GRC: Trying to take the bite out of risk

22.08.2012
These days, organizations are facing increasingly sophisticated information security attacks from multiple sources. At the same time, they're struggling to comply with a growing number of , and they're facing pressure to put in place better corporate controls.

One way to address this group of challenges is with a relatively new concept that has a variety of definitions in the marketplace: governance, risk management and compliance (GRC) technology.

GRC software tools--those designed specifically for IT-related data () and broader enterprise issues (), first appeared about 10 years ago. The software is designed to automate GRC processes, enable companies to integrate and manage operations that are subject to regulation, and implement an organized approach to managing GRC-related activities.

10 tips for implementing GRC

The core functions of GRC software are content/document management, workflow, a relational database for mapping GRC components (such as risks, requirements, controls, assets and processes), and reporting, according to Chris McClean, senior analyst at Forrester Research in Cambridge, Mass. Rather than having to store GRC-related data in multiple silos, companies can leverage a single platform to track activities and enforce rules and procedures as needed.

"Most GRC software implementations are used to facilitate manual processes with workflow and standardized forms," McClean says. "Most of these tools allow customers to pull data from other systems as reference information for risk/control measurement, and in some cases organizations are using these capabilities to automate risk assessments and control tests."