|
by: Dilip Krishna
by David Rowe - Sungard on Jun 03, 2007 - 07:29 AM read 420 times Source: http://www4.sungard.com/blogs/riskManagement/?p=14#commen... |
|
What is needed is a good taxonomy of GRC. The lack of a classification scheme reflects the confused lines of authority of GRC initiatives in most organizations, and the lack of leverage of GRC investments. Until this happens the chances of effectively moving from a defensive to offensive risk management/GRC regime are slim indeed.
The possibilities are of course there for all to see - from leveraging and de-duplicating policies and controls (effecting cost reduction as well as enhancing control) to rationalizing and reusing immense spends on technology. All this can happen only in the context of an effective framework for GRC which needs to include things like SOX, AML, fraud as well as traditional risk management into a coherent whole.