For the past week, I have been chatting via e-mail exchanges about the nature of GRC with Norman Marks, vice president, GRC, for SAP BusinessObjects. Marks, a former vice president of internal audit with Business Objects before SAP’s acquisition of the firm, has a lot to say on the topic, as you will see below, and also in his own blog.
Our conversations examine the difficulty of defining GRC, the confusion currently roiling the GRC marketplace, and the importance of bringing greater clarity to the realm of organizational GRC.
Norman Marks: To begin, I suggest we try to reach a common understanding of what a “GRC practitioner” is as a first step in our discussion.
I summarize GRC in my own words as how an organization:
• Understands the needs and objectives of its stakeholders (owners, for the most part);
• Directs and manages the organization to achieve those needs and objectives (bringing in my favorite, strategy management);
• Considers and manages risks to success; and
• Stays in compliance with applicable laws and regulations
Eric, what is your view of what “GRC” means, and how wide or narrow is the group of “GRC practitioners”? more