Which is more important to the success of a GRC program – culture, funding, or processes/technology?

As an admitted GRC geek, the question interests me; I’m always looking for the (probably nonexistent) silver bullet.

(In fact, we asked you to respond to this very question earlier this year in Business Finance’s 2009 GRC Maturity Study.)

So, when a GRC executive at one of the world’s largest technology companies offers to answer the “what’s most important” question, I’m all ears.

Bob Tizio, governance, risk, and compliance officer for SAP Americas, believes that it is difficult to distinguish between the value of tone at the top, funding, and processes (and supporting technology) when identifying the most important element of GRC program success. All must be in place, he emphasizes, with a notable caveat.

“They’re all equally important,” he says here. “I think you really need to have the right culture — the right tone at the top — or else you’re not going to get the funding, the people, or the technology you need to move forward.”

In other words, establishing the right tone at the top is a first among equals when it comes to the key ingredients of GRC success. ###