The Unified Performance, Risk, and Compliance Process Model

Recently, Nenshad Bardoliwalla wrote a nice series of 4 posts, entitled The Unified Performance, Risk, and Compliance Process Model, published in his blog and also in the Enterprise Irregulars website. The series of posts were excerpted from his excellent book Driven to Perform: Risk-Aware Performance Management From Strategy Through Execution, written with Stephanie Buscemi and Denise Broady, where they describe how they unified performance, risk, and compliance into a coherent strategic management process framework.


He wrote one post for each phase of the classic performance management lifecycle: Part I - Strategize and Prioritize, Part II - Plan and Execute, Part III - Monitor and Analyze, and Part IV - Model and Optimize. The posts are well detailed and illustrated graphically, and provide prescriptive guidance in how to put all the pieces together in their model. Below is a summary of his posts:


Part I - Strategize and Prioritize:

Understand the Corporate and Departmental Contexts

Review the corporate strategic goals, strategic plans, initiatives, and metrics. Contextualize them to the implications they have for the departments and use this context to drive the PM lifecycle.

Develop and Set the Strategy

First, review the environment. To get a holistic picture of risk, understand where you currently stand and assess the internal environment and properly define and prioritize the most important risks with the greatest impact and likelihood of occurrence (risk type, impact, probability, timeframe, and mitigation strategy/costs).

Next, get a holistic picture of the full set of compliance initiatives you will intersect with, such as SOX, OSHA, data privacy laws, and global trade regulations.

The next step is to set the mission, values, and vision:
- Define mission (the fundamental purpose of the entity, especially what it provides to customers and clients).
- Define core values (the attitude, behavior, and character of the organization).
- Define the vision. A vision is a concise statement that defines the 3- to 5-year goals of the organization.

Next, set the goals. Define a strategy and set business objectives using risks as a key variable for deciding which strategies to pursue.

Assign KPIs to Goals and Set the Right Targets

Define KPIs and targets that translate strategy into performance expectations.

Perform Additional Risk Analysis and Set KRIs

Now look again at risks to see what could keep you from meeting your goals.

Set a response strategy for the risk (treat, tolerate, transfer, or terminate).

Define KRIs and risk thresholds and tolerances for those risks.

Perform Additional Compliance Analysis

Define your compliance requirements. Define policies, procedures, and controls that must be in place to ensure that you can meet the compliance requirements.

Work on the Strategic Action Plan and Initiatives

The strategic initiatives help define the exact methodology (the roadmap) for achieving the various goals. The results of this planning may require revisiting the strategy.

First, develop the roadmap (sequence of actions) for achieving performance, risk, and compliance expectations.

Next, define critical success and failure factors for all initiatives. Every project or investment must, in addition to defining the critical factors for its success, also define its critical “failure factors,” that is, those circumstances under which the project or investment is no longer likely to be successful.

Finally, develop different risk-adjusted scenarios with contingency plans should risks to achieving plans materialize.

Cascade Accountability

Cascade accountability of KPIs, KRIs, and controls throughout the organization and ultimately into individual MBOs for alignment.

Part II - Plan and Execute

The planning and execution gets into the details of planning the strategic initiatives both from a financial and operational standpoint.

Align Corporate Budget to Departmental Budget and Link Corporate and Departmental Initiatives

The budgeting process takes each of the outcomes or actions from the planning process and aligns revenues and expenses against them. Decisions regarding investment priorities and resource allocations define how the company will operate and set the bar for measuring performance.

To create risk-adjusted budgets, incorporate the range of possible revenues and costs of each action into the budget at the appropriate organizational level. Align risk adjusted budgets with contingency plans should risk events occur, or if risks exceed the acceptable threshold to achieving budgets.

Align Departmental Budget to Departmental Operational Plans

The operational planning process links the financial budget to specific operational factors. Plan out each step of each initiative. Consider what risks you have in each area of the operational plan. If the risk materializes, you would want a contingency plan in place that showed the performance and risk implications if we moved the budget from one initiative to another.

Forecast Performance and Risks

Create rolling, risk-adjusted forecasts of the budget (revenues and costs) and operational plan (including number, capacity, and cost of resources necessary to achieve plan) so that you can see trends over a rolling time horizon for those risks whose probability, consequence, and resiliency over time.

Execute Plans

This step is essential but obvious; put the plan into action. Be prepared to execute on the type of risk associated with the plan once the threshold or tolerance is exceeded.

