Achieving Compliance
Buy a GRC tool or leverage existing applications? There is no black-and-white answer. However, a company's size and the scope of its operations can help guide the decision.
CIO — As economic tough times continue, there's one thing companies can count on: more regulations. For the CIO and the IT department, that will mean more time spent grappling with and monitoring a seemingly endless (and growing) mountain of data related to compliance.
How pervasive is the challenge? Last May, the Information Systems Audit and Control Association (ISACA) surveyed more than 3,000 of its members and found that regulatory compliance ranked among the top-five business issues facing IT managers and executives. In its report, ISACA notes that "regulatory compliance still operates in a 'project mode' and has not yet been embedded in business processes."
CIOs who seek to conquer compliance issues have found various routes—and tools—to help them achieve that aim. Some have purchased governance, risk management and compliance (GRC) tools to automate the process of staying on top of rules and regulations. Others have combined products such as office suites or accounting software with strong governance and business process frameworks. Both methods can succeed in identifying compliance requirements and making sure your company is effectively following the rules. So which way should you go?
There is no black-and-white answer to the question. However, a company's size and the scope of its operations can help guide the decision, says Forrester senior analyst Marc Othersen.
Make the Work Easier
A GRC tool can be an effective way to achieve compliance if your business is subject to many regulations and if the organization is spread out globally, says Othersen. Other countries have different regulations and industry standards, so a company with global operations has more rules to follow, he says. A tool can make it easier and more cost-effective for a company to comply with regulations wherever it does business.
Holly Marr, operations management organization leader at Acxiom, a global provider of information management solutions, started using CA's GRC Manager about six months ago to keep on top of approximately 900 compliance controls that the $1.4 billion company must abide by. "Our company has been learning how to manage the process [of compliance] in the most efficient way, and the tool is a way to go," she says.
Before the tool, internal auditors manually tested the controls for each regulation, which then had to be documented and sometimes remediated. However, all this information was housed in Excel spreadsheets and other documents that needed to be shipped to the internal auditors, regulators, upper management and regional offices to sign off on. Marr and her team chose CA's tool because it automatically helps them map industry-standard controls, such as the IT governance framework Cobit. It also consolidates the company's compliance data in one place. The amount of manual work required to do both these things was labor-intensive for IT, says Marr.
