Year: 2015

Today’s business environment is fraught with risk. Economic, technology and market conditions affect organizations on a daily basis. The constantly “changing risk landscape” is a discussion point in headlines, industry forums, media outlets and board rooms. We are moving to a world where risk management will become the primary source of competitive advantage. Rather than avoiding risk, organizations need the ability to embrace risk with confidence.

Risk management will become the core capability which separates winners from losers. Organizations that understand and manage risk effectively will prosper, while those that cannot will fail. Success starts with the ability to manage operational risk in a manner that frees up resources to focus on the company’s long term, strategic objectives. This does not happen overnight.

Executives need relevant, up-to-date information to pursue the right opportunities. But, they also need a balanced approach to manage the major risks facing the organization to acquire the insight to make the right business decisions, address risk and explore new opportunities with predictability. A governance, risk and compliance (GRC) program is the backbone that keeps the organization prepared to manage issues and reduce risk. A GRC strategy that focuses on sharing data, leveraging processes and breaking down organizational barriers builds efficiencies across the organization to effectively transform compliance, manage risk and exploit opportunity.

Whether executives like it or not, all risk and compliance functions are expected to add value to the organization. These days, you cannot invest in anything that does not bring value to the company. Risk and compliance functions are no different. You can gauge your GRC program’s value by two simple measurements, and the first is results. GRC programs are expected to drive a constant increase of effectiveness in managing risk and compliance. The second measurement is reach. As the risk and compliance function matures, ideally it protects more and more of the organization. These two factors, as they increase, are key measurements of the risk and compliance function and how it brings value to the organization.

Organizations are looking to improve their results and expand their reach by maturing programs beyond check-the-box compliance. They must mature from first meeting the company’s compliance obligations, progressing to managing risk and, ultimately, reaching the point where the organization can use compliance and risk as a competitive advantage—truly bring value to the organization by helping drive opportunity.

I invite you to join me at ISACA’s 2015 North America CACS conference to explore this topic in more depth in my presentation titled “GRC Maturity Models.” I hope that these ideas will help you find conversation tools that help you determine your path to a mature, sustainable GRC program that helps fuel your enterprise toward opportunity.

Steve Schlarman, CISM, CISSP
GRC Strategist, IT and Security, RSA, The Security Division of EMC

[ISACA]

The days of doing business with a handshake and a smile are long gone. However, one thing continues to remain constant—how few vendor contracts are updated, even if the scope of service changes. This can be detrimental to an organization, particularly if the vendor is handling sensitive data such as personally identifiable information (PII), protected health information (PHI), cardholder data (CHD), or confidential, intellectual property and strategic data (also known as CIPS).

Periodically reviewing—and appropriately updating—master services agreements ensures both parties are aware of the processes, data elements and where the data processing is being performed. In other words; contracts must be continuously reviewed and revised as scopes of work change. The best way (or at least, the cleanest way) to update the master services agreement is via addendums that are signed and dated by both parties.

Effective vendor risk management is in managing the details. A key consideration in developing a durable vendor contract also means identifying the success criteria for the vendor and includes:

• The business unit’s requirements for the vendor
• The technical requirements involved (e.g., data elements, IT components, connectivity)
• The vendor’s requirements for the customer

To ensure that all expectations (performance, compliance, regulatory, etc.) are met—and no one is blindsided—it is important for the organization to identify early and manage the following key vendor risk operational points:

• Coordination between sourcing and vendor management
• Vendor risk classification
• The monitoring of vendor performance
• Effective use of assessment results
• Responding to and managing vendor performance issues

But what do you do if the vendor is not living up to the agreed-upon expectations documented in the contract?

An exit strategy is a must when a vendor does not meet its contractual expectations. It is a prudent step for the organization to ensure that a backup plan exists to either redirect the work to an already existing vendor used by the organization or to find a new vendor (one that most likely went through the previous request for proposal [RFP] process).

In my upcoming session (#145—“Contracting for the Full Vendor Lifecycle”) at ISACA’s 2015 North America CACS taking place 16-18 March 2015 in Orlando, FL, I will discuss these and other challenges during the contract phase of the third-party relationship. Hope to see you there!

Tom Garrubba, CISA, CRISC, CIPT, CTPRP
Senior Director, The Santa Fe Group
Program Director for the Shared Assessments Program

[ISACA]