GRC faces challenges

Despite the benefits of an integrated governance, risk and compliance (GRC) system within companies and organisations, middle management are fearful of losing control in the decision-making process, according to compliance experts.

In a briefing paper released by Clayton Utz solicitors Randal Dennings and William Yao, a number of challenges have been identified by organisations attempting to integrate GRC.

Dennings said there was a perception by staff that the “initiative may have an ulterior motive, for example, cost recovery drive or head count reduction”.

“Business units and middle management are fearful of being marginalised as GRC responsibilities are devolved in those in lower levels of the hierarchy.”

According to Dennings, while most organisations currently maintain separate functions overseeing governance, risk and compliance frameworks and policies, there is a greater advantage in an integrated system.

“This model has traditionally been seen as having a distinct advantage of being able to quickly establish controls and policies specific to the organisation relating to the particular governance, risk or compliance failures or key risk areas.”

Dennings said there were a number of limitations to this approach, such as a disconnect between the three disciplines, possible inefficiencies or duplication, and a lack of transparency across these frameworks and the organisation.

“It is encouraging therefore that many GRC ‘leading organisations’ report that the further that they journey down GRC implementation, the greater the value that they identify is delivered via this approach,” he said.