Governance Risk Management and Compliance (GRC)

Government, Risk Management, and Compliance - GRC is important because it offers a holistic view of risk that streamlines decision-making regarding issues that aren’t always unified.
From regulatory changes to stakeholder demands, boards are under pressure to manage interrelated priorities that can be difficult to align.
GRC is one of the best tools boards have to integrate GRC functions and ensure that all operations align with strategic objectives while also adhering to legal and regulatory requirements.
Yet, in a 2023 survey of those who either manage or oversee their organization’s risk and compliance strategy, only 53% said their programs were mature — making effective adoption of GRC tools and strategies an imperative.

1. Governance Risk and Compliance (GRC):
A Complete Guide
Seta A. Wicaksana
www.humanikaconsulting.com

2. Lead Consultant
SETA A. Wicaksana
Direktur Utama Humanika Institute
Business & Professional:
•Pendiri dan Direktur Humanika Consulting dan hipotest.com
•Dosen Tetap & Peneliti di Fakultas Psikologi UP
•Business Psychologist
•Ketua Pusat Kajian Psikologi Bisnis dan Kewirausahaan Fak. Psi. UP
•Penulis Buku
Professional Certification:
•Certified of Assessor Talent Management
•Certified of Reward Management
•Certified of Human Resources as Business Partner
•Certified of Risk Professional
•Certified of HR Audit
Pendidikan:
•Ilmu Ekonomi dan Management (MSDM) S3 Universitas Pancasila
•Fakultas Psikologi S1 & S2 Universitas Indonesia
•Sekolah Ikatan Dinas Akademi Sandi Negara

3. GRC is Important
Government, Risk Management, and Compliance - GRC is important because it offers a holistic view
of risk that streamlines decision-making regarding issues that aren’t always unified.
From regulatory changes to stakeholder demands, boards are under pressure to manage
interrelated priorities that can be difficult to align.
GRC is one of the best tools boards have to integrate GRC functions and ensure that all operations
align with strategic objectives while also adhering to legal and regulatory requirements.
Yet, in a 2023 survey of those who either manage or oversee their organization’s risk and compliance
strategy, only 53% said their programs were mature — making effective adoption of GRC tools and
strategies an imperative.

4. What does a weak GRC strategy look like?
Unclear
objectives
Lack of effective
oversight
Lack of access
to crucial
information
Organizational
and functional
silos
High costs
High rates of
duplication
Wasted
resources, data
and information
Unnecessary
complexity

5. Why does Organization Need GRC?
Constant changes to
regulations and enforcement
that severely impact business
operations
Stakeholder demand for
strong performance
outcomes, consistent growth
and transparent processes
Growing costs of addressing
compliance requirements
and managing risk
Increase of third-party
relationships and associated
governance challenges
Potential legal and financial
consequences resulting from
lack of effective oversight and
overlooking critical threats

6. What is GRC
Organizations employ a
GRC framework to handle
interdependencies
between corporate
governance policies,
regulatory compliance,
and enterprise risk
management programs.
GRC strategies aim to help
organizations better
coordinate processes,
technologies, and people
and ensure ethical
behavior. A well planned
GRC strategy can address
many of the challenges of
the traditional, siloed
approach to risk and
compliance, including
miscommunications,
interdepartmental
tension, and
inefficiencies.
The GRC framework offers
advantages for
organizations of any size.
However, it’s especially
valuable for large
enterprises that aim to
implement cross-
organizational
governance, risk, and
compliance programs
effectively.

7. Governance
Governance refers to a set of policies, rules, and processes that organizations implement to ensure their
activities align with their business objectives and goals. It covers resource management, ethics,
management, and accountability.
A successful governance strategy balances various stakeholder interests, maintains control of resources,
and empowers employees to work correctly. It provides accountability for all behaviors and outcomes,
manages worker conduct by encouraging a corporate citizenship approach, and enforces ethical business
practices.
Good governance involves clearly defining jobs and responsibilities and evaluating employees according to
their results.

8. Risk Management
Risk management refers to identifying, evaluating, and managing various risks, including legal,
financial, and security-related risks. Organizations must employ resources to minimize risks by
monitoring and controlling the impact of security events.
A risk management system encompasses personnel, technologies, and processes for
establishing and enforcing risk mitigation objectives. An effective risk management process
requires keeping key stakeholders informed and incorporating legal, contractual, and business
requirements.
A risk management program should include identifying security threats and managing risks
such as unsafe practices and software vulnerabilities. The program can then assess the risks
and implement plans to mitigate them and ensure business continuity.

