It is also important for us to learn from the bitter lessons experienced by others as our financial services industry too is tempted to provide low quality credit, which has been the root cause of the subprime issue. The topic therefore is very relevant and it is time to generate a wider discussion on Governance, Risk Management and Compliance – in short – GRC, which are considered to be the three key pillars or imperatives of financial management. 1. What is GRC? 1.1 By itself, GRC is not new or unknown. GRC has always been of fundamental concern to businesses, the financial service industry and to regulators and supervisors. All stakeholders realize that there are enormous benefits of observing GRC and that such benefits would outweigh the cost of putting in place processes, procedures and controls that enable effective implementation of GRC. 1.2 Governance is all about self-discipline. It is the process by which the Board of Directors sets the objectives for an organization and oversees progress towards achieving those objectives. Put it simply, it is the set of procedures and processes that keeps the organization alive and allows it to operate as a “going concern”. The higher the sophistication of the financial system, the higher would be the demand for governance as regulation and supervision cannot cover all risk elements in their supervisory processes. 1.3 The next critical pillar or imperative is Risk Management; i.e. identification, assessment, continuous monitoring of risks (real or hypothesized) and risk mitigation, while maximizing returns.
Adopting an integrated GRC framework is a challenge  4.1 Understanding the demands of the organization’s stakeholders is the key in terms of performance and conformance, and aligning the organization to deliver against these objectives. Considering the risk appetite and risk tolerance of the organization, the processes and technology should be designed and deployed so that the achievement of objectives is measured, risks are assessed and continuous improvement is realized in support of effective GRC. Integrating GRC has become a challenge for virtually every financial institution looking to establish an integrated and consistent approach to controlling exposures, managing risks and creating value. 4.2 The major challenge in adopting an integrated GRC approach is the aligning of the GRC framework and processes to standalone and isolated solutions that are already in place. The difficulty is to integrate these isolated solutions through a flexible and add-on basis to embrace new requirements. Changing core business solutions without overhauling business requirements is considered to be a nightmare by many financial institutions. If it is  4  BIS Review 15/2008  properly planned and designed, it would not be that bad and those who have taken the bold decision to do so will be the winners in the future. 4.3 Another important challenge would be to adopt a GRC framework, which is consistent with international standards. To enable this, new policies and procedures have to be written with links to automated systems.