Understand Governance Complexity & Paradox

The purpose of the GRC is to improve business performance through the creation of value to  stakeholders, and the maturity of the GRC approach will make a significant impact on business growth and transformation.

Governance is by definition a framework of principles, practices and indeed ethics; separate, different and outside the setting and subsequent control of business strategies, budgets, outcomes and metrics. It’s about how well an organization is being run and if set upright, it should effectively oversee the achievement of the business vision, mission, and objectives. 

Needless to say, effective governance leads to effective management and reaches a high level of organizational maturity. Governance discipline is complex and multifaceted, how to enforce the organizational governance discipline depends on the nature, scale, and complexity of the organization, as well as understanding its risks and conducting profoundly.

Over-governance or under-governance hurts: Governance is by definition a framework of principles, practices and indeed ethics; separate, different and outside the setting and subsequent control of business strategies, budgets, outcomes and metrics, etc. In fact, management and governance are complementary disciplines. Governance as a multi-disciplinary approach is an enabling vehicle that provides a platform for determining sound corporate attitude, behavior and structured decision-making for improving business maturity. However, applying a single layer of governance, as a lot of businesses do, will either enforce ‘over governance’ or ‘under governance’ in or more of these areas. To put another way, there is a sort of paradoxical nature here: as you would not like to either have your strategy overly constrained by the current governance practices or you don’t want the corporate governance disciplines overly weakened by too much creativity. Either over-governance or under-governance hurt the balance and growth cycle of the company.

Cognitively, the problem with governance is that the people enforcing governance normally have a frame of reference based on their own view or experiences of the organization's existing capabilities. Also, sometimes governance "standards" can be taken too far and become their own bureaucracy. In that case, innovation would be stifled. Analogically, governance is not about stopping the corporate vehicle, but to steer it in the right direction with the proper speed. Governance isn’t just about putting restrictions on what you can do, it is also about monitoring and knowing when things are not going to plan so that you can take appropriate action at the right time to make reasonable adjustment.

Don’t just see governance as constraint, but rather an opportunity: Governance is steering and effectively facilitates the successful functioning of an organization while ensuring there are adequate controls in place to operate responsibly in accordance with its values but not to the extent of restricting the aspiration to achieve its vision through an ambitious mission or aggressive goals. A good governance standard provides a common corporate "language," business principles, as well as work instructions to decide and take actions for either grasping opportunities or managing risks. It helps to manage collaborative results and best practices that view the organizational objectives holistically with the correct strategy lenses/focus.

When governance is seen as a constraint only, it perhaps stifles transformative changes. Often risk and opportunity co-exist. Risk should be seen in a much brighter light as it creates many opportunities for those that wish to see beyond a defensive response. Information technology is a critical ingredient in GRC disciplines. Intelligent GRC processes are the processes by which information is converted into intelligence, planning and direction, processing and analyzing, dissemination and integration, evaluation and feedback. GRC can be used to drive business change and business value the most, as there's less of a requirement to focus exclusively on regulatory and audit findings.

People are both means and ends to governance discipline: You cannot have effective GRC without people. The higher the complexity of the organization and the complexity of the environment in which it operates, the higher the requirement for business connectivity in order to meet performance baselines and generate value, allowing different roles to work together in harmony. Oftentimes, people are both causes and fixers of risks. Any GRC software solution is only a tool to assist in the administration of the function; people still have to decide how to best apply a tool and incorporate the tool into their system. A GRC application is to complement what people already do. Expecting a tool to drive processes is a difficult way to approach things and build a people-centric organization. Always go back to that old chestnut of "people, process, and technology" to address business issues and it works in the GRC disciplines as well.

We can't and won't be able to predict or manage every turn or twist of the business, every business is different with its own set of issues, problems, and concerns regarding its strategic and inherent risks. Culture and awareness are the most critical aspects of GRC, and can only be implemented in humans. It is critical to look at culture, staff training, existing processes and technology first, make improvements if necessary, then determine whether new tools would be a good addition to the mix. GRC needs to be people centric, including engagement and motivation because a focus on control and process enforcement has the tendency to damage an enterprise's capacity to grow the business up to to the next level of business maturity.

Uncertainty and risk are inherent in every venture of the business. Governance is neither linear nor single dimensional nowadays, and it should be looked more holistically in an enterprise and it is critical in adopting a social-technical-ecological perspective of governance models, and human critical thinking and intelligence are crucial as well to enforce GRC effectiveness. Ultimately, the purpose of the GRC is to improve business performance through the creation of value to shareholders and other stakeholders, and the maturity of the GRC approach will make a significant impact on business growth and transformation.

Posted in: Complexity,GRC