GRC are necessary within enterprises but businesses tend to structure and run them differently. For example GRC may operate as three separate, siloed functions in some companies. Other companies have a GRC function that includes GRC specialists if not GRC certified professionals.<\/p>\n\n\n\n
Even when GRC operates as a combined organization, cyber security \u2013 another risk function \u2013 tends to operate separately. One of the reasons for that is because GRC functions are viewed as business functions while cyber security is viewed as more of an IT (technology-oriented) function. However, as any cyber security incident demonstrates, the scope of risk fallout tends to impact more than one function simultaneously.<\/p>\n\n\n\n
Governance is often thought of synonymous with data governance, but corporate governance has a higher-level responsibility. Corporate governance balances the interests of various stakeholders and it helps the company realize its strategic objectives through frameworks, rules, practices, processes and performance measurement, among other things.<\/p>\n\n\n\n
In a data-centric context, governance helps ensure that only authorized parties have access to the data they wish to use. Data governance rules eclipse compliance because the use of data is also governed by laws and regulations.
<\/p>\n\n\n\n
Traditional risk functions have focused on financial risks. Typically, this function has worked closely with, if not reported to, the CFO. Financial risks take several forms including vendor risks, business continuity risks and indemnification (insurance).<\/p>\n\n\n\n
Traditional risk management can sometimes be at odds with other groups, particularly when it\u2019s viewed as an obstacle to innovation. It\u2019s therefore important to determine what an organization\u2019s risk appetite is and to innovate within the scope of it. For example, Amazon has had some spectacular successes and failures because it was willing to take on significant risks to its bottom line, stock price and reputation.<\/p>\n\n\n\n
Compliance focuses on legal and regulatory compliance. This function must understand which outside rules the organization must adhere to and translate those rules into practices and processes that ensure compliance.<\/p>\n\n\n\n
Compliance is subject to audits internally and by third parties which may be consulting firms that are verifying whether their clients\u2019 companies are compliant. Alternatively, a regulatory auditor, may be doing the same. The various audits tend not to be mutually exclusive undertakings since the last thing a company wants is for a government auditor to discover a problem. If that happens, then the company will likely be subject to regulatory fines and if it\u2019s a public company, they\u2019ll have to disclose the issue to shareholders. If the violation has also harmed customers (e.g., PII misuse), lawsuits could also result.<\/p>\n\n\n\n
Modernly, compliance, like governance, has been strongly associated with data given the EU\u2019s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). However, the compliance function is broader.<\/p>\n","protected":false},"excerpt":{"rendered":"
GRC are necessary within enterprises but businesses tend to structure and run them differently. For example GRC may operate as three separate, siloed functions in some companies. Other companies have …<\/p>\n","protected":false},"author":4,"featured_media":1851,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[18],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/posts\/1845"}],"collection":[{"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/comments?post=1845"}],"version-history":[{"count":1,"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/posts\/1845\/revisions"}],"predecessor-version":[{"id":1847,"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/posts\/1845\/revisions\/1847"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/media\/1851"}],"wp:attachment":[{"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/media?parent=1845"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/categories?post=1845"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aimbix.com\/index.php\/wp-json\/wp\/v2\/tags?post=1845"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}