Shared Experiences in GRC

This week we reflect on our time in compliance and try to extract some common themes that seem to make compliance smoother and put control over compliance risk back in the hands of the compliance professionals (who CAN'T just be check mark chasers if compliance burden is a concern). We share how lessons we learned from the CPA exam, defense lawyers, and criminal trials influence our thinking about compliance programs and, in turn, how we thought about structuring technology to help.

This week we use basic scenario modeling (or simulation analysis) to enhance risk management. Scenario modeling enables more informed risk decisions by considering the universe of potential outcomes of a risky scenario. By understanding the probability of outcomes that are in or out of the organization's risk tolerance, we can make quantified decisions that also impress management! In a real case study from the Arizona State Lottery we'll find out if the pick 3 lottery really is truly random!

This week we talk about managing risk events. What are risk events? Anything from an ethics hotline reports, conflict disclosures, security incidents, sexual harassment incidents, unexpected financial instrument value fluctuations, physical security breaches, vendor failures, etc., etc. No matter which function you're in, centralize the capture, review, and remediation of these events to maximize assurance while creating insightful reporting and automating the process.

This week our hosts, Dan Zitting and Kevin Legere, talk about having a roadmap for SOX that will differentiate the value your program delivers. Most companies have basic SOX testing nailed down now, but it's still far too manual and far too inefficient. These types of SOX programs are growing stale. Additionally, robotic automation is coming to SOX, so we can either be building the automation or be automated away. This episode lays out the maturity curve to push toward getting there.