download
DESCRIPTION
TRANSCRIPT
Standards for Integrated Governance, Risk and Compliance Management
Scott L. MitchellCEO, Open Compliance & Ethics
Agenda
• Big Picture of GRC• GRC Standards• Integration of GRC – OCEG Framework• GRC and Corporate Performance
What is OCEG?
• Provide a universal framework for integrating the principles of good corporate governance, risk management, and compliance while promoting ethics and integrity in the daily practice of business– Cross-Industry (pharmaceutical, financial, etc.)– Cross-Topical (employment, environmental, etc)
• Drive adoption of the framework through a multi-industry and multi-disciplinary coalition of stakeholders
• Lead a community of practice for exchanging information and continuously improving the framework and related tools for implementation
OCEG is a nonprofit organization that uniquely seeks to:
OCEG Resources
• Guidelines & Standards• Evaluation Criteria & Metrics• Online Environment
Big Picture
Stay in the Green
Criticism…
Governance,Risk Management & Compliance
are the departments of
NO
…Response
The Fastest CarsHave the Best Brakes
Basic Principles
GO STEER BRAKE
Historically, 99% of business investment is focused here
“Brakes” are a critical component to executing
strategy and realizing long-term value
…and just to belabor the metaphor
• Although the parts are located throughout the vehicle, the brakes should work as a single, integrated system
• In organizations, this system or “program” should address the total portfolio of governance, risk management and compliance processes
Integration of GRC + C
capability to set and evaluate performance against objectives; authorize a business strategy and model to achieve objectives while staying within mