Understanding GRC

[Former Member]

Hi,

I am very new to this domain and want to gain a good knowledge of it for practical purposes. I have started with reading various documments on GRC on the whole. I get a lot of functional material, but I am unable to comprehend it technically.

I also realize that no one has provided (or can provide...am not sure) a solution that ensures full compliance under SOX and other such acts. So do we try to look into some specific areas under one act only and try to make our processes compliant by implementing various controls?

Please correct me if I am wrong.

Thanks in advance.

Regards,

Latika.

[Former Member · Accepted solution]

It is conceptually impossible to provide a blanket 'solution' for you. Each organisation is different and has completely different GRC solutions. Rather than seeking a solution to GRC, you should be seeking an <b>approach</b> to developing a solution for your organisation.

[Former Member · Accepted solution]

Thanks Ramesh,Justin

So what I have understood from your replies is that a "solution" suitable for one organization may or may not be relevant for the other. That is our effort should first be at understanding the current processes of the organization and then modify the processes (if necessary) so that they are GRC enabled and during this excercise we may or may not be complying to any specific act like SOX.

Is it correct?

Regards,

Latika.

[Former Member · Accepted solution]

Hi Latika,

You are correct.

Every firm has processes peculiar to its own.Understanding the existing process is the crucial first step.GRC helps implementing the best practices in the processes and thus enables the firm towards the compliances.

Regards,

Ramesh

[Former Member]

Hi Latika,

The GRC does not have the tag of any specific Act,Rules,Regulations etc.

It is pertinent that all the regulatory acts such as SOX lay emphasis on the best practices.GRC enables the best practices.

The processes are the road map for achieving the goals;while the controls steer the organisation in attaining these goals.Thus the focus of this forum is upon understanding and analyzing the risks,controlling the identified risks by means of appropriate mitigation strategies thus enabling a good Governance.[ best corporate practices ].

The term "Good Governance" is very broad and exhaustive - Risk and control contribute to " Governance".

In light of the above, we are not trying to look into some specific areas under one act only.Rather we are trying to highlight the best practices in the processes.An understanding of the Risk and controls helps bringing about the best practices.

Hope this helps.

Regards,

Ramesh.