Farewell To GRC: Bring On Good Governance
David Norfolk, 31/08/2010, posted in "Analysis"
David Norfolk is Practice Leader Development and Governance (Development/Governance) at Bloor Research. David first became interested in computers and programming quality in the 1970s, working in the Research School ...more info
David Norfolk is Practice Leader Development and Governance (Development/Governance) at Bloor Research. David first became interested in computers and programming quality in the 1970s, working in the Research School of Chemistry at the Australian National University. Here he discovered that computers could deliver misleading answers, even when programmed by very clever people, and was taught to program in FORTRAN. His ongoing interest in all things related to development has culminated in his joining Bloor in 2007 and taking on the development brief. Development here refers especially to automated systems development. This covers technology including acronym-driven tools such as: Application Lifecycle Management (ALM), Integrated Development Environments (IDE), Model Driven Architecture (MDA), automated data analysis tools and metadata repositories, requirements modelling tools and so on. ...less info
I’m deeply interested in governance, but I’ve always felt that GRC (”Governance Risk and Compliance”) is a bit of a dead end. It often seems to focus purely on technology and in enforcing the letter of the regulations rather than on the spirit of good governance.
It is too often seen as purely a cost, delivering no business benefit apart from it being allowed to continue operating (which is not to be sneezed at, of course) and is often used as a way of selling technology which promises to deliver governance, risk management and compliance without any need for real cultural change or management input (and I’m very cynical about that possibility). As an indicator of its essential irrelevance, GRC often excludes fraud from its scope, yet fraud, often by employees, is far from uncommon and can suck the life blood out of an organisation over many years!
No, I am all in favour of good governance, of managing risk and of complying with all regulations that you are legally obligated to comply with—and with any optional initiatives or standards that deliver real business benefit (and no others)—but GRC often strikes me as, in practice, a way of avoiding having to think about all that. I suspect the conversation can go something like:
CEO: “Do we have good GRC in place?“;
Minion: “Yes, we do indeed, we spent £xxxk on GRC products last year and the %%% department was complaining only last week that it lost several sales because of all the controls we are enforcing – can I have my GRC-related bonus now please, before we start it all over again for the next inspection?”.
With good governance, compliance is a continuing state of the business; but, when done badly, you are only compliant on the day of inspection and each inspection requires an expensive repeat of the whole compliance exercise
These thoughts are prompted partly by my starting on a revision of my book on IT Governance. This is necessitated by the need to take account of all the mergers and acquisitions in the industry that affect the practical examples it mentions and, since the work is predicated on the idea that IT governance is a business and cultural issue, rather than a technology one, I now rather wish I’d left all technology references out! The technology vendors have changed, the issues haven’t. However, technology has a place—in enabling good governance, once you have commitment to good governance and an emerging governance culture in place.
I still like the definition of IT Governance I use in that book:
IT Governance is that part of corporate governance in general which ensures that automated systems contribute effectively to the business goals of an organization; that IT-related risk is adequately identified and managed (mitigated, transferred or accepted); and that automated information systems (including financial reporting and audit systems) provide a ‘true picture’ of the operation of the business.
The place of technology in governance is largely in managing policies, enforcement and metrics. For example, we need to measure the fiscal and societal outcomes of automated business systems, so that we know whether they do, in fact, “contribute effectively to the business goals of [the] organization”; and this means using the sort of analytics and optimisation tools the business uses, but on IT operational data and systems.
Nowadays, some firms, such as MetaCompliance, do sell “compliance management tools” (for want of a better description) that you might actually find useful as part of a holistic governance initiative (including fraud management). But governance isn’t simply a new silo and a new set of silo’d tools to buy. It should be a fundamental part of of how the business operates and, for example, if you don’t know what you have, who’s using it, how it’s configured and where it’s running, governance generally (and security, risk management, regulatory and legal compliance and all those good things in particular) are doomed to expensive failure. Which is probably why my next book, co-authored with noted CM expert Shirley Lacy and due out in September, is all about Configuration Management.
Subscribe via RSS or via email
