How to Create an Effective GRC Program: 3 Phases

The world of risk management and compliance is evolving as risks become more complex and challenging to manage. A constantly changing risk landscape demands that organizations adapt quickly to new regulations, emerging risks, and other factors that endanger their operations. Effectively managing these challenges requires more than merely having a governance, risk, and compliance (GRC) program that grows and matures with the business. However, implementing such a program can be daunting, and organizations may struggle to know where or how to start. 

A "crawl, walk, run" approach enables an organization to start on a path to greater risk maturity. 

Phase 1: Crawl

The earliest phases in the GRC maturity process are the simplest. Immature GRC programs generally use either ad hoc-based decision-making or policy-based decision-making. Ad hoc decisions are highly reactive by definition; with no processes to guide decisions, leaders consider, act, and move on to the next problem. This approach relies on a "hero" mentality, with a few people making impromptu decisions. These hasty choices often arise from customer complaints, governance agency inquiries, or audits. Ad hoc risk management decisions focus purely on putting out fires.

Policy-based decisions are the first small step out of the vicious cycle of reactive risk management. This decision-making approach develops an organization's appetite for risk. The key to succeeding in this early phase of GRC maturity is thinking in terms of people, process, and technology — in that order. Moving from spreadsheets and emails to more agile GRC software will improve your risk posture, but only if you achieve buy-in from key leaders and develop reliable processes to complement robust technology.

Establishing guidelines and rules for an organization's approach to risk requires an understanding of the needs and perspectives of stakeholders in other parts of the business. Show these stakeholders that you want to partner with them for better outcomes. Knowing what risk means to every department will help break down silos in your organization while guiding your policy development. 

After establishing some initial policies, you might be tempted to execute them all — immediately. Instead, focus on introducing risk policies before trying to execute them. After you've gained trust by listening to your leaders and employees, educate them on the company's risk posture. Take steps to strengthen or create business continuity plans for each department, assess the effectiveness of its current controls, and introduce any necessary new controls through testing and implementation processes.

Consider focusing on a specific department, perhaps the one at the focal point of a cyber incident that triggered your interest in more proactive risk strategies. 

Phase 2: Walk

The "walk" phase includes risk–model-based decisions and system-driven decisions. 

Risk model-based decisions

Organizations pursue risk–model-based decisions when they commit time and focus to their risk management program. They identify a risk model — like the NIST or ISO27005 model — and begin to take an inventory of all the risks present in their organization. 

Some leaders use a risk model to audit their entire organization. Depending on its maturity, your model should provide either quantitative or qualitative outputs about your risks. You'll see the probability of a risk, how your existing mitigating controls affect the risk, and whether you have pressing vulnerabilities. From there, you can dig deeper to understand and rank vulnerabilities. 

Most leaders identify more risks than they can mitigate and must prioritize. The easiest fixes should happen first. A risk that requires as much (or more) time and money to mitigate as its potential fallout will rank lower on your list. 

Systems-driven decisions

This approach includes integrating systems, getting rid of spreadsheets, and feeding information into GRC software. When you can pull in incidents from your other applications, your GRC technology will surface insights to drive better decisions. You'll have greater agility in accepting versus mitigating risks, incorporating security scorecards and threat assessments to take in information. This works as an "alive system" to complement risk models and scale risk management. You'll add workflows with automation, augmenting people with machines to improve speed, agility, and efficiency while collecting more and better data to drive continuous improvement.

Phase 3: Run

Though aspirational for some organizations, this phase promises risk-driven decision-making, powered by machines, integrations, and code. When risk drives everything, it illuminates strategic advantages. 

At this maturity level, you're performing risk analysis, and incorporating risk quantification to assign financial value to risks. But not every risk is worth the effort to develop a quantitative metric. Many programs start with the most high-value risks to better understand those big-ticket risks. 

If you're doing business in 2023, reducing cyber-risk is a priority. By quantifying cyber-risk, you'll more clearly understand and be able to report the scale of the loss your organization could experience without an effective cyber-risk program. Using the language of business (monetary value) to communicate cyber-risks, you'll get leadership's attention. Nothing spurs leadership to take action quite like an impending major financial loss.

One Step at a Time

Building and maturing a risk program may seem like a steep climb, but you must start somewhere. Take one small step at a time with the "crawl, walk, run" approach. Get your policies in place early on and educate line-of-business leaders about their risks as you build. Remember to think in terms of people, process, and technology, with people forming the foundation. Following these principles to establish a comprehensive and effective risk program tailored to your organization's needs.