9. Compliance
Compliance refers to an
organization’s adherence to
government regulations,
industry standards, and internal
policies.
Failure to comply with these
obligations can impact
business operations and result
in legal and financial penalties.
Successful compliance
management integrates
external and internal
compliance requirements.
External compliance refers to
industry standards and laws
that apply to an organization,
while internal compliance
refers to the organization’s
corporate policies and internal
controls.
Organizations should regularly
update and track compliance
policies and provide adequate
training for employees.

10. Summary
Governance Risk Compliance
Composed of all the
business processes and
policies that are
developed, implemented,
and maintained to provide
strategic direction as well
as guidelines for day-to-
day operations.
Includes all activity
related to monitoring,
assessing, managing,
and mitigating
vulnerabilities to ensure
that operations are not
interrupted, and sensitive
information is protected.
Tracks compliance rules,
keeps impacted teams
up to date about
changes, and sends
alerts when systems,
processes, or people put
the organization at risk of
non-compliance
violations.

12. The Challenges of GRC
Ineffective GRC implementation can make data silos worse—integration and cross-enterprise coordination is
an essential part of a successful GRC strategy. The GRC strategy should provide a unified view into data insights,
permitting organizations to make well-informed decisions.
Manual processes can cause wasted time and human error—some GRC processes are manual. Manual
processes can also limit the organization’s visibility into data monitoring and collection.
An organization’s work culture can be a barrier—after an organization defines a GRC framework, there is a need
to constantly update and maintain the framework. It is critical to ensure the organization is committed and
supports the GRC strategy.
The cloud changes everything—organizations are readily adopting cloud computing, resulting in major changes
to organizational structures, networks, attack surfaces, and access control systems. GRC must adapt to this new
paradigm.

13. GRC Capability Model
OCEG created an open-source GRC Capability Model integrating risk,
governance, audit, ethics/culture, IT, and compliance.
Organizations can apply this holistic approach to different compliance
subject areas and situations and use it with specific functional
frameworks, including COSO, NIST, ISO, and ISACA.

14. COSO Framework
The Committee of Sponsoring Organizations of the Treadway
Commission (COSO) framework is a reputable ERM framework
businesses across industries use to create a more holistic view of risk.
Integrating COSO principles into a GRC model helps corporations layer
accepted risk management best practices over their governance and
compliance objectives.

15. NIST Framework
The National Institute of Standards and Technology (NIST)
Cybersecurity Framework is a repeatable process for managing
and improving cybersecurity.
Within GRC, it offers a structure for identifying, responding to and
recovering from cybersecurity threats — a must, given that cyber-
attacks spiked in 2023.

16. ISO Framework
The International Organization for Standardization (ISO) offers
guidance on various business needs, including information
security and risk management.
These standards complement GRC by offering documented
approaches organizations can leverage to improve risk
management and compliance.

17. ISACA Framework
ISACA is a global professional association that develops frameworks
for IT governance and risk management, including the Control
Objectives for Information and Related Technologies (COBIT).
These frameworks can guide how an organization’s GRC model aligns
IT governance practices with their overall objectives and regulatory
landscape.

18. Four Components of The GRC Capability Model
Learn about organization
culture and stakeholders to
inform strategy and action—
this step involves learning
about core influencing factors
in the internal and external
business environments to
define purposeful objectives.
01
Align actions with strategy
and strategy with
objectives—work to ensure
the decision-making process
addresses opportunities,
values, requirements, and
threats.
02
Perform actions that
encourage and reward
desirable behaviors—
discover events as soon as
possible and dissuade and
remediate undesirable
behaviors.
03
Evaluate strategy and
actions—on an ongoing
basis, evaluate objectives and
update them to improve
organizational processes.
04

20. Key Stakeholders of
GRC
GRC requires cross-functional collaboration across
different departments that practice governance, risk
management, and regulatory compliance. Some
examples include the following:
•Senior executives who assess risks when making
strategic decisions
•Legal teams who help businesses mitigate legal
exposures
•Finance managers who support compliance with
regulatory requirements
•HR executives who deal with confidential
recruitment information
•IT departments that protect data from cyber threats

21. GRC Framework
•A GRC framework is a model for managing governance
and compliance risk in a company.
•It involves identifying the key policies that can drive the
company toward its goals.
•By adopting a GRC framework, you can take a proactive
approach to mitigating risks, making well-informed
decisions, and ensuring business continuity.
•Companies implement GRC by adopting GRC
frameworks that contain key policies that align with the
organization's strategic objectives.
•Key stakeholders base their work on a shared
understanding of the GRC framework as they devise
policies, structure workflows, and govern the company.
•Companies might use software and tools to coordinate
and monitor the success of the GRC framework.

