Management Platforms and Governance MSDs for Corporate Oversight

By Kenneth Tombs

This Executive Briefing Paper discusses the integration of Governance, Risk Management and Compliance (GRC), into contemporary business practices highlighting Management Systems and Dashboards as key tools.

Introduction

This paper brings together key learning from the transformation of Governance Risk Management and Compliance (GRC), within the business operations of a leading cloud services provider. Highlighting the role of intelligent Management Systems and Dashboards (MSD) in providing a real-time overview of GRC and other management functions.

Here we are drawing upon three years’ experience of implementing GRC cloud software, for a customer’s operational management system, enhancing their compliance, standards conformance, and the customer’s operational delivery. Overall, some 28 governance and operational functions came together as modules or data representations in their management system - audited successfully several times during implementation.

In the dynamic landscape of modern business, the integration of Governance, Risk Management, and Compliance (GRC) into everyday operations is essential. Intelligent MSDs serve as the crucial tool in this integration, offering a centralised, real-time overview of the various GRC functions.

Key benefits of intelligent MSDs including applications are enhancing visibility, risk management, compliance, strategic decision-making, performance appraisal and analysis. It details various governance modules like board and strategy management, policy and audit management and risk and compliance management. This paper outlines implementation considerations, emphasising flexibility, data integration, technical architecture, user accessibility and security.

Enhanced Visibility: MSDs aggregate data across different domains, offering a unified view of performance metrics and risk indicators. Managing GRC registers and analysis on live applications within the same MSD environment, makes cross-referencing straightforward, reporting and calendar more accurate, while minimising risks of gaps or missed opportunities the GRC exposes.

?

What were their challenges?

In larger businesses, the oversight of a management system tends towards separate functions lead by different individuals. While those individuals often champion improvements to their own areas of responsibility, rarely do we get concerted improvements to GRC.

In the smaller business the oversight of governance sits with the proprietor or founder-directors. Brain-space and resource are the major constraints, forcing a constant trading-off between the urgent and the important.

Often what drives improvement or even a total transformation, are factors such as rapid growth, globalisation, corporate acquisition or demerger, recovering from a major incident, or where grouped management systems previously aligned for fundamentally different purposes. As corporate and strategic change becomes ever more common, arguably, management systems must become generic as in readily capable of weathering major changes to corporate structure, operations, standards or stakeholders.

What were their implementation constraints?

The businesses board had been a long-term supporter of GRC as part of its Business As Usual (BAU). Budget was not particularly an issue other than keeping spend relevant. They had benefitted previously from a relatively small, most experienced and close-knit team, where much of its GRC happened without team members thinking too much about it. However, as the company begin to grow fast and into many differing territories, the risk emerged of not being aware of, and in control of, its real risks and threats. The main constraint was the availability of people for data-preparation and process elicitation, fortunately these setup preparations quickly settled to a more manageable level and became part of BAU.

What were the lessons learned?

A clear leadership vision of requirements and their level of sophistication, made it easier for their various teams to share that vision. This acceptance made easier by already have a level of GRC operating within the business, people had accepted GRC was part of their day job. Being honest when things didn’t work and swiftly making changes, even if seemingly at odds with previous methods, while respecting people have their regular duties to attend to. Avoiding unless critical, modifications to the cloud software – using what was readily available. As for any IT involving project, need-creep and reinventing previous wheels is inevitable and strictly avoided. Remaining aware of, and providing for, the needs of different audiences from the GRC, board, executive, customers, financial and auditors. Assets were not just the physical, they included virtual and data; anything used by the business was an asset and therefore easier to manage in threat and vulnerability terms.

What were the costs?

The direct cost stabilised at less than 1% of the business’s turnover. Put simply, having an effective GRC/Management System negated the considerable risks of failed customer contract conditions, missed vulnerabilities, not anticipating likely threats and handling the inevitable issues arising in the normal course of business. Whilst it took three years to embed robustly into the business, immediate and demonstrable benefits resulted after four months of starting the transformation.

Why so long to implement?

The baseline management system was remarkably swift to implement, a matter of a few months to a workable first-generation proposition. Beyond this was the much longer journey of decisions, review, revisions, audit and such; effectively learning and improving as their journey progressed. Thus, the customer moved on swiftly and with relative ease, from generation one to something wholly owned by, and operational within, the business. It became a true representation of the business’s practices, not the determinant of those business practices. Had there not been an external audit cycle to observe, then those three years would most likely have shortened to two.

Importance of Management Systems and MSDs

MSDs facilitate informed decision-making by providing executives and managers with a comprehensive view of their organisation's operational health. Proven benefits included:

Enhanced Visibility: MSDs aggregated data across various domains, offering a unified view of performance metrics and risk indicators. The leadership, executives and directors could cross-check activities with less reliance upon personal reporting.

Risk Management: Real-time data aided in identifying, assessing, and mitigating potential risks before they escalated, with identifying risk-opportunities where the business could benefit.

Improved Compliance: By tracking regulatory requirements and compliance status, the MSDs assisted in maintaining adherence to legal standards and contractual commitments.

Strategic Decision Making: Access to real-time data and analytics enabled the leadership to make evidence-supported decisions.

Performance Appraisal: As actions, commitments, goals, and promises are clear in their progress, this enables board or executive interventions and support to be timely and more appropriate.

Analysis, Prediction, Response: were significantly enhanced avoiding data transcription errors, more robust data sets minimise gaps in usable data, managing crisis, threats and vulnerabilities are better understood and managed.

Integrated applications modules: having key functions such as risks, controls and similar registers, within the MSD software itself, helps lower the costs of implementing such tools and maintaining them over time.

?

