Making the ROI Case for GRC Platforms
As the governance, risk, and compliance market matures, product vendors and potential buyers alike are struggling to make the case for GRC implementations--whether it's being able to point to credible return on investment figures, or building a business case to justify the expense of a software platform. This is certainly not due to a lack of value, but rather a lack of parameters to work with when defining essential elements relating to cost, benefit, flexibility, and risk. When possible, the GRC proposition should be driven by a vision of better governance and performance, but when pressed for more specific justification, the following factors will help provide specific supporting evidence to make the case:
Thu, May 05, 2011
CSO — As the governance, risk, and compliance market matures, product vendors and potential buyers alike are struggling to make the case for GRC implementations--whether it's being able to point to credible return on investment figures, or building a business case to justify the expense of a software platform. This is certainly not due to a lack of value, but rather a lack of parameters to work with when defining essential elements relating to cost, benefit, flexibility, and risk. When possible, the GRC proposition should be driven by a vision of better governance and performance, but when pressed for more specific justification, the following factors will help provide specific supporting evidence to make the case:
The Cost
The cost of GRC can be significant--most leading GRC platform vendors report their average initial customer deal size is between $200,000 and $600,000 including software, hardware, and implementation services. In addition to these cost factors, you will have to factor in maintenance and support costs as well as services such as strategic consulting that might be used to guide the organizational roles and responsibilities, process improvements, and other elements of the business that the GRC platform will support.
The Benefits
There are three major categories that encompass the more basic ROI argument for GRC value. These include efficiency benefits (e.g. faster report aggregation, decreased audit costs, faster time to remediate control deficiencies), risk reduction benefits (e.g. fewer incidents, fewer regulatory fines, lower insurance premiums), and strategic performance benefits (e.g. better strategic decisions using risk and compliance information, stronger reputation driving more lucrative relationships). Efficiency benefits are usually the easiest and earliest to demonstrate, while strategic performance benefits may take years to fully appreciate.
The Flexibility
Another key factor in building the business case for GRC implementations is the degree of flexibility it provides to help the business respond to opportunities and threats. For GRC programs, you should consider two distinct elements of flexibility: flexibility relating to extending the GRC program and flexibility supporting business agility.
Extending the GRC program is critical in an environment of new and changing regulations, risk factors, and business requirements --so for example: a company using a GRC product for operational risk management may be able to leverage that product's business continuity module for an additional $40,000, instead of implementing a separate business continuity software application that would normally cost $400,000. GRC programs can't truly succeed without this flexibility--it's one of the most frequent compliments from GRC customers when it goes well, and one of the most common complaints when it doesn't.
