Implementing a proactive and risk-based information technology (IT) governance, risk management, and regulatory compliance (GRC) approach enables companies to better manage compliance costs and streamline compliance and business processes through increased automation.
GRC has always been an important if somewhat abstract concern to businesses, particularly companies that are publicly traded and/or in heavily regulated industries. Within the last decade, firms have developed a new and more concrete sense of urgency, as C-level leaders have been forced to address regulations such as Sarbanes-Oxley, Basel I, Basel II, and HIPAA, as well as mounting stakeholder and public demands for stronger internal controls and greater accountability.
High-profile corporate malfeasance, which wiped out billions of dollars in shareholder value early in the last decade, added to the growing awareness that governance, risk management, and regulatory compliance weren’t merely nebulous concepts, but were instead important parts of a public company’s DNA, as important as areas like product innovation, service delivery, and marketplace competitiveness.
Hence attending to GRC is rapidly becoming its own separate business discipline, although there is still some controversy as to exactly what it entails, why and where within the enterprise it’s important, and how or if it should be integrated at the enterprise level.
