The Business Case for Integrated GRC DEVELOPED BY

Integrating governance, performance, risk, internal control and compliance management (GRC) activities yields a number of
benefits. These interrelated activities have much in common; and an integrated approach can improve performance while
reducing costs. Importantly, integration does NOT mean consolidation. Rather, the various GRC areas should adopt a common
vocabulary, methods and, if appropriate, shared technology and shared services to be more effective, efficient and agile.

LACK OF EFFECTIVE EFFECTIVE OVERSIGHT

CURRENT OVERSIGHT FUTURE
STATE !
! ! STATE BENEFITS
higher quality information
INTEGRATED Integrating GRC information allows
ETHICS INTEGRITY
REPORTING management to make more intelligent
& ANALYTICS decisions, more rapidly.
ORGANIZATIONAL
& FUNCTIONAL DISJOINTED STRATEGY process optimization
SILOS LACK OF POOR INTEGRATION All non-value-added activities are
VISIBILITY DUPLICATION eliminated and value-added activities
INTEGRATED are streamlined to reduce lag time
Business GRC STRATEGY Financial and undesirable variation.
Operators Executive
Audit
Executive
Risk better capital allocation
HIGH Executive
Legal, HR, Identifying areas where there are
COSTS IT + Other Compliance redundancies or inefficiencies
COMPLEXITY Executive
allows financial and human capital
to be allocated more effectively.
INTEGRATED RISK &
CONTROL ACTIVITIES
SLIPPING THROUGH FRAGMENTATION improved effectiveness
WASTED Overall effectiveness is improved
THE CRACKS INFORMATION as gaps are closed, unnecessary
WASTED
redundancy is reduced, and GRC
RESOURCES activities are allocated to the right
individuals and depar tments.

protected reputation
INTEGRATED & QUALITY Reputation is protected and
INFORMATION enhanced because risks are
UNNECESSARY managed more effectively.
SH A R ES
ED TECH ERVIC
LACK OF INTEGRITY
COMPLEXITY NOLOGY SH A R ED S reduced costs
COMMO UL ARY
COMMON VOC AB
N METHODS Reduced costs help to improve return
on investments made in GRC activities.

MAKING THE CASE FOR CHANGE

When making the business case
for change, you must clearly Revisit & Redefine Values Understand “As-Is” and Analyze Costs & Benefits Make The Financial Case Decide & Commit
understand your stakeholders and Objectives Define “To-Be” States of Multiple Options & Tell The Strategic Story Make a formal commitment to
Gain an understanding of the current move forward and accomplish
and the things that matter Focus on the most important Determine what it would take to Numbers only tell half of the story.
enterprise objectives to make the way that GRC activities are approached. achieve the to-be state. Consider Ensure that the case tells both the your goals. Leadership must be
most to them. Define a vision for the future. committed to both the goals and
case for integrated GRC. multiple options to avoid myopia. financial and strategic story.
the approach.
• Revenue • What do we value? What are our objectives? • What are the current costs? • What are the people, process and • What are the people, process and
• Customer Attraction & Retention • Determine the path forward
• What will drive value and objectives? • Where is there unnecessary redundancy? technology elements? technology elements?
• Profitability (Lower Costs) • Measure and assess the net
• What are the major opportunities? • Where are the gaps? • What are the costs to get there? • What are the costs to get there? How value of change
• Asset Utilization • What are the major risks? • What do we want to look like in the future? How will costs change? will costs change? • Commit to achieve the benefits,
• Asset Protection / Security not to simply do a project
• What are the “strategic hooks” for the case? • How will we measure success? • What benefits are expected? • What benefits are expected?
• Workforce Performance
• What will be different? • What will be different?
• Reputation / Brand Protection

Contact info@oceg.org for comments, reprints or licensing requests ©2007-2015 OCEG for additional GRC illustrations and resources visit www.oceg.org/resources