Definition:
Every outsourced service must be delivered and managed to comply with applicable standards of “governance, risk management and compliance” (“GRC”) of the enterprise customer. Managing GRC requirements involves a collaboration of the business organization and its service providers. As such collaborations mature, they adopt shared tools. Some tools measure and report on performance for both SLA compliance and business metrics. Other tools enforce business rules and require approval by the compliance officer for any exceptions. In any event, GRC procedures have become not only contractual obligations, but also opportunities for competitive advantage and protectors of the business organization’s brand value.
BPM stands for business process management; it is a written procedure that is defined, mapped, repeatable, measurable, and manageable for change. It can also be described as the standard operating procedures for a company or enterprise.
Examples:
– Lean Sigma
– Activity- Based Costing (ABC)
– Total Quality Management (TQM)
Technical Requirements:
GRC and BPM require, above all else, an investment of time, money and energy for a company. Unfortunately, many times corporations do not have the means to properly measure the productivity of a particular business process at an acceptable level. For many business organizations, key performance indicators (KPI’s) will often try to gauge productivity from a perspective that are required by senior managers. The issue is, however, that KPIs have a tendency to not scale downwards to obtain analytic intelligence on lower-level business processes and operational procedures. The platform a business organization decides to use will need to be vigorous in the areas of delivery, data storage, and has the ability to be dashboard enabled. Additionally, the platform must be able to comprehend how the enterprise processes strategic business assets, and needs to be able to handle unforeseen adverse issues in the global marketplace.
An expert in BPM with an interest in both the business and IT should most likely be in charge of the business rules and make sure that they can be accessed and distributed from some kind of web portal. Transparency in this process will also contribute to the success of it.
In order to properly outsource BPM and GRC, it needs to be understood that GRC is an ongoing process; all parties need to accept some degree of accountability. Risks should be shared and distributed, undertaken with an ideology of openness and fiduciary interest. It is also important to know what types of performance indicators will work the most efficiently for a business organization’s GRC objectives.
Benefits:
GRC is a function that requires attentions throughout the business organization’s supply chain management and is an essential element of managing the outsourcer. But some elements of GRC can also be an outsourced function, such as data serving breach management, identity theft repair, and mitigation services, SAS20 Type II repairing, and anti-bribery conference management.
The collapses of Bear Stearns, AIG, and Lehman Bros. demonstrate the impact of GRC programs on the viability of the business organization. Outsourcing GRC allows a company that specializes in compliance function to bear some of the heavy burden that comes with GRC and BPM on a company. Using a service provider that specializes in this area will allow for the enterprise to focus on other areas that it may find more profitable, while managing specifically identified compliances risks.
Using outsourced service providers or software to maintain GRC and BPM also allows for more transparency between the management and the employees. The economic crisis of a 2007 to 2008 also showed that internal audits were simply not sufficient to monitor GRC alone. The various programs and dashboards offered on today’s GRC market can alert enterprises when something goes astray within the company in a traditional statistical or data mining process that will keep shareholders, regulators, and board members informed of the daily activities of a corporation, while still allowing them to focus on their main objectives within the company.