Published: August 2009 - Governance, risk management, and corporate compliance (GRC) is a business journey, not a destination. The business world is dynamic: Organizations are constantly reacting to an evolving risk and compliance landscape of pressure and control. Organizations tackle GRC as an integrated business collaboration and architecture to drive toward:
■ Accountability: GRC requires a system of accountability where executives can see the status of GRC issues, events, incidents, and unresolved findings,and hold individuals accountable for resolution.
■ Security and peace of mind: GRC oversight strives to understand and model various threats, likelihoods, and business impacts, and to select and prioritize business controls to bring systems and information in line within
acceptable levels of risk tolerance.
■ Sustainability: GRC demands a sustainable process and infrastructure as organizations must sustain risk and compliance management practices on a continuous basis. The dynamic nature of business demands an organization
address GRC collaboratively and continuously.
■ Consistency: GRC involves multiple roles in the organization working together in an integrated framework and technology architecture.
■ Efficiency: GRC eases the burden on business by leveraging common processes, assessments, and information through technology integration and enablement.
■ Transparency: GRC delivers transparency across the business, and when done correctly links risk management to corporate performance strategy.
