Achieving the vision with enterprise governance, risk and compliance (GRC) - Seamless Collaboration

WHITE PAPER Seamless Collaboration Achieving the vision with enterprise governance, risk and compliance (GRC) SEAMLESS COLLABORATION Table of Contents Introduction......................................................................................................1 The Collaboration Imperative...........................................................................2 GRC Overview...................................................................................................2 Governance...................................................................................................3 Risk...............................................................................................................4 Compliance...................................................................................................6 Internal Control Gaps........................................................................................7 Overlapping Risks.............................................................................................9 Final Thoughts: Promoting Collaboration......................................................10 i SEAMLESS COLLABORATION The author of this paper was Clark Abrahams, Chief Financial Architect at SAS. Your comments and questions are valued and encouraged. Contact the author at 919-531-9316 or clark.abrahams@sas.com. ii SEAMLESS COLLABORATION Introduction “Mind your own business” is advice that, perhaps, has become somewhat obsolete. In an enterprise setting, policies and procedures often transcend departmental boundaries, and the actions taken by one group can drastically affect its downstream associates, or the entire enterprise. Hence, the distinction regarding what is considered to be an individual department employee’s business, versus another’s, has become increasingly blurred. The mindset is evolving more toward the admonition from senior management: “If you see something wrong and do nothing about it, then you become part of that problem.” Massive business failures and staggering losses have made risk management far too important a job to be delegated to others. Increasingly, managers – and employees in general – have adopted a broader view. They make it their business to ensure that the company they work for is doing the right thing. Recent legislation in the US has put real teeth behind this assertion. The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), enacted on July 21, 2010, established a whistle-blower program wherein whistle-blowers who report original information directly to the Securities and Exchange Commission that leads to successful enforcement related to a violation of federal securities laws can collect from 10 percent to 30 percent of the ultimate judgment, or settlement, amount. The new law prohibits retaliation by employers against whistle-blowers who provide information about potential securities violations, even if they are not pursued.1 In a recent pharmaceutical industry False Claims Act case, a single whistle- blower and her legal team were awarded $96 million of a $750 million settlement, of which $150 million was a criminal fine.2 This is not an isolated case. The US government recovered $3 billion in False Claims Act settlements and judgments in 2010. In today’s world, boards of directors and C-level management must govern a new brand of issue-surfacing culture, wherein an employee witnessing a potentially serious legal violation may have adopted a new mantra: “If you see something wrong, report it and retire early!” 1 Proposed Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934, 17 CFR Parts 240 and 249, [Release No. 34-63237; File No. S7-33-10], RIN 3235-AK78. http://www.sec.gov/rules/proposed/2010/34-63237.pdf. 2  United States District Court for the District Of Massachusetts, Case 1:04-cv-10375-JLT Document 65, filed 10/17/08. http://www.taf.org/eckardcomplaint3.pdf. 1 SEAMLESS COLLABORATION The Collaboration Imperative If not for the sake of efficiency and effectiveness, then under threat of penalty, institutions must strive to foster greater collaboration among the ranks of their departments and workers. The first step in that direction is for senior management to inform the work force of the importance of molding a collaborative culture. This can only truly be achieved through shared resources and more complete information. Awareness comes from knowing what is going on at the boundaries of a department and – more broadly – inside and outside the enterprise. Awareness fosters appreciation for what is being done in other areas and how it relates to individual roles and business processes. That appreciation naturally breeds cooperation within and across organizational units. Collaboration is the next step beyond cooperation. It requires a deeper understanding of common goals and what the organization is trying to accomplish at all levels. This is precisely what an enterprise governance, risk and compliance (GRC) solution is designed to provide to users in every operating unit of the organization. For several examples of how an enterprise GRC solution can foster greater collaboration throughout an organization, see the SAS white paper Safeguarding Compliance: Fostering Collaboration and Breaking Down Operational Silos with Enterprise GRC.3 GRC Overview GRC is an approach in which an organization integrates its governance, risk and compliance activities to meet or exceed performance goals, while staying within the bounds of prudent risk taking, corporate policies, laws, regulations and agreements. Figure 1 depicts, at a high level, the main areas of GRC. Governance Risk Compliance Board Communication Financial Laws & Regulatons • Mission • Operational • Regional (e.g. BIS) • Risk Appetite • Credit • Country (federal) • Corporate Culture • Market Liquidity • Provincial (state) • Capital Management • Model • Local (municipal) Business/Profit Plan Franchise Ethical Standards • Business Model • Strategic Corporate Policies • Product Set • Reputation / Litigation • Alliances • Human Resource Training & Education • Strategy Development • Insurable / Vendor Process Improvements • Balance Sheet Mgmt. • Business Continuity Brand Stewardship • Geopolitical • Shareholder Value Information Technology • Social Responsibility • IT Security • Sustainability • Privacy G R C AUDIT FUNCTION Figure 1. Components of GRC. 3 Abrahams, Clark R., and Kulwal, Manoj. Safeguarding Compliance: Fostering Collaboration and Breaking Down Operational Silos with Enterprise GRC, SAS Institute, March 2011. 2 SEAMLESS COLLABORATION Governance Governance deals with setting the course of the business and ensuring that it is under control at all times. It provides the framework through which responsibilities are delegated, objectives and performance metrics are set, alignment of stakeholder interests and expectations are maintained, and progress toward achieving goals is monitored. Business performance management, strategy development and strategy execution all fall under governance. The choice of performance indicators can influence business strategy, and care must be exercised in order to avoid unintended outcomes. For example, given identical regulatory capital requirements, a performance indicator based on return on equity (ROE) will reward greater allocation to riskier asset classes than an indicator based on risk-adjusted return on capital (RAROC) or shareholder value added (SVA).4 Economic capital approaches, while more demanding of data and resources, help to avoid distortions in projected financial results and foster superior strategy choices. The business strategy for maximizing shareholder returns is linked to a variety of risks, and it is also linked to compliance during execution, when the pressure to meet performance objectives sometimes overwhelms standard conduct. Key ingredients of effective governance, according to Rodney Nelsestuen of TowerGroup, include: • Sound policy limits for total risk exposure at any given time, including the risks associated with noncompliance. • Visibility and transparency into each area of risk and compliance, no matter where it resides in the company. • Human resource measurement and training on risk and compliance within an ongoing process. • The expectation (the corporate culture) that all risks and compliance issues identified will be brought into the open.5 Table 1 shows examples of governance-related business issues, their causes and how an enterprise GRC solution addresses them.