Part III - Monitor and Analyze

In the monitor and analyze phase of the risk-adjusted PM lifecycle, you monitor to understand what is happening in the business, analyze to understand why it is happening, and for those things not on track, adjust to improve the situation relative to your goals.

Monitor

The presentation of information to be monitored is crucial in order to facilitate decision-making. Risk monitoring is aligned directly to KRIs across the source systems that provide transactional data for the KRI. Dashboards linked with risks should help identify and manage key risks versus overall risks that are being prioritized based on exposure through quantitative/qualitative assessment

Monitor performance. You can evaluate the KPIs you’ve set to identify progress made toward achievement of objectives and trends.
Monitor initiatives. You can also evaluate which initiatives are failing or behind schedule.
Monitor risk. You can then evaluate important key risk indicators to identify:
. What and where are our top risks?
. What are the changes to the risk levels for key activities and opportunities?
. Are risks being assessed in accordance with company policy or according to industry best practices?
. Are our mitigation strategies effective in reducing the likelihood or impact of a risk?
Monitor internal controls. Report key control deficiencies, approvals, verifications, and reconciliations to mitigate risk.
Monitor any incidents and losses. What incidents or losses have occurred? If risks or losses have occurred, or external events are affecting the department, document this information, even if you haven’t been tracking it in the system yet.

Analyze

Analysis is a key step in which you not only look at where you are, but what is happening (or what has happened) and why.

Analyze performance. For KPIs, perform analysis to understand why they are increasing or decreasing.
Analyze initiatives. To evaluate initiatives, perform analysis on the initiative to understand why it is succeeding or failing.
Analyze risk. For KRIs, perform analysis to understand why they are increasing or decreasing.
Analyze controls. When analyzing internal controls, you perform analysis on their effectiveness.
Analyze root causes of incidents or losses. If incidents or losses occur, perform analysis on the root causes and trends.

Adjust

After monitoring to know what has happened and analyzing to understand why it happened, for those things not going according to plan, it is time to set the business back on course by taking what you’ve learned and using that information to adjust the settings across the enterprise.

Adjust performance. If you see KPIs trending in the wrong direction, once you have analyzed the root causes, it should be clear what actions to take to set things back on course.
Adjust initiatives. For initiatives that are not going as planned, it becomes essential to rapidly take remedial action or cancel them.
Adjust risk. For KRIs trending in the wrong direction, once you have analyzed the root causes, it should be clear what actions to take to set things back on course, often by putting the appropriate mitigating controls in place to stabilize them.
Adjust controls. For controls violations, adjustment takes the form of remediation and certification.
Adjust after incidents or losses. For incidents and losses, the correct adjustments typically involve reexamining if we are tracking the right risks and have put the appropriate controls in place to mitigate them.

Part IV - Model and Optimize

In the model and optimize, we strive to assess the drivers of performance and risk at a deep level to understand the various alternatives we can pursue with the goal of making the best decision given a certain set of constraints.

Model

Modeling falls into three categories.

Revenue, Cost, and Profitability Modeling. Modeling the costs, revenue, and profitability implications of performance management, risk management, and compliance management activities and their drivers can be achieved at a very detailed level using activity-based costing and associated methodologies.

Scenario Modeling. Scenario modeling can be applied to financial and operational modeling and focuses on creating different business scenarios.

Simulation Modeling. More advanced modeling including Monte Carlo simulation supports creating a broad range of scenarios based on multiple iterations of input assumptions and combinations.

Optimize

The goal at this phase of the PM lifecycle is to determine the optimal way to achieve objectives by taking into account the entire context of the problem, including all relevant constraints and assessments (costs, benefits, risk, labor and time).

Wrapping Up

From a process unification perspective, risk and compliance management operating in tandem with performance management will become differentiating capabilities in the management of an organization.

From a technology unification perspective, business intelligence can be conceptualized as the base of the pyramid upon which performance management and governance, risk, and compliance are built, since it provides the basic technology capabilities and infrastructure that serve as a foundation for the higher layers of the pyramid. Connecting governance, risk and compliance capabilities with performance management capabilities through a common business intelligence platform establishes a single, unified, cleansed repository of information and common semantics on top of that information, which is critical to enabling risk-aware performance management business processes. Without this common foundation, it is impossible to obtain any synergies that extend beyond deploying any one of these capabilities in isolation.

