GRC adoption gaining traction in India

In today's enterprise landscape, what is the importance of Governance, Risk and Compliance, and what is MetricStream's role in this regard?

The growing number of government mandated compliance regulations across the world, corporate governance failures, data breaches and the need for robust enterprise risk management has increased the focus on Governance, Risk and Compliance (GRC) activities within companies. GRC programmes are put in place to help companies improve oversight of corporate governance – including financial reporting compliance, enterprise risk management (ERM) and related audits.

Internally, most companies are operating these functions in silos with disconnected systems and little collaboration among business units. This results in weak oversight and limited visibility into inherent risks.

An Enterprise-wide GRC (EGRC) platform can help overcome these challenges, and enable future consolidation and integration of a diverse set of GRC activities.

The MetricStream GRC Platform helps consolidate GRC activities such as policy management, risk management, audits and compliance on a common platform. The solution enables companies to exploit the synergy between GRC activities for better collaboration, transparency, insight, governance and performance.

What is the future of GRC in India?

GRC adoption in India is still fairly nascent when compared to the developed markets; but it is certainly gaining traction especially in the BFSI, healthcare, life sciences, energy & utilities, IT services and manufacturing sectors.

The Satyam case has spurred the demand for GRC solutions in India. However, companies are still contemplating and coming to terms with investing in compliance solutions. Companies in India have started taking a hard look at their corporate governance policy and processes and are prioritizing GRC projects.

What is your India presence?

MetricStream has a significant presence in India; we’ve had close to a 100 per cent growth in our employee count over the last few quarters. A significant amount of our R&D and product development is driven by our engineering teams in Bangalore. MetricStream sees India as a potential market as well as the hub of sales, marketing and delivery for worldwide regions including North America, Europe, Middle East and Asia. So India is important to us both as a direct market as well as a base to serve other geographies.

Since the implementation levels of GRC vary from country to country and company to company, are your solutions flexible enough to be tailor made according to the requirements?

The scope and scale of a GRC implementation can differ from one company to the next and from one industry to another. Pharmaceutical companies, for example, are concerned about different regulations like FDA in US and MHRA in UK while banks have several different regulations to comply with in each country they operate in.

Listed companies in India are subject to Clause 49, while their American counterparts are subject to SOX.

The MetricStream solution provides a common framework and an integrated approach to managing cross-industry and cross-country regulatory standards and guidelines. The solution supports various industry best practice frameworks like COSO, COBIT and ISO 31000 with embedded content libraries. One of the strengths is that we have strong vertical solutions with industry-specific content.

What is the unique differentiator of your GRC platform and what are the value additions brought in the version 6?

MetricStream’s recent GRC Platform release delivers an enhanced and flexible data model to closely align GRC with business performance and it accelerates value realization through superior user experience and collaboration.

Today, organizations are gradually moving away from silo-based applications towards a standardized and enterprise-wide GRC framework. MetricStream ensures that the framework supports independent risk, compliance and assurance functions and processes, while integrating them on a common information platform.

MetricStream GRC Platform 6 now includes the GRC Foundation – an extensive set of libraries for risks, controls, processes, policies, assets, organizations, regulations and other GRC elements.

The platform architecture enables organizations to model functions such as Internal Audit, Operational Risk and Corporate Compliance in a comprehensive manner. It also enables the design of multi-disciplinary and integrated GRC ecosystems spanning a range of control and assurance processes such as Policy Management, Quality Management, Supplier Risks and Performance, IT Risks and Compliance, and Environment, Health and Safety (EHS).

Who are the major clients and strategic partners of MetricStream?

MetricStream clientèle spans multiple verticals with several Fortune 500 and Global 1000 companies in each industry. They include Pfizer, Philips, UBS, SanDisk, Subway, Fairchild Semiconductor, American Airlines, Societe Generale, Kellog’s and Cummins.

Interestingly a MetricStream Customer, Constellation energy, recently won the OCEG GRC achievement award and a peer choice award for their GRC program. TCS is a strategic partner with MetricStream

How do you perceive the corporate governance scenario in India, and how can it be further improved?

In our conversations with senior executives in India, we have learned that the biggest risks to corporate governance are weak oversight and monitoring mechanisms and management override. Also, in comparison with developed countries that impose stringent penal and criminal consequences for poor corporate governance, penalty levels in India are considered to be inadequate to enforce good governance.

There needs to be an improvement in the risk management and oversight process, as well as financial disclosure, management discussion and analysis.

With the proliferation of regulations and concerns over corporate governance and transparency, ERM is seen by many regulators and business leaders as a strategic approach to achieve improved corporate governance, more transparency in the decision making of the board and senior executives, and improved performance against business objectives.

How do you look at GRC as a business approach?

The purpose of GRC is to provide a 360-degree view of risk and compliance, and to identify inter-relationships in today’s complex and distributed business environment. GRC is a federation of business roles and processes, working together in a common framework, collaboration and architecture to achieve agility, effectiveness, and efficiency across the organization.

GRC aligns business processes, partners, employees, and systems to be more efficient and manageable. Inefficiencies, errors, and potential risks can be identified, averted, or contained, reducing exposure of the organization, and ultimately creating better business performance.

Talking about GRC, incidents like the Satyam scam pop up. How can a GRC solution help avoid such untoward things?

A KPMG survey report on corporate governance in India indicated that many Indian companies operate in a family-owned culture and this often leads to the assumption amongst boards that senior managers know their job and have the best interests of companies they manage at heart.

This has sometimes resulted in boards refraining from asking the difficult questions to senior managers when the company has been performing well or until there is a crisis.

Structures and rules are important because they provide a framework to encourage and enforce good governance; but alone, these cannot raise the standards of corporate governance.

What counts is the way in which these structures and rules are put to use. Greater organizational transparency and collaboration is needed. A fully integrated solution that includes a common information model and a common understanding of risk and collaboration will provide maximum benefits for the organization.

Since GRC is related to the integrity of an enterprise, there could be many complexities associated with GRC software implementation. What are the primary areas that a GRC implementation should look into?

The key to a successful GRC implementation is to not lose sight of your stakeholders. Sometimes you become so engrossed in the program that you lose sight of the fact that people have got to implement it on a day-to-day basis. It is important to keep communicating to your stakeholders where you are.

Companies should avoid treating the introduction of a GRC system as a technological quick fix – without human support at every level of the company, the system will be costly and useless, but getting support for a structural change of this size is never an easy task.

Name
Email
Comment Here
Code Verification

Indian PC market grew 6.6 p.c. in Q1: Gartner

Microsoft Office for Android tabs soon?

Twitter tweaks privacy policy, adds transparency

Bharti Airtel adds 2 mn mobile users in April

Save petrol and money with this Android App

Why 122,680 Facebookers 'like' Nirmal Baba?

Do you think IT employees need unions?

Book your trip to Vaishno Devi online

Can Aamir Khan bring down female foeticide?

DataWind terms Aakash II launch a revolution

Subscribe to PCQuest for iPad & Android tablets

Register Free at DQ Top 20 Online portal & get insights on the Indian IT Industry

Enterprise IT News and Analysis in your inbox

Subscribe to the free PCQuest newsletter

Do you think IT employees need unions?

Arun and Cipla - no ladders, no snakes

Cyber attacks: Have India's neighbours turned culprits?

Personal cloud will eclipse PC: Gartner

SMEs don't give much importance to security

Sponsored Links

Custom Site

Demo Downloads On :

1-Click News Updates