them to actively contribute to GRC
objectives by encouraging risk identification and ownership of
compliance responsibilities. This builds a culture of GRC
excellence that emerges organically from the collective efforts of
the entire organization.
•Continuous Learning: Building a GRC-savvy workforce is key.
Invest in ongoing training programs to ensure employees
understand their roles and responsibilities within the GRC
framework. Regularly review outcomes in the context of GRC
metrics to enhance organizational learning and adaptability.

6. Building a GRC Team:
Structure and Roles
•GRC Sponsor & Senior Executives: Provide the objective,
ensures GRC efforts align with strategic objectives and help
create a culture of compliance and risk awareness.
•GRC Program Manager: Leads the program, establishes
governance, and focuses on integration, collaboration,
common nomenclature, and definitions and ensures that
there is alignment across functions and processes risk
assessments, mitigation strategies, and communication of
risk and compliance information.
•Business Unit Leaders/ Module Owners: Ensures that their
modules and processes are implemented properly in the
GRC framework to provide necessary insights and KRIs
•Subject Matter Experts/ Module Users: perform day-to-
day activities and ensure that expected policies, and
procedures are followed
•Information Security Professionals: Safeguard
organizational data, manage IT systems, and implement
cybersecurity measures.
•Internal Auditors: Ensure compliance with internal policies
and defined regulatory expectations, identifying areas where
controls may be lacking, etc.

7. Do I Need to Build a GRC
Team?
Whether you need a dedicated GRC team depends on your
organization’s specific needs. Here are some factors to consider:
•Organization Size:Larger organizations with complex
regulatory environments and a high-risk profile may require a
dedicated GRC team.
•Strategic Importance of Risk Management:If strong risk
management is critical to your organization’s success, a
dedicated GRC team can provide the necessary focus and
expertise.
There are several ways to structure a GRC team:
•Centralized:A central GRC department oversees company-
wide activities.
•Distributed:GRC responsibilities are embedded within each
business unit, with a central team providing oversight.
•Hybrid:A central GRC team works collaboratively with
representatives from each business unit.
•Outsourced:External consultants supplement internal GRC
staff for specialized knowledge.

8. Implementing a
Successful GRC Strategy
The key to a successful GRC strategy lies in integration. Here
are some vital steps:
•Establish clear governance with executive oversight and
regular reporting processes.
•Map internal controls and processes to relevant
regulations and frameworks.
•Automate workflows for efficiency, such as control
testing, policy attestations, risk surveys, and compliance
audits.
•Implement GRC software to centralize data, processes,
and reporting in one system.
•Build a culture of risk awareness through training and
communication of GRC objectives and individual
responsibilities.
•Regularly monitor KPIs, maturity metrics, and
performance against defined goals for continuous
improvement.

9. The 7 Critical Reasons for
Measuring GRC Outcomes
Measuring outcomes instead of siloed activities for Governance,
Risk Management, and Compliance (GRC) is crucial for several
reasons:
•Alignment with Business Objectives: GRC exists to support and enhance the
achievement of organizational goals. By measuring outcomes, we ensure that GRC
efforts directly contribute to these objectives rather than being isolated activities
that may not align with broader business priorities.
•Holistic Understanding of Performance: Focusing solely on individual activities
within GRC can lead to a fragmented view of performance. Measuring outcomes
provides a holistic understanding of how effectively the entire GRC system
operates in achieving desired results.
•Identification of Value Creation: Outcomes measurement helps identify the
tangible value GRC activities create. It allows organizations to demonstrate the
impact of their investment in GRC in terms of risk mitigation, compliance
adherence, stakeholder trust, and overall business resilience.

10. The 7 Critical Reasons for
Measuring GRC Outcomes
•Stakeholder Confidence: Stakeholders, including investors, regulators,
customers, and employees, are interested in the overall effectiveness of GRC in
ensuring organizational stability and ethical conduct. Measuring outcomes
enhances stakeholder confidence by providing evidence of GRC's ability to achieve
desired results.
•Risk Management: Effective risk management requires a proactive approach
beyond isolated activities. Measuring outcomes allows organizations to assess
their ability to anticipate, prevent, and respond to risks comprehensively rather than
reacting to individual incidents in isolation.
•Continuous Improvement: Measuring outcomes facilitates a culture of continuous
improvement within the organization. By understanding what works and what
doesn't in terms of achieving desired outcomes, organizations can refine their GRC
strategies and practices over time for better results.
•Resource Optimization: Focusing on outcomes helps organizations allocate
resources more effectively by prioritizing activities that have the greatest impact on
achieving desired results. This ensures that resources are not wasted on activities
that do not contribute significantly to overall objectives.

11. Measuring GRC Outcomes as
a Business Unifier
•Meet business objectives: Organizations exist to achieve their
desired business objectives. Every GRC system must contribute
to attaining those business objectives.
•Enhance leadership and organizational culture: Inspire and
promote an organizational culture of performance,
accountability, integrity, trust, and open communication.
•Increase stakeholder confidence: Increase stakeholder
confidence and trust in the organization as reflected in share
price, ratings, and other stakeholder indicators.
•Prepare and protect the organization: Prepare the organization
to address risks and requirements and protect it from the harm
of adverse events, non-compliance, and unethical behavior.

