Very few firms take the time to reflect on the relationship between governance, risk, assurance and compliance for the enterprise (GRACE). As a result, a lot of money and effort is wasted through poorly-coordinated efforts and weak assurance. This is neither necessary nor contributory to business performance. There is a better way.
The search for an integrated approach to governance, risk, assurance and compliance for the enterprise (hence GRACE) has gathered momentum ever since the attention to all these topics in COSO in 1992.
To some extent, the drive to integrate these fields is driven by confusions of terms. These areas should not naturally integrate; rather they should coordinate to ensure that key aspects of organisational control are effective and that changing compliance requirements are reflected in to the appropriate process-level and organisational control routines which are then validated and against which robust assurance is available to executives and, as necessary, the board of directors.
But it is equally important not to reduce any aspect of assurance or compliance - or even governance or risk – to a box-checking exercise. Ideally, a firm should have a vision of how its GRACE activities will evolve and develop in a way which is consistent with the strategic and operating imperatives of the firm. Depending on the nature of the risks facing the firm, that may involve coordination with external audit work and coverage.
For financial services firms, maintaining effective routines for identifying changing compliance requirements and their fit with the firm’s business model(s) – managing the ‘regulatory delta – is an on-going challenge. Very few firms manage this well, least of all optimally. Almost all are over-reliant on expensive legal advise to interpret requirements.
We help firms to address the challenge of coordinating GRACE requirements to optimal effect. The result is always a more robust assurance process and usually considerable savings in unnecessary fees.
We are founder sponsors of the International Centre for Governance Risk & Assurance, based in London.
You are viewing the text version of this site.
To view the full version please install the Adobe Flash Player and ensure your web browser has JavaScript enabled.
Need help? check the requirements page.