22. GRC Maturity
•GRC maturity is the level of integration of
governance, risk assessment, and
compliance within an organization.
•You achieve a high level of GRC maturity
when a well-planned GRC strategy results in
cost efficiency, productivity, and
effectiveness in risk mitigation.
•Meanwhile, a low level of GRC maturity is
unproductive and keeps business units
working in silos.

23. Implementing
a GRC
Strategy
•Establish clear goals and build a GRC framework: Determining your greatest
risks and challenges will determine the structure of your framework. A complete
framework should help an organization make informed business decisions,
minimize risks, and help ensure sustainability.
•Identify current operational shortfalls: Organizations should take a closer look
at all problems that have not been fully addressed. Business operations
processes and technology can always be improved and falling behind creates
greater risk.
•Get buy-in at the top: If senior management is not truly committed, it will be
difficult to build momentum around implementation. Managers need to lead a
risk-aware corporate culture.
•Get buy-in across the organization: The entire organization must understand
the importance of GRC. If employees feel that GRC is someone else’s job,
problems can slip through, no matter how comprehensive the framework is.
•Set clear roles and responsibilities: Everyone needs to know where they fit
into the cross-functional collaboration.
•Use GRC software: Using word processors and spreadsheets alone could
condemn an organization to manual tracking.
•GRC framework testing: Begin with a department or two to be sure that the GRC
process and interface are clear, and that all significant issues are being
addressed. Correcting any issues when they are smaller will save time and
potentially embarrassment, rather than rolling out an organization-wide program
on day one.

24. Benefits of well-planned GRC management and strategy
Organizations that can implement a cohesive,
integrated set of processes and technologies
can expect benefits like:
Reduced costs
Reduced duplication of business activities
Faster, easier access to information
Higher quality and accuracy of information and
communications
Greater ability to consistently repeat key
processes
The standard components of a strong GRC
strategy include, but are not limited to:
Effective oversight
Integrated reporting and analytics
Organization-wide ethics and integrity
requirements
Integrated information, risk and control activities
Unified vocabulary across departments and
disciplines
Standardized practices for core processes like
hiring, training, investments, evaluation, etc.

25. GRC is Important for small businesses, too
•The OCEG model of GRC was born out of the challenges and experiences of large organizations.
•However, it is important to acknowledge that small and midsize businesses (SMB), which do not have
distinct departments for risks, compliance, internal audits, governance, and strategy, still need to
develop strong GRC capabilities.
•SMBs face significant risks when they don’t have a well-defined, repeatable, and manageable approach
to GRC. According to a 2019 study conducted by the Ponemon Institute.

26. Keys Take
Away
1.Organizational culture is the foundation of GRC performance - A positive
and mature risk culture aims to continuously strengthen decision-making
and operations by being ’responsibly red’.
2.It’s not a one-way street - Effective risk management and decision-making
requires a systemic dialogue and consideration of relevant risks in both
streams in an appropriate way. This applies whether it’s corporate level
existential concerns (often compliance risk) or serious threats and concerns
at the ’tip of the spear’ point of delivery (often operational risks and needs)
that requires support from corporate level to address.
3.Find your inner balance - There is a need to find a balance between the
need to document and the need to be able to operate effectively. The best
way to achieve this is to focus on, evaluate, and re-examine, how we operate
as opposed to what we do (and adding things to do and forms to fill in).
4.Information is everything - A basic foundation of risk analysis, risk
management, and good governance practices is information. Informed
decision-making is inherently better management and inherently better risk
taking.
5.Visibility and accessibility are key to decision-making - Depending on
your volume of information, your needs in this area will vary greatly. For a
small and fairly straight-forward operation, a simple Excel-sheet risk matrix
may suffice in order to document, track, follow-up, and when needed, report
on your GRC work.
6.The quality and integrity of your governance, risk, and compliance
framework can make all the difference in the success and growth of your
organization.

27. Learning and
Giving for
Better
Indonesia
www.humanikaconsulting.com