SHOP SMART: 4 Steps to Successfully Adopting a GRC Solution

SHOP SMART: 4 Steps to Successfully Adopting a GRC Solution

In the Mid-digital age, firms are increasingly investing in software
to support governance, risk, and compliance (GRC) management activities.
Nevertheless, selecting the right GRC system for your organisation and
implementing it successfully is no easy task.
By outlining and examining four crucial phases in the process, this
article aims to help you steer a clear path towards success.

The GRC System- Phases, Rules and Pitfalls:

There are four key stages in the successful purchase and
implementation of a GRC solution which the diagram below highlights. We will
examine each phase in greater detail to help you shop smart.

 

1. Preparation

The first rule is to be realistic when shopping around for a GRC software solution.  A digital solution is a tool to aid efficiency. It will not do risk management for you, but rather support your organisation with risk management issues.  As such, any organisation looking to purchase GRC software will need to make sure they have a specific operational risk management (ORM) framework beforehand.

Another common mistake is to implement a GRC system without first reviewing your firm’s existing risk framework. Risk managers need to be aware of gaps and weaknesses in order to make a more informed choice about which system is most suitable. The framework dictates the GRC system that supports it, not the other way around. If for example, your ORM framework is over-complicated then simplify it before unnecessary complexities get transferred to the software. Or if your framework is immature make sure the software you choose is suitable for your organisational needs.

Thirdly, implementing a new or first-time GRC system is like any other important project, and therefore, needs a business plan. You will need to consider:

1. What will the GRC system be used for?

• • Will the system cover the full scope of compliance? Will you use it for reporting? Or will it be used for just operational risk?

1. Who will the users be?

• • Number of users and administrators will influence the intricacy and price of the system. Ask yourself: How widely does the business need the first, second and third lines of defence to use the system?

1. Who will own and maintain the system?

• • Do risk managers want a system that integrates with some or all of the other systems? Who will decide on the interfaces and manage them?

A strong business plan and the answers to these questions above will greatly influence the next phase in your journey.

2. Selection

There are a variety of GRC systems on the market differing in cost, appearance and functionality but how do you know which one is right for your organisation? Firstly, you need to be clear about what you want out of a system. You need to make sure the solution you choose has the core functionalities you require.  It’s easy to be distracted by impressive features but you need to ask yourself whether they will be of any use to your business circumstances. It also pays to be aware of future regulatory developments so that the system you go with can develop with the regulatory environment.

Secondly, good vendor procurement depends on investigating and reviewing a range of GRC systems as well as the vendors and teams that will work on the project. Shop around. Risk managers can even create a scorecard so that they can tally up the merits of each system in accordance with the needs of the company.  GRC solutions can then be evaluated against one another to see which is most suitable.

Lastly, do your homework. Ask your vendor for a demo and ask around to see if you can get a balanced review of the product.  Before you sign on the dotted line make sure you’ve fully read the contract and are sure of what you are buying.

3. Implementation

Once you have selected your GRC system it is vital that you dedicate enough time and resources to implement it correctly. Implementation should be treated as a major change programme with senior-level support. It is hugely telling that many vendors insist on an internal project manager before they start the project. Neglecting to dedicate a professional project manager for the duration of the implementation is a pitfall you want to avoid.

Failure at this stage can also occur when firms try to implement too quickly. Take things steady with a pilot project and a gradual rollout. This way you can develop risk champions who can assist with a smooth company-wide integration.

Configuration and migration can be problematic parts of implementation but hopefully, you will have done the groundwork by following guidelines from the phases above.  Once the ORM framework is in good shape the main challenge is to configure the system so that it aligns with the organisation – the group structure; entities; functional structure; user-profiles and risk framework, including taxonomy, scoring matrices, and risk and control libraries. Be certain about what existing data to transfer to your new system. Complete a rigorous cleansing exercise so that only accurate data is migrated over. Migration can be especially challenging after mergers, requiring the mapping of data that may be organised and labelled differently. Recent machine learning techniques can be a great help here.

As configuration and migration decisions are critical, we suggest avoiding implementation during the summer months, when due to annual leave, poor decisions and delays may result.

4. Utilisation

Once the system is configured ensure that your primary users complete comprehensive user acceptance testing. Vendors often provide a checklist so that your users can log any issues, glitches, or design changes to the configuration. Adequate testing will only increase the chances of success for your solution.

As with phase 3, it is important to try to avoid cutting corners to accelerate rollout. Take things slowly. Prioritise training for a number of main users who will develop a good understanding of the system and add valuable insight through testing. Those users can then go on to train others in small stages to ensure effective use and adoption.  However, do make sure there are enough super-users to support and maintain the system, as the loss of a key person could be detrimental going forward.

When you are established, keep in mind that over-customisation is a trap that many firms fall into. Resist the temptation to replicate what your organisation was doing in a spreadsheet and instead harness your system’s inherent benefits. Too much customisation sacrifices these benefits and makes upgrades difficult.

Continuous Dialogue Throughout

As well as this four-phase process, good communication is essential for the successful adoption of your GRC system. You will need to work in partnership with your vendor from beginning to end. During the testing and the final configuration phase, ensure there is a continuous dialogue between your vendor, the project team and the early adopters. This is key for successful implementation and utilisation of the new system, as you must achieve a common understanding and purpose.

Here at 1RS, we believe in supporting our clients during every step of their journey – and beyond.

Following an in-depth assessment of your organisation, our team will configure your 1RS solution so that it fits the size and needs of your organisation while ensuring complete compliance. We then guarantee all structures are correctly and effectively embedded through ongoing monitoring.

Our GRC tool is designed by risk and compliance practitioners, for risk and compliance professionals.

Book a call with us, to find out more