Governance, Risk and Compliance: Joined at the Hip by Data
Faced with a complex and fast-changing business climate, an increasing number of organisations in all industries are taking a broader, more integrated approach to managing governance, risk and compliance (GRC) than in the past. Moving away from the traditional method of addressing specific regulatory mandates and silos of risk independently, they are striving for sustainability, consistency, efficiency and transparency in all the GRC processes across the enterprise. The strategic benefits include lower cost and more comprehensive risk management and compliance, coupled with increased business agility and faster, better decision-making.
A number of trends have combined to cement the need for integrated GRC strategies in the minds of savvy executives and board members. Regulatory agency scrutiny continues on the upsurge. Investors and potential business partners are focusing increasingly on corporate behaviours and procedures. The recent litany of high profile risk management failures – from the sub-prime lending debacle to runaway trading losses at leading institutions – is fuelling tighter regulation and drawing legislative attention. And regulations are starting to require defined risk management strategies, prompting many businesses to combine their risk and compliance functions.
As organisations move towards a more structured, unified approach to GRC, all the traditional concerns and issues around data – its trustworthiness, accessibility, timeliness, security, relevance and quality – are greatly amplified. Mounting business complexity, global operations, re-engineering and widespread outsourcing have resulted in unprecedented new risks that, when coupled with the today’s steady stream of new rules and regulations, make trusted, timely and high quality data all the more important for effective risk management and timely regulatory reporting. Unfortunately, the data used to manage GRC on a global scale becomes increasingly fragmented across geographies with the introduction of each outsourced system and process and each outside data source.
Moreover, as risk and governance functions merge, the inter-relationships and interdependencies come to the fore, placing a further premium on complete, trusted and timely data, and on a coherent, unified approach to data integration. Far too many organisations are saddled with duplication of technologies and efforts, multiple data quality and data integration rules and standards, and inconsistent approaches to accessing and delivering data for various risk and compliance activities. As risk and compliance functions merge, and integrated approaches to GRC emerge, it’s incumbent on organisations to avoid perpetuating these silos of information, technologies and processes going forward. While the growing need for an encompassing GRC strategy may have the board’s attention, these challenging economic times don’t allow for redundant investments and uncoordinated solutions.
Here is a blueprint for organisations looking to leverage trusted, timely and high quality data within their GRC strategy:
Any investment made in data processes is redundant if the data cannot be trusted due to quality concerns. From data capture errors to poorly executed data migrations and system consolidations, poor quality data can seep insidiously into an organisation’s processes on a daily basis. Some regulations require demonstration of data quality via data quality scorecards. Implementation across the enterprise can be challenging without the proper technologies and processes in place. Hence the primary stake in the ground is to put into place tools and processes that identify, quantitatively measure, continuously monitor and proactively improve data quality.
Risk and regulatory pressures affect companies at an enterprise versus departmental level, and the data required to effectively address these pressures is scattered across the enterprise and beyond in a huge diversity of applications, databases and formats. Packaged applications such as ERP aside, much of the data required for GRC is housed in difficult to access mainframes and in unstructured formats such as Excel, PowerPoint and PDF files. Not only do you need to efficiently get to all this data, but you also need tools to help profile it for data quality issues, gaps and incompatibilities.
When combating risk, time is more often than not an enemy. You cannot afford to rely on data that is out of date. Hence, organisations need the ability to capture data as it is created directly from transactional source systems, identify what is changed, and then cleanse, transform and deliver the data at any speed – real-time, near real-time or batch – for meaningful analysis and use.
The costs of producing timely, trusted data can be prohibitive without appropriate processes and technologies. Organisations can decrease data acquisition, integration, cleansing and delivery costs by adopting an integration competency centre (ICC) approach. Essentially, an ICC optimises resources by combining data integration and quality skills, technologies and processes in one group. Through the reuse of tools, best practices, data interfaces and mappings, and business rules, an ICC can speed project delivery and slash development and maintenance costs. Duplication of data integration and quality efforts is minimised, as an ICC can leverage past successes rather than reinventing the wheel with each new project.
SOX and Basel II, among other regulations, require auditable processes and documentation on how your data is produced and used. For example, financial institutions can reduce Basel II capital reserve requirements by having an auditable data integration process. But again, this can be costly and exceedingly difficult without the proper technology and architecture. Specifically, you want the capability to leverage all your metadata to understand the lineage of data elements and identify data sources, transformations and changes. At the same time, you can leverage metadata to understand the impact of making changes to a database on existing reports and processes. Thus armed, you are better able to implement repeatable, methodical processes for data integration and delivery and comply with audit requirements via automatic documentation of data processes.
So much of the critical data in the enterprise today used for GRC is in the form of complex data, historically difficult to access and hard to integrate with other enterprise data. This includes the unstructured data of spreadsheets, the semi-structured data of legacy formats and standards such as SWIFT, and complex structured data. Organisations need to exchange complex data in a variety of integration scenarios, within and increasingly across enterprise boundaries. You need a platform and automated process for taking in this information from any system, translating it, and delivering it in a usable form to any user or system. Trying to do it in a custom-coded, piecemeal fashion results in a hairball of costly, brittle and inefficient interfaces that hamper agility and decision-making.
Governance, risk and compliance are today inextricably linked. Thus it is essential to have a comprehensive platform and process for meeting the numerous data integration, data quality and complex data challenges around GRC, enabling companies to confidently address all regulatory- and business-related risks, optimise business processes and decision-making, and achieve compliance at a lower cost. An effective enterprise GRC strategy hinges on effective enterprise data integration. Without access to comprehensive, trusted and timely high-quality data, it is impossible to manage all the myriad aspects of GRC in a holistic and strategic fashion.