Business Intelligence Trends: Eye on Compliance

Tomorrow, September 11th at 3PM ET, will happen a live Web broadcast presentation entitled Business Intelligence Trends: Eye on Compliance, provided by DM Review and hosted by Eric Kavanagh with Jim Ericson, in its program called DM Radio.


Accordind DM Review: "Which one word strikes fear into the hearts of modern executives? Compliance! Mandates such as HIPAA, Sarbanes-Oxley, Basel II and others require that companies pay ever closer attention to their core processes, under penalty of stiff fines, even jail.

Complicating matters is the divergent nature of such mandates. On the one hand, HIPAA requires that sensitive patient data be protected, effectively hidden from unauthorized view. On the other hand, Sarbanes-Oxley seeks to reveal critical information and prevent organizations from hiding financial and process data. Still, there are ties that bind these mandates, and there are best practices for helping to ensure compliance while also improving operational efficiency.

Meanwhile, the rise of compliance has been a boon for software and services companies, who are finding new and creative ways to help organizations remain compliant. Tune into this episode of DM Radio to hear from the experts about what your organization can do to achieve compliance and also reap other benefits from compliance-related initiatives. We'll talk to: Compliance Weekly Editor in Chief Matt Kelly; Oracle Senior Director Michelle Shannon; and Exeros Vice President Todd Goldman.

Attendees will learn:
- The invaluable role of business rules management systems
- How data governance boards can help or hinder compliance
- Why it pays to be responsive to auditors
- The increasingly important role of application logs
- How a strategic view of compliance can pay serious dividends."

The Governance, Risk and Compliance(GRC) was driven by the Sarbanes-Oxley Act, and nowadays is an important issue to the companies.

In the DM Review website, you can register for this live Web broadcast.

You also can check out the DM Radio archives to hear previous programs with a variety of other issues.

The DM radio is an excellent initiative by DM Review to spread knowledge with expert professionals in interesting subjects.

The integrated approach: Governance, Risk, and Compliance Management

A couple of days ago, Joe McKendrick wrote an interesting post, published in the blog of Informatica Enterprise Data Management, entitled What is 'GRC,' and How Can It Bring the Enterprise Together?

He talks about how the companies nowadays need be able to document the reliability and quality of data, to fulfill mandates such as Sarbanes-Oxley.

For this, the companies need a more automated, systematic form to integrate those information.

He explains that the integrated approach: Governance, Risk, and Compliance Management can build sustainable compliance management: "These include governance, or the oversight of corporate activities and processes; risk management, or the identification, assessment and monitoring of risks and controls; and compliance management. Most importantly, GRC brings together teams of people that normally would not be working with each other. The distinct categories of governance, risk management and compliance were often run by separate groups of specialists. Companies increasingly recognize that there needs to be a single focus –that finance, IT, security and operations teams need to be engaged in a common purpose of bringing greater flexibility and transparency to the way data is managed and dispersed throughout the enterprise."

He mentions Lee Dittmar, a principal with Deloitte, and a thought leader in GRC, that observed, in an article published in the BTQuarterly:
"As leaders strive to meet the raised bar on corporate governance, to achieve better risk mitigation and to meet increasingly complex compliance challenges, a common element is recognized as being critical: high-quality information. They need the right information, at the right time, at the right place, and in the right form. They need relevant, timely, accurate, transparent, and reliable information.
This requirement for higher-quality information puts intense focus on IT's role as a key enabler for improving GRC connectivity - helping uncover its collective synergies and boosting support of stronger, more efficient businesses. Yet CIOs and IT managers find themselves still wrestling with organizational fragmentation and resistance issues, such as ongoing complexity in the corporate silos and continuing manual processes. It's difficult to create a more ideal environment, in which decentralized units are bridged and systems and controls exist on a common platform when they're not free to fully explore all of the possible interrelationships and common dependencies inherent in GRC."

He finishes the article, also mentioning Dittmar: "GRC brings to light the need to be able to transform overwhelming amounts of data coming in from all corners of the enterprise into "information that serves as a strategic asset of the business."

Both are interesting articles (Joe McKendrick and Lee Dittmar) about Governance, Risk, and Compliance (GRC).

A good way to automate and integrate information is through the concepts of Enterprise Decision Management(EDM), with its focus on the automation of operational decisions using analytics and rules and also focus on management.