Cost-Benefit of Second-Generation GRC Solutions

Once in a while, you can be better off getting hit with that bullet you thought you dodged.

Business is an example where this can happen. Small to medium enterprises (SMEs) were left out of the requirements for Sarbanes-Oxley (SOX). Only publicly traded companies were “forced” to document processes for Governance, Risk management and Compliance (GRC) then to be confirmed by outside auditors.

But you know what? This turned out to be a good thing. The “big boys” found that by following a GRC regimen they were operating more efficiently, lowering their costs, driving innovation and becoming much more agile. And now, the technology to implement sound business practices, tight controls and agility is more advanced and significantly cheaper. So SMEs would be very smart to investigate the benefits of going with a second-generation GRC solution. Here are some of the things that should be a part of every solution they consider:

Minimizes risk. Every business, no matter what the size, has risks. Anytime you have human beings performing manual processes, there is a risk of something being done wrong – either accidentally or on purpose. In a privately held company, those discrepancies are potentially more devastating than they are in a public company. They are also much more personal. A second-generation GRC solution mitigates that risk by automating and regulating business processes. It can assure that all work is performed properly by refusing to allow completion of the process if it does not follow the prescribed procedure.

Tightens up business processes. When a business first starts out, all the rules and business processes are generally laid out and closely followed by everyone who works there. Over time, however, as the business expands, the processes tend to expand along with it. Different people have different ways of working, and will tend to do things in the way they are most comfortable – even if it conflicts with the organization’s best practices. Second-generation GRC solutions help rein in the “cowboy” approach by tightening up business processes, and then making compliance a part of the process instead of a separate operation. At the same time, if there are improvements that need to be made, they can easily be implemented across the entire organization rather than only affecting the originator(s). Ultimately, they create a culture of controls, making sure work is being completed by following the proper, repeatable processes instead of individual acts of heroism.

Improves change management. Anytime there is a change, it is important to document it in order to be able to trace back through any later problems. Yet documentation is often the bane of an organization – something its people know they should do but often put off in the interest of more urgent matters. Second-generation GRC solutions automatically create the documentation for any changes, assuring there is always a current and accurate record of every process from inception on. It also allows SMEs to make more changes within a given timeframe, helping them react more quickly to market pressures and opportunities.

Helps drive innovation.There are only so many hours in the day, and so much work each person in the organization can do. If that time is being spent performing manual tasks (such as documenting changes), it is not available for more high-value work. By automating tedious but necessary manual processes, second-generation GRC solutions free up those resources, giving them more time to drive innovation and help the organization gain a competitive advantage.

Increases agility. One of the theoretical advantages an SME holds over a large enterprise is agility. Smaller companies are expected to be able to react more quickly to problems as well as sudden opportunities in the market. But if they’re bound by outdated or slow business processes, that advantage is often lost. Second-generation GRC solutions help SMEs regain and even increase their agility, making them more competitive even in the face of factors they can’t control (such as the economy).

Eliminates costly, repetitive tasks in an SAP landscape. By its nature, SAP has many repetitive tasks. Take something as simple as provisioning new users into the system. This is normally a manual task that takes time away from more important work. Yet it is also the foundation for everything else that user will do in SAP, so it is important that it be done quickly and accurately. Second-generation GRC solutions can automate the process of enrolling users, with the appropriate controls and audit trail to assure everything is spot-on. As a result, SAP administrators spend less time on repetitive manual tasks, freeing them again for more high-value work.

Can be implemented in stages. Unlike the mandatory efforts for publicly traded companies that resulted from SOX, use of second-generation GRC solutions in SMEs is completely voluntary. As a result, they can be implemented in stages, allowing the cost savings from stage one to help fund the second stage, and so on. This option makes gaining all the other benefits much more palatable and realistic for budget-conscious organizations.