Graham Packaging Case Study

ControlPanelGRC adds value to Graham Packaging's GRC efforts

The Customer

York, Pennsylvania-based Graham Packaging is a global leader in the design, sale and manufacture of value-added, custom blow-molded plastic containers for branded foods and beverages, personal care and specialty products, household products, and chemical-based products including automotive lubricants. Originally an extension of a design engineering firm, today the company has 80 plants employing approximately 7,500 people in 16 countries around the world. Although it is privately held, Graham Packaging is a registrant with the Securities and Exchange Commission (SEC) due to obligations in connection with publicly transacted bond debt, and thus is subject to the same governance, risk and compliance (GRC) standards as if it were publicly traded.

The Challenge

After Graham Packaging became a registrant with the SEC, the company purchased one of the first-generation GRC tools available at the time to help with Sarbanes-Oxley (SOX) compliance. While it definitely helped Graham Packaging save a significant amount of time and money versus performing completely manual tracking and audits, it was so difficult to install and use that even after several years, company officials were only able to take advantage of one-quarter of its functionality.

“One of the biggest issues we had was gathering the data in the first place,” says Jeff Rishel, Vice President – IT at Graham Packaging. “The GRC tool we had was fine once the data was in the system, but it still took a lot of man-hours to get it to that point. Even when it was in there, we were limited in how we could use it. But enabling the rest of the functionality looked to be a huge project, and one that we didn't have the resources to dedicate to.”

The difficulties of using the tool had a particular impact on the yearly audit that is required to demonstrate SOX compliance. Preparing for the audit required an information-gathering effort involving several resources for roughly one week. During that time, those resources were unavailable to perform other, higher-value tasks for the company.

“The tool we had was a step in the right direction,” Rishel says. “But we were ready to take another step.”

The Solution

“We recognized that SymSoft had a product that was significantly lower in cost and would be much easier to implement,” Rishel says. “We also saw that we'd get full value out of the system while achieving payback in less than a year. We were sold immediately.”

Originally, Graham Packaging was looking for ControlPanelGRC to replace the old tool for SOX compliance and Segregation of Duties (SOD) projects. Since installing it, however, officials have discovered it can do much more.

For example, when users are working on master data, ControlPanelGRC can transport it for them without having to go through the normal control processes. Users have faster access to master data without having to depend on IT for changes. Security is another area where Graham Packaging has seen improvement.

“We get questions about user access on a regular basis,” Rishel says. “Before, we had to check with the person in charge of security to get the reports we needed to answer those questions. Now that we have ControlPanelGRC, more people both in IT and on the internal auditing team are able to obtain the information themselves without compromising security. Overall, more people are able to do more things now in SAP. It has relieved some major choke points for us.”

Rishel also had high praise for the SymSoft team that has been helping Graham Packaging with the implementation and use.

“We feel like they are just another part of our team,” he says. “We know them by name and they know us by name. We're very comfortable with them. They're very quick to understand what we're looking for, which you don't often find. It's been a big factor in the overall success we've had.”

The Results

Graham Packaging began to see quantifiable results almost immediately. Rishel also says the company is on track to achieve a solid return on its investment and significant soft-cost savings, too. Moreover, there has been a significant impact on day-to-day operations.

“Through automation, we've already reduced the amount of repetitive tasks by 50 percent,” Rishel says. “But I can see it rising to 75 percent when we implement the full functionality.”

This automation of repetitive tasks has had an impact on the annual audit as well. Rishel estimates Graham Packaging has cut an entire week's worth of preparation out of the process.

“With our old tool, we had to gather all the information manually from various sources to give to the auditors,” he says. “With ControlPanelGRC, the information is already there. We can just pull it out of the system and give our external auditors access to it. It's much faster, more complete, and more accurate.”