Think Flat

Hi Suvendu,
I do not have any disagreement with your suggested approach; however, I would like to ask one question, "Why the governance was seen in isolation?".

I have reason for asking this question; as per my understanding, a governance is a three step process, wherein, you define, "WHAT", "HOW", and "WHO", i.e. the WORK that needs to be governed, the details, as how those work units would be governed, and finally, WHO would govern those? That is, the stakeholders, interests, benefits, and responsibilities and empowerment map / matrix, i.e. the composition of governing body / council.

Therefore, if you try defining the governance from this perspective, you would appreciate that "Risk Management", "Operations Management", "HR Stewardship", "Financial Stewardship", "Client Satisfaction" etc. are integral parameters of governance. If that were the case, the gap lies in understanding of "governance", and hence, its implementation.

Regards,
Shyam

Hi Shyam,

Thanks for your comment.

Absolutely, there is no doubt that governace is not an isolated entity. It is the core of all process orchestration. However, let's appreciate the recent turmoil in financial services industry and under that backdrop, we have to figure out HOW, WHAT went wrong. Governance, risk and compliance (GRC) remains and will remain the core entity deciding the strategic initiative. However, when we analyze the present market turmoil, it was apparent that there is a disconnect between the goal GRC had set and the way other important processes responding to that- i.e. customer service, product / service innovation and technology effectiveness. You are right- this could be bad governance or gap in the governance process implementation etc.The whole idea is to bring the GRC process attributes close to those of customer service, product / service innovation and technology effectiveness and analyze. This coordinated analysis will be a better balm for strategic decisioning. My perspective is not questioning the core of governance, but it's proposing to look at governace with other three mentioned important process attributes for superior decisioning and better goal setting in this near-recession market. Hope, this clarifies.

rgds
Suvendu

I would also like to inform you some more about IT Governance and Compliance.
IT governance, risk and compliance (IT GRC) is about striking an appropriate balance between business reward and risk. The maturity of IT GRC practices for managing reward and risk has a direct impact on the organization. IT GRC encompasses the practices for delivering: Greater business value from IT strategy, investment and alignment, Significantly reduced business and financial risk from the use of IT, and Conformance with policies of the organization and its external legal and regulatory compliance mandates. IT GRC energizes the entire organization to imagine what it can achieve, establishes methods for achieving their objectives, and demonstrates the practices that are proven to work for minimizing business and financial risk. Fundamentally, IT GRC is about striking an appropriate balance between business reward and risk, enabling an organization to more effectively anticipate and manage business risk while more effectively delivering value for the organization.

Thanks Jack for bringing up the topic on IT GRC- an area close to my research interest.

To me, IT GRC falls under the enterprise GRC functions, but it has its added significance and roles to play in order to ensure enterprise GRC runs effectively and at the same time, the ambience of IT GRC is also robust.

To summarize, I can see two roles when we mention IT vis-à-vis Enterprise GRC:-

1. Providing Consistent, Sustainable, Scalable platform for Enterprise GRC
This helps collaborating, disseminating information, policies, predictive GRC analytics and reporting. In order to have consistent, transparent and efficient GRC functions, a technology driven infrastructure is a must for organizations who want to see greater value emanating from GRC investment.

2. Manage IT GRC activities
This has already been well articulated by you. It is not only important to align the IT actions with business strategy & objectives, but also important for IT to manage its own aspects of GRC – IT controls, privacy, information security, information risk, business continuity, disaster management. Some of Infosys offerings in this area can also be appreciated in following link

Information Risk Management.

In my previous deliberations, I always had greatest regard to IT function and its evolving significance in strategic decisioning. The challenge would be to create meaningful analytics of enterprise IT function and bring those closure to GRC intelligence, customer service and product/service innovation. I would look forward to greater dialogue in this regard from your side.

Thanks
Suvendu

A very valid futuristic and significant area which enables the business to exist, govern and comply with all statutory requirements so that it can create more money. Can a person with more than 8 year experience in internal audit kaizen, Balance Score card/capital budgeting and Statutory compliance and Corporate Governance feed the top management with effective suggest to keep the entity going....Can a BBM+MCA+ACS+CA(intermediate) with 9 year experience in risk management and corporate governance & statutory compliance enable your esteemed organisation to exist and take a giant leap into future....