12. Measuring GRC Outcomes as
a Business Unifier
•Prevent, detect, and reduce adversity: Discourage, prevent,
and provide consequences for misconduct; reduce the
tangible and intangible damage caused by adverse events,
non-compliance, and unethical behavior and the likelihood of
similar events happening in the future.
•Motivate and inspire desired conduct: Provide incentives and
rewards for desirable conduct, especially in the face of
challenging circumstances.
•Improve responsiveness and efficiency: Continuously
improve the responsiveness (timeliness and agility) and
efficiency (speed and quality) of all GRC system activities while
improving effectiveness (ability to meet objectives and
requirements).
•Optimize economic and social value: Optimize the system's
overall value relative to its allocated resources.

13. The Three Containers of
GRC Measurement
A high-performing GRC capability will deliver those universal
system outcomes by balancing three aspects of its systems:
•Effectiveness: The degree to which a system or process is
logically designed to meet legal and other defined requirements.
•Efficiency: Measures the ratio of work the system performs to
the relevant return on investment in both finance and human
capital.
•Responsiveness: The system’s ability to operate quickly and
flexibly in response to changing outcomes.

14. Measuring
Effectiveness
1. Design Effectiveness: This assesses
how logically the system or process is
designed to meet legal and other defined
requirements. It examines whether the
system includes all necessary elements
to evaluate risk and whether it's designed
to address those risks effectively. Key
indicators to measure design
effectiveness include:
•Risk Coverage (ideally 100%)
•Requirement Coverage (ideally 100%)
•Depth of coverage for priority risks

15. Measuring
Effectiveness
2. Operating Effectiveness: This measures how
well the system operates as intended. It
evaluates whether the system functions
according to its design. Indicators for assessing
operating effectiveness include:
•Number of control-test failures
•Number of control violations
•Number of substantiated allegations of
misconduct
•Percent of issues detected via proactive
activities

16. Challenges Associated With
Evaluating System
Effectiveness Include:
COMPARISON
STANDARDS:
DETERMINING WHICH
STANDARDS TO USE FOR
EVALUATION CAN BE
CHALLENGING. WHILE
FRAMEWORKS LIKE THE
U.S. FEDERAL SENTENCING
GUIDELINES OFFER
GUIDANCE, THEY MAY NOT
PROVIDE PRACTICAL
CRITERIA FOR EVALUATING
EFFECTIVENESS AT AN
OPERATIONAL LEVEL.
EVALUATION EXPERTISE:
IDENTIFYING INTERNAL
AND EXTERNAL
PROFESSIONALS WITH THE
NECESSARY SKILLS TO
EVALUATE PROGRAM
EFFECTIVENESS CAN BE
COMPLEX. DECISIONS
REGARDING THE
SEGREGATION OF
EVALUATION ACTIVITIES
AND THE EXTENT TO
WHICH COMPLIANCE
STAFF SHOULD
COLLABORATE WITH
INTERNAL AUDIT STAFF
ALSO NEED
CONSIDERATION.
EVALUATION FREQUENCY:
ESTABLISHING THE
FREQUENCY OF
EVALUATIONS IS CRUCIAL.
REGULAR EVALUATIONS
ARE ESSENTIAL TO ENSURE
ONGOING EFFECTIVENESS
AND TO PROVIDE
EVIDENCE OF
EFFECTIVENESS IN CASE
OF MISCONDUCT
INVESTIGATIONS.
OBTAINING ANNUAL
ASSURANCE OF THE
COMPLIANCE PROGRAM
CAN BE BENEFICIAL.

17. Measuring
Efficiency
1. Financial Efficiency: This refers to the
total financial resources needed to execute
a process effectively. Key indicators for
assessing financial efficiency include:
•Total cost of risk, compliance, and control
activities
•Average cost per employee for training on
risk and compliance
•Average cost per issue resolution
(categorized)

18. Measuring
Efficiency
2. Human Capital Efficiency: This aspect evaluates
the type and level of human resources required for
the process. While human capital costs can be
quantified financially, it's essential also to consider
intangible opportunity costs. For instance, if the
program heavily relies on senior executive time, it
incurs more than salary and benefits expenses. It
also impacts strategic objectives such as growth,
profitability, talent retention, and customer loyalty.
Indicators for assessing human capital efficiency
include:
•Number of senior executives dedicated to the
program
•Ratio of senior executives to program staff
•Monthly hours required for business line
executives to engage in program activities

19. Measuring
Responsiveness
1. Cycle Time: Cycle time measures the total
duration required to complete a process. It is
important in various processes, particularly in
minimizing the time between detecting and
responding to issues. While it's challenging to
establish clear rules for every scenario due to the
unique nature of each issue, understanding and
improving cycle times associated with issue
detection and resolution should become more
manageable over time. Key indicators include:
•Cycle time from non-compliance to detection
•Cycle time from detection to action

