In our recent webinar, which was co-hosted by Forrester, we discussed some of the most prevalent mistakes in implementing GRC.
Poor data governance, the need for data integration and aggregation, as well as flexibility in the data model and the GRC technology are all vital components of implementing an effective GRC program, yet they are often overseen, and at best underestimated.
Project Management Challenges
We didn’t speak about the more generic common mistakes in implementing GRC: project management challenges. The need for executive sponsorship is clear. The need for strong project management, and strong monitoring of scope is of great importance.
Implementing GRC technology involves many people, integrates many ideas, and can require adjustments in day-to-day activities. Very often people involved in a GRC implementation are passionate specialists in their own fields, and not specialists in IT implementations. Scope creep or refinement of requirements becomes a discussion, and can endanger the project.
Somebody once said “begin with the end in mind” (Stephen Covey). This is something to bear in mind; what do you want to get out of the project: Whether the goal is compliance assurance, a certain consolidated risk report or cost reduction, it should be driving your process and your implementation. Throughout the project it is critical ask yourself whether the current process is pushing you further toward your end goal, and if it is not—to evaluate what changes in methodology will help you arrive there.
Tip: write them on the whiteboard behind your desk, and be sure to use a pen so you cannot wipe out your notes.
Luc Brandts is responsible for managing the development and execution of BWise products and technology vision. In his previous career as a business consultant, he managed projects in information technology, systems implementation, change management and business process optimization. His experience extends to industries such as financial services, government, manufacturing, healthcare and telecommunications.
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.
