enabling risk management with sap grc
Post on 12-Dec-2016
243 Views
Preview:
TRANSCRIPT
Turning risk into resultsEnabling risk management with SAP GRC
What we are seeing in the marketOrganizations today are struggling with managing risks across the enterprise. External and internal risk management requirements are becoming increasingly complex and intrusive, while the demand for more comprehensive, consolidated and actionable governance, risk and compliance (GRC) information continues to increase. The historic approach of managing risk in silos across different teams, processes, methods and infrastructure cannot keep up with these requirements. Risk management has become a growing operational and financial burden, limiting its ability to keep pace with business growth and transformational initiatives.
This is the right time to learn about opportunities to transform your risk management program by enabling it through an SAP GRC Risk Management solution that can:
• Create improved visibility and integration by linking various risk and control frameworks• Lower the cost of risk management through the elimination of duplicate and fragmented risk
activities and minimization of manual processes• Increase efficiencies through automation and end-to-end process centralization
What are the opportunities at your company?Typical current state Mature state
Our recent EY global survey of more than 250 leading organizations found a direct link between effective risk management practices and improved financial performance. Harnessing the power of GRC technology to improve risk information, streamline processes and reduce cost was both the biggest challenge and opportunity in achieving the needed risk management maturity.
Increasing complexity Simplified
Reactive Proactive
Fear of unknown Visibility
Cost pressures
Cost- efficient
Inconsistent approach Consistent
Multiple and manual risk management processes
Significant workflow automationCentralized risk and risk assessment managementIntegration with other SAP GRC modules
Fragmented, manual and ad hoc reportingInability to produce a consolidated heat map
Consistent and real-time reportingCentralized and consolidated heat mapDrill-down capabilities
Lack of confidence that all risks were captured
Consolidated views and end-to-end risk management processesScheduled risk assessment activitiesAbility to improve audit activities
Lack of centralizationSignificant impact on business
Centralized processesReasonable impact on businessAbility to manage risks at multiple organizational levels
Inconsistent approach to capture and assess risks across the organization
Central end-to-end processAutomated risk activities
SAP GRC Risk Management can enable your risk agenda
Significant workflow automationCentralized risk and risk assessment managementIntegration with other SAP GRC modules
Resulting in the following benefits:
• Improved alignment to the objectives and strategy of the business
• Central management of financial, operational and compliance risks across organization and technology platforms
• Increased integration and coordination among business, IT and compliance
• Automated risk assessment process
• Flexibility to accommodate various risk models and execute scenario simulations
• Sustainability of risk management process
• User-friendly reporting
• Elimination of duplicate and fragmented risk management activities
• Reduced level of effort associated with performing risk management activities
• Streamlined distribution and approval of risks and surveys
• Comprehensive and continuous risk management and monitoring
• Proactive identification of risks
• Improved visibility and integration across manual and fragmented risk activities
• Better aligned risk coverage, including the identification of stronger, more pervasive controls
• Improved visibility to risks that matter most to the organization, enabling resources to proactively focus on the most significant risks
Improve controls and processes
Better aligned risk coverage,including the identification of stronger, more pervasive controls
Reduced level of effort associated with performing and testing controls
Increased control and process efficiencies enabled through automation and continuous monitoring
Improved control mix that addresses key business risks while driving process efficiencies
Embed risk management Comprehensive and continuous
risk management and monitoring
Central management of financial, operational and compliance risks and controls across organization
Enhance risk strategy
Improved alignment to the objectives and strategy of the business
Improved visibility to risks that matter most to the organization
Proactive identification of risks
Enhanced decision-making
Optimize risk managementfunctions
Elimination of duplicate and fragmented risk management activities
Increased integration and coordination among business, IT and compliance
Sustainability of risk management process
Effective top-down and bottom-up reporting
Turning risk into results
Enhance risk
strategy
Embed risk
management
Optimize risk management
functions
Improve controls and
processes
Risk agenda
Risk
Cost
Value Risk Value
Cost Cost
ValueRisk
Next steps to improve your risk management landscape
Maturity models and leading-practice benchmarks: assist with assessing the current state against leading practice (enterprise-wide technology, GRC technology and processes/controls) and identifying opportunities for improvement.
SAP GRC demo environment: demo environment for all the latest versions of software, including SAP GRC 10.0 for Access Control, Process Control, Risk Management and Global Trade Services.
EY RiskUniverse®: industry-specific risk universes, process-normative models and key business risks linked to application-specific controls that can be used to customize SAP GRC demos.
Baseline enterprise-wide GRC technology maturity model
Optimize enterprise application landscape
► Single ERP vendor as primary choice for global corporate functions
► Aggressively rationalize application portfolio and licensing
► Centrally developed architectural blueprints and standards adopted
Simplify enterprise application landscape
► Rationalize application portfolio and licensing alignment
► Single ERP vendor by function ► Architectural standards and blueprints
alignment
Leverage enterprise application landscape
► Some application rationalization ► Leverage unused ERP functionality and
integration ► Limited adoption of architectural standards
Deployment options
► Application rationalization/ Decommissioning
► Point solutions and custom applications ► Inconsistent architectural landscape
Maximize IT organizational efficiency
Status quo
Maximize cost reduction
Maximize organizational effectiveness Deploy technology
Leverage technology
Simplify technology
Optimize technology
Tech
nolo
gy e
nabl
emen
t
Benefits
Simplify
Deploy
Leverage
Optimize
Where is Co? X
What is your future state?
GRC technology benchmarking metrics
Top
66% 9% 20%
Metrics Low Median
Percentage (%) of primary controls that are automated.
46% 17% 30% Percentage (%) of IT budget related to providing IT support services.
30 Days 74 Days 55 Days Average cycle time in days (including weekends) from identification of a change in risk till risk response.
2 Days 14 Days 5 Days Average cycle time in days (including weekends) from the identification of a control violation until its reported.
0.2 3.8 1.1 Technology cost associated with reporting on internal controls and compliance per $100,000 revenue.
‘Co X’ current state
Note: Cross-industry technology, internal controls, and process benchmarks obtained from APQC.
Automation
Portfolio rationalization
Automation
Automation
Portfolio simplification
Rapid GRC technology diagnostic provides accelerated current state assessment of your GRC processes and technology, allowing you to identify realizable value and develop a future state road map to achieve it.
SAP GRC demo facilitates mapping of business requirements to SAP GRC functionality and could be used to develop an initial business case for implementing SAP GRC.
Why EY?
• Global and flexible approach with a focus on SAP GRC
• Knowledgeable team with practical experience in process, risk and technology disciplines
• Industry-specific content and enablers
• Leading-practice assessment diagnostics and leverage models
• Service delivery model design and key performance indicators
Our services• Rapid GRC technology diagnostic
• GRC technology vendor selection
• GRC technology implementation and assessments
• Risk transformation enabled by GRC technology
RiCAP™: collects and analyzes process, risk and controls data to help align risk spend to strategic and business objectives by maximizing risk coverage and identifying control cost drivers.
EY | Assurance | Tax | Transactions | Advisory
About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.
EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.
© 2014 EYGM Limited. All Rights Reserved.
EYG/OC/FEA no. XX0000
1403-1222661 EC
ED 0115
This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice.
ey.com
top related