20. Measuring
Responsiveness
2. Flexibility and Adaptability: This describes the
system's capacity to incorporate changes, whether
internal (such as performance evaluation results
prompting adjustments) or external (like new
regulations or market shifts). A responsive system
swiftly adjusts to environmental changes,
anticipates future shifts, and prepares accordingly.
Key indicators include:
•Cycle time for integrating new acquisitions into
the program
•Cycle time for addressing new risks and legal
requirements comprehensively

21. Culture: 8 Aspects
Analyze Governance Culture – Analyze the
climate and mindsets about constraining and
conscribing the organization, including how
the governing authority and executive team
are engaged and whether leadership models
behavior in words and deeds.
Analyze Management Culture – Analyze the
climate and mindsets about arranging
resources and operating the organization,
including how the organization is inspired to
achieve effective, efficient, responsive, and
resilient performance.
Analyze Assurance Culture – Analyze the
climate and mindsets about how the
organization objectively examines and judges
the effectiveness, efficiency, responsiveness,
and resilience of critical activities and
outcomes.
Analyze Performance Culture – Analyze the
climate and mindsets about how the
workforce perceives performance, especially
the associated trade-offs.

22. Culture: 8 Aspects
Analyze Risk Culture – Analyze
the climate and mindsets about
how the workforce perceives risk,
its impact on work, and its
integration with decision-making.
Analyze Compliance Culture –
Analyze the climate and mindsets
about how the workforce fulfills
its mandatory and voluntary
obligations.
Analyze Ethical Culture –
Analyze the climate and mindsets
about how the workforce
generally demonstrates integrity.
Analyze Workforce Culture –
Analyze the climate and mindsets
about workforce satisfaction,
loyalty, turnover rates, skill
development, and engagement.

23. Organizational
Culture
Assessment
Please respond to each statement based on your perception of
the organization's culture on a Likert scale (e.g., 1 = Strongly
Disagree, 5 = Strongly Agree).
1. Governance Culture
•1.1 The governing authority consistently provides clear and
effective guidance for the organization.
•1.2 The executive team demonstrates strong leadership by
aligning their actions with organizational values.
•1.3 Leadership is actively engaged in addressing the challenges
faced by the organization.
•1.4 a transparent communication channel exists between the
governing authority and the workforce.
2. Management Culture
•2.1 The organization's resources are effectively arranged to
achieve its goals.
•2.2 Management inspires the workforce to strive for efficient and
resilient performance.
•2.3 The organization adapts well to changing conditions and
challenges.
•2.4 There is a strong alignment between organizational goals and
resource allocation.

24. Organizational
Culture
Assessment
Please respond to each statement based on your perception of the organization's
culture on a Likert scale (e.g., 1 = Strongly Disagree, 5 = Strongly Agree).
3. Assurance Culture
•3.1 The organization has effective mechanisms to objectively evaluate performance
outcomes.
•3.2 Assurance processes are in place to ensure critical activities are executed
efficiently.
•3.3 The organization regularly reviews and adjusts its processes to improve
responsiveness.
•3.4 Feedback from assurance activities is used to enhance organizational
performance.
4. Performance Culture
•4.1 Employees understand the performance expectations and trade-offs associated
with their roles.
•4.2 The organization recognizes and rewards high performance consistently.
•4.3 Performance metrics are clearly communicated and aligned with organizational
goals.
•4.4 There is a culture of continuous improvement in performance across the
organization.

25. Organizational
Culture
Assessment
Please respond to each statement based on your perception of
the organization's culture on a Likert scale (e.g., 1 = Strongly
Disagree, 5 = Strongly Agree).
5. Risk Culture
•5.1 Employees are aware of the risks associated with their work
and understand how to manage them.
•5.2 Risk management is integrated into the decision-making
processes of the organization.
•5.3 The organization proactively identifies and mitigates potential
risks.
•5.4 There is an open environment for discussing risks and learning
from mistakes.
6. Compliance Culture
•6.1 Employees are well informed about the organization's
mandatory and voluntary obligations.
•6.2 Compliance with regulations and policies is a top
organizational priority.
•6.3 The organization has effective systems to monitor and enforce
compliance.
•6.4 There is a strong culture of accountability when it comes to
meeting obligations.

26. Organizational
Culture
Assessment
Please respond to each statement based on your perception of the
organization's culture on a Likert scale (e.g., 1 = Strongly Disagree, 5 = Strongly
Agree).
7. Ethical Culture
•7.1 Integrity is demonstrated by employees in their daily actions and decisions.
•7.2 The organization promotes ethical behavior through its policies and
practices.
•7.3 Ethical considerations are integrated into the decision-making process.
•7.4 There is a zero-tolerance policy for unethical behavior, and it is consistently
enforced.
8. Workforce Culture
•8.1 Employees are satisfied with their work environment and feel valued by the
organization.
•8.2 The organization invests in the skill development and career growth of its
workforce.
•8.3 Employee turnover rates are low, indicating strong loyalty and engagement.
•8.4 There is a high level of workforce engagement in achieving the organization's
goals.

27. Learning and
Giving for
Better
Indonesia