Governance Modules

Business governance typically consists of several key modules or components that work together to ensure the effective management and operation of an organisation. These modules include strategic planning, which involves setting the company's long-term goals and objectives; organisational structure, which defines the hierarchy and reporting relationships within the company, risk management, which assesses and mitigates potential threats to the business, compliance and ethics, which establish guidelines for ethical conduct and regulatory compliance, financial management, which oversees the company's financial health and resources, and performance measurement, which tracks and evaluates the company's progress towards its goals. Each of these modules plays a crucial role in maintaining transparency, accountability, and sustainable growth in a business, contributing to its overall success and stability.

Board Management: Facilitates efficient board meeting planning, document management, and decision tracking.

Strategy Management: Becomes practical to continuously adapt rather than tactically fix over the short-term.

Policy Management: Centralises the creation, approval, distribution, and review of corporate policies.

Audit Management: Streamlines audit planning, execution, and reporting, enhancing governance processes.

Risk Management Modules

Risk management is a fundamental module within the framework of business governance. It encompasses the identification, assessment, and mitigation of potential risks that could impact an organisation's operations, finances, reputation, and overall objectives. By thoroughly analysing internal and external factors, businesses can proactively identify risks, evaluate their potential impact, and develop strategies to either mitigate or transfer those risks. Effective risk management helps companies make informed decisions, allocate resources wisely, and maintain resilience in the face of uncertainty. It plays a pivotal role in ensuring the long-term sustainability and stability of an organisation, fostering a culture of risk awareness and responsible decision-making throughout the business.

Risk Assessment: Automates risk identification, evaluation, and prioritisation processes.

Incident Management: Captures and manages information related to incidents, facilitating analysis and response strategies.

Business Continuity Planning: Supports planning and execution of strategies to ensure business operation during and after a crisis.

Risk Management: Real-time data aids in identifying, assessing, and mitigating potential risks, as well as spotting opportunities.

?

Compliance Modules

Compliance modules are a critical aspect of business governance, focusing on adherence to legal, regulatory, and ethical standards. This component ensures that an organisation conducts its operations in full compliance with applicable laws and industry regulations. It involves establishing clear policies, procedures, and controls to prevent, detect, and address any breaches or violations. Compliance modules encompass various areas such as data protection, anti-money laundering, environmental regulations, labour laws, and more, depending on the industry and geographical location. By effectively managing compliance, businesses can mitigate legal risks, uphold their reputation, and gain the trust of stakeholders, including customers, investors, and regulatory bodies. This module plays a vital role in maintaining the integrity and ethical standards of an organisation while safeguarding against potential legal and financial repercussions.

Regulatory Compliance Tracking: Monitors changes in relevant regulations and tracks organisational compliance.

Compliance Reporting: Generates reports for internal and external stakeholders, ensuring transparency and accountability.

Data Privacy Management: Ensures adherence to data protection laws and regulations, like GDPR, through continuous monitoring and control.

Improved Compliance: MSDs assist in tracking regulatory requirements and maintaining adherence to legal standards.

?

Implementation Considerations

Implementing management systems is a crucial step in ensuring the efficient and effective operation of an organisation. These systems provide a structured framework for planning, organising, and controlling various aspects of the business, ranging from quality and environmental management to information security and occupational health and safety. The process typically involves defining objectives, setting policies and procedures, allocating resources, and monitoring performance against established benchmarks. Implementing management systems helps organisations streamline their operations, improve consistency, reduce risks, and enhance overall performance. It also facilitates compliance with industry standards and regulations, which can be essential for gaining the trust of customers and stakeholders. Successful implementation requires commitment from leadership, employee involvement, and ongoing assessment and improvement to adapt to changing circumstances and goals. Ultimately, management systems serve as a cornerstone for achieving organisational excellence and long-term success.

Flexibility: MSDs should be flexible to cater to the unique needs and Critical Success Factors (CSF) and Key Performance Indicators (KPI) of the organisation. MSD items suited to today’s leadership purposes may need to change for future purposes, yet be able to switch back to historic items when again those purposes change.

Data Integration: Seamless integration (applications interfaces), with existing systems is crucial for accurate data aggregation and reporting.

Technical Flexibility: The architecture of a MSD should, arguably must, include processing within the MSD environment, as well as linkages to other more substantial platforms such as resource planning, or logistics. This will be enabled through common data interchange mechanisms, suggesting that technical simplify and commonality are best to pursue.

User Accessibility: Ensuring ease of use and accessibility for various user groups and audiences promotes adoption and effective utilisation.

Security: Robust security measures are essential to protect sensitive data and maintain compliance with internal security and data protection regulations.

Strategic Decision Making: Access to real-time data and analytics supports evidence-based strategic decisions.

?

What was the solution deployed?

While the details of the overall management system are confidential to the business, broadly the functions integrated across two platforms. An intelligent process management platform combined with the GRCOne Limited software, together represented in the following governance diagram.

?Performance Appraisal and Analysis: These MSDs facilitate performance appraisal, making leadership actions, goals, and promises clearer and allowing for timely interventions.

?

Conclusion

In conclusion, this paper on management systems as MSDs, underscores the critical role these MSDs play in enhancing the effectiveness and efficiency of Governance Risk Management and Compliance (GRC) within a business. By offering real-time insights into performance metrics, risk indicators, and compliance levels, MSDs empower organisations to make informed strategic decisions, manage risks proactively, and ensure regulatory compliance. The integration of such MSDs into business operations is not just beneficial but essential for fostering a culture of transparency, accountability, and continuous improvement. As businesses larger and smaller navigate the complexities of the modern business environment, the adoption and effective utilisation of management systems and MSDs stand out as a key factor in achieving operational excellence and sustainable growth.