{"id":896,"date":"2012-11-02T12:05:31","date_gmt":"2012-11-02T12:05:31","guid":{"rendered":"http:\/\/www.chaordicsolutions.co.uk\/blog\/?p=896"},"modified":"2012-11-07T22:59:32","modified_gmt":"2012-11-07T22:59:32","slug":"grc-and-erm-as-uneasy-bedfellows","status":"publish","type":"post","link":"https:\/\/www.chaordicsolutions.co.uk\/blog\/from-our-grc-consultants\/grc-and-erm-as-uneasy-bedfellows\/","title":{"rendered":"GRC and ERM as uneasy bedfellows"},"content":{"rendered":"

\"\"<\/a><\/p>\n

GRC and ERM as uneasy bedfellows: different, quite separate but clearly interrelated.<\/em><\/p>\n

 <\/p>\n

<\/p>\n

From Robert J Toogood, Senior Partner \u2013 Chaordic Solutions:<\/strong><\/p>\n

This week I have had the pleasure of working with some close colleagues from the Institute of Risk Management (IRM) GRC Special Interest Group<\/a>, to start looking at the relationship between what is commonly referred to as GRC and ERM.<\/p>\n

From my own experience, it is clear that activities associated with an integrated approach to governance, risk management and compliance (aka GRC) can sometimes have an uneasy relationship with what is known as enterprise-wide risk management (aka ERM).\u00a0 There are even some views that go as far as suggesting that GRC is simply just another term for ERM.<\/p>\n

So what is this thing we call GRC?<\/p>\n

The acronym GRC was first used over ten years ago … however, based on the research of Racz, Weippl and Seufert<\/a>, there does not appear to be a universally accepted definition of what GRC actually is.\u00a0 The findings from their research are unfortunately confirmed by frequent discussions in various LinkedIn and other collaborative spaces, where attempts are periodically made to reach consensus on what GRC actually is.<\/p>\n

As a starting point, the Open Compliance and Ethics Group (OCEG)<\/a> defines GRC as being a:<\/p>\n

\u201c<\/em><\/strong>Capability <\/strong>that enables an organization to reliably achieve objectives while addressing uncertainty and acting with integrity<\/a>; including the governance<\/a>, assurance<\/a> and management of performance, risk<\/a>, and compliance<\/a>.\u201d<\/em><\/em><\/p>\n

The US-based but globally focused Risk and Insurance Management Society, Inc. (RIMS) have a view of this definition\/approach in their \u201cAn Overview of Widely Used Risk Management Standards and Guidelines<\/a>\u201d document.\u00a0 They conclude that when comparing the OCEG view of GRC against Risk Management frameworks such as COSO and ISO 31000:<\/p>\n

\u201cThe major difference for the OCEG approach is the formal integration of the governance, risk and compliance processes, ideally supported by a common technology platform. In this framework, risk is given a limited role focused on identification and measurement. The primary directive for risk, though not exclusively, is to measure the likelihood of an event that has an adverse effect on objectives. The OCEG Capability Model relies heavily on an integrated technology platform as an enabling tool to identify and assess risk for prevention and\/or remediation purposes.\u201d<\/em><\/p>\n

The outcome from the literature review based research of Racz, Weippl and Seufert<\/a> was a single-phrase definition of:<\/p>\n

\u201cGRC is an integrated, holistic approach to organisation-wide governance, risk and compliance ensuring that an organisation acts ethically correct and in accordance with its risk appetite, internal policies and external regulations through the alignment of strategy, processes, technology and people, thereby improving efficiency and effectiveness.\u201d<\/em><\/em><\/p>\n

But how does this and other definitions compare with what is referred to as ERM?\u00a0 It is interesting to see that\u00a0COSO (2004)<\/a> defines enterprise risk management as a:<\/p>\n

\u00a0\u201cProcess, effected by an entity\u2019s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.\u201d<\/em><\/p>\n

If we then look at ISO 31000<\/a>, risk is defined as the:<\/p>\n

\u201cEffect of uncertainty on objectives\u201d whereas risk management <\/strong>is \u201ccoordinated activities to direct and control an organization with regard to risk\u201d. <\/em><\/p>\n

In addition, ISO 31000<\/a> sees the risk management process as a:<\/p>\n

\u201cSystematic application of management policies, procedures and practices to the tasks of communication, consultation, establishing the context, identifying, analysing, evaluating, treating, monitoring and reviewing risk\u201d.<\/em><\/em><\/p>\n

What seems to emerge from a comparison of these definitions is that the main distinguishing feature of GRC is that it formally integrates governance and compliance with an associated risk management framework such as COSO or more recently, ISO 31000.<\/p>\n

However, we are all products of our own experiences.\u00a0 It is because of these unique experiences, and therefore quite often perceptions, that when we look at something as complicated as GRC, it is easy to misunderstand\/misinterpret what is actually going on … it just depends on how you and your organisation are viewing things, and more importantly, what your expectations are.<\/p>\n

So from the research this week, it is clear to me that GRC and ERM are different, quite separate but clearly interrelated.\u00a0 However, the creator of the term GRC, Michael Rasmussen, in his blog post \u201cRethinking GRC<\/a>\u201d believes the time may have come for a rethink of what GRC means.<\/p>\n

But what are your<\/strong> views?<\/p>\n

PS If you would like to join the recently formed Institute of Risk Management (IRM) GRC Special Interest Group<\/a>, then just let me know – it would be good to have you onboard!<\/p>\n

References<\/strong><\/p>\n

An Overview of Widely Used Risk Management Standards and Guidelines \u2013 A Joint Report of RIMS Standards and Practices Committee and RIMS ERM Committee <\/a>from RIMS<\/p>\n

A Frame of Reference for Research of Integrated Governance, Risk & Compliance (GRC)<\/a> from Racz, Weippl and Seufert<\/p>\n

Enterprise Risk Management \u2014Integrated Framework, Executive Summary, September 2004<\/a> from COSO<\/p>\n

The Risk Management Toolbox<\/a> from ISO<\/p>\n

Rethinking GRC<\/a> from Michael Rasmussen<\/p>\n

Is ERM GRC? Or Vice Versa?<\/a> from Treasury and Risk<\/p>\n

A structured approach to Enterprise Risk Management (ERM) and the requirements of ISO 31000<\/a> from IRM<\/p>\n","protected":false},"excerpt":{"rendered":"

GRC and ERM as uneasy bedfellows: different, quite separate but clearly interrelated.  <\/p>\n","protected":false},"author":1,"featured_media":36,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[26],"tags":[34,20,18,19,83,86,84,85,29,27,28,30,81,313,36,39,37,38],"_links":{"self":[{"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/posts\/896"}],"collection":[{"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=896"}],"version-history":[{"count":41,"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/posts\/896\/revisions"}],"predecessor-version":[{"id":921,"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/posts\/896\/revisions\/921"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/media\/36"}],"wp:attachment":[{"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.chaordicsolutions.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}