Name: KuppingerCole Report Reviews IT GRC Market and Cites MetricStream as a Pioneer
Item: KuppingerCole Report Reviews IT GRC Market and Cites MetricStream as a Pioneer
Author: Ajmir

1 Ajmir (08.08.2013 5:38 AM)

Dear Michael,I could not agree with you more. After doing extensive recasreh and working with many customers over the last few years on this topic, it has become clear to me that the true vision of enterprise-wide GRC or enterprise-wide Performance Management can not be reached without destroying the boundary between the two. In my recent book, "Driven to Perform: Risk-Aware Performance Management from Strategy Through Execution", co-authored with Stephanie Buscemi and Denise Broady, we establish three key pillars that we believe are necessary to deliver on this vision.First, people mistakenly believe that performance, risk, and compliance management is primarily about finance. Yes, financial processes are heavily regulated and are often the first area companies turn to for managing performance and risk. But we demonstrate that performance management needs to be unified with risk and compliance management and interconnected across every line of business in order to truly be effective. We show these linkages across the entire value chain of an organization: From product development to procurement to supply chain to sales, marketing and service, also understanding the implications on all the supporting processes in finance, HR, and IT.Second, the processes of performance, risk, and compliance management are currently separate, making it impossible to establish effective governance. One part of the organization is worried about internal controls, another part is involved in risk management, another part is setting goals and doing planning, and most of the managers and employees in the organization are oblivious to all of these processes. In "Driven to Perform", we argue that these need to be unified into a single process-based framework. You can align people and processes through technology to actually tie together the ability to set your strategy and the corresponding goals, look at the risks that are relevant to achieving the strategy and instrument them with the appropriate KRIs, then placing the internal controls that will let you know if you are effectively mitigating those risks. These then become the management processes of the organization that allow customers to derive far greater value than each process would be able to achieve in isolation from the other.Third, in order for this approach to be effective, you have to embed the strategic processes into the execution processes. Once you have your strategy and your goals and your risks and controls linked together in a process-based framework, if you then keep them disconnected from the execution processes embedded in your transactive systems, there is much less value that can be realized. Organizations need to be able to layer their goals and risks and controls and the corresponding measurement infrastructure and superimpose them on the transactive processes that their ERP/CRM/SCM/HCM systems provide. Business Process Management technologies can provide a big piece of this puzzle, because it gives you the flexibility to modify your processes based on your strategic priorities.In summary, businesses need frameworks for governance that unify performance, risk, and compliance into a holistic process that can be extended across every part of the value chain of an organization and embedded into the daily activities of its constituents. "Driven to Perform" describes in great detail exactly how to accomplish this vision of Unified Governance.Best Regards,Nenshad Posted by Nenshad Bardoliwalla

Contacts