GRC Solutions - Creating a Successful Measurement Program

OCEG (Open Compliance and Ethics Group) just released GRC solutions within our GRC Metrics & Measurement Guide. For a limited time, learn how to create a successful GRC measurement program with these GRC solutions and guides for free.

This updated version of the OCEG GRC Metrics & Measurement Guide helps organizations understand the issues and processes involved to analyze the performance of GRC capability.

GRC Solutions Guide | Key Takeaways

• How to create a GRC measurement program
• Best practices for GRC measurement and analysis
• Key performance indicators to evaluate the GRC program
• Additional tools to support risk management, internal auditing, compliance, and ethics training.

The GRC Metrics and Measurement Guide walks you through implementing a GRC measurement strategy, selecting relevant indicators, and addressing challenges.

You can also use this guide to make the business case for improvement in your GRC measurement program, including the acquisition of technology that enables you to gather, visualize and analyze your GRC information.

What is a Successful GRC Measurement Program?

An effective GRC measurement program recognizes critical risks and applies controls where they will have the most significant impact. Success measurement is considered the absence of an event such as:

• Fraud
• A regulatory change invalidating a product line
• A successful network breach
• A critical system failure

Developing the measurement strategy and program is a distinct project that requires sufficient time and resources allocated to it for success. The development process begins with analyzing three areas: enterprise objectives, maturity objectives, and operational objectives.

Why Read the GRC Metrics & Measurement Guide?

This guide will provide you with the tools to evaluate performance and bring programs in-line with strategic business goals to create success for risk, compliance and audit executives and leadership with governance responsibilities.

The guide provides GRC solutions to:

• help anyone design and use a measurement program to monitor and report on their organization’s GRC capabilities,
• provide an overview of GRC measurement needs to those delivering the information and technology necessary to effectively monitor the performance of GRC capabilities,
• offer direction for internal auditors in their efforts to plan assessments and establish assessment criteria, and
• deliver insights to directors and executives charged with governance and oversight of GRC.

Learn how to:

• How to measure anything
• How to apply measurement techniques to assess GRC from a people, process, governance, and technology perspective, and
• How to determine what to measure for your specific needs

GRC Solutions & Guide Key Takeaways

• How to create a GRC measurement program
• Best practices for GRC measurement and analysis
• Key performance indicators to evaluate the GRC program
• Additional tools to support risk management, internal auditing, compliance, and ethics training.

The GRC Metrics and Measurement Guide walks you through implementing a GRC measurement strategy, selecting relevant indicators, and addressing challenges. You can also use this guide to make the business case for improvement in your GRC measurement program, including the acquisition of technology that enables you to gather, visualize and analyze your GRC information.

SMART GRC Solutions

Additionally, you will learn more about the following criteria which will assist you in defining key metrics and indicators that are specific/simple, measurable, actionable, relevant and timely (SMART).

Specific / Simple

• Is there a clear understanding of what will be measured? Is it easily understood?
• Would two different people measure it in the same way?

Measurable

• Is it accessible and worth the cost to obtain the data?
• Can it be quantified?

Actionable

• Are the underlying processes that can affect this indicator under our control?
• Once we understand the value of the indicator and any trends, will it be possible for us to take meaningful action?

Relevant

• Does the indicator capture the essence of the desired outcome?
• Will tracking this indicator drive the appropriate behavior – or generate unintended consequences?

Timely

• Can it be frequently updated?
• Will the indicator reveal itself in time to take appropriate action?

Ultimately, choosing the indicator is determined through a holistic assessment of validity, reliability, and practicality.

This article is just the beginning of what you will learn by reading our GRC solutions guide, "GRC Metrics & Measurement." We’d like to hear from you regarding any feedback you have; please feel free to reach out to us at support@oceg.org