Governance, Risk and Compliance: A Strategic Alignment Perspective Applied to Two Case Studies

Abstract

Governance, Risk and Compliance (GRC) has become critical for organizations and so is the need to support this by ICT. This paper positions GRC into an integrated strategic perspective, providing guidelines to assess maturity and defining paths for achieving strategic alignment. The approach is applied to two case studies, clarifying the organizations' GRC maturity "as is" and "to be". These cases were studied in the utilities and financial sectors, both show that organizations can have similar GRC maturity levels but follow quite different paths to achieve alignment with regard to GRC. While the Dutch utility company stuck to a path where the organizational strategy with respect to GRC was taken as a starting point, the financial institution followed a path in which the IT solution strategy was leading. In interpreting this result, it appears that the existing IT assets are strongly impacting the selection of the alignment path. More case studies are advocated to further validate the approach and contribute to optimize the strategic and integrated perspective on GRC.

Enhancing banking performance through dynamic digital transformation capabilities and governance, risk management, and compliance: Insights from the Indonesian context

“…GRC ensures an organization performs optimally by following laws and regulations, managing risks effectively, and maintaining ethical standards (Mitchell, 2007; Spanaki & Papazafeiropoulou, 2013). Although the components of GRC have been implemented independently in the past, organizations have recently embraced a holistic approach to GRC to generate value and gain a competitive edge, thus providing it with a fresh perspective (Shahim et al, 2012). Despite its growing prevalence, there is no universally accepted understanding or definition of GRC (Curse, 2016).…”

A Human Resources Management Perspective on the Complementary Relationship between the Success of the GRC Model, Employee Perception, and the Impact of This Relationship on Performance

“…The following figure (2) illustrates the preceding: The risk management system is a risk standard and establishes the individual intellectual property of risks, while the governance, risk management, and compliance system provide a broader and more comprehensive framework and philosophy for communicating about governance and compliance risks, by enhancing the technology of reporting mechanisms, policies, and procedures, and risk assessment procedures (Shahim, Batenburg, & Vermunt, 2012). Consequently, it should be noted that the governance, risk, and compliance system is incomplete without adequate and trustworthy risk information, and that the risk management system cannot be appropriate or effective unless it is rooted in governance, compliance, and performance.…”

“…In the midst of the accelerating momentum of industrial and environmental changes and developments that the world is witnessing, countries cannot achieve their aspirations without formulating a vision for the future (Shahim, Batenburg, Vermunt, , 2012).taking into account the plans and objectives aimed at achieving it, as visions represent a real beginning to storm the future (Ramalingam et al, 2018).…”

Managing Information Security Risk Using Integrated Governance Risk and Compliance

“…and IT GRC 2.1 GRC Defined GRC is not a new concept since its components have been executed mostly in a fragmented manner, but the fact that organizations took a united perspective of this concept for creating added-value and realizing the competitive advantage, gave it a new perspective [20]. While GRC has come into increasingly common use, there is no proper universal understanding of the term or its objectives [22].…”

“…Subsequently, GRC is considered an emerging topic in the business and information technology world [4]. Being critical for organizations, there is a need to support this by information and communication technologies (ICT) [20]. But the main challenge behind GRC concept is that the integration of these three areas (governance, risk and compliance) is generally dealt with in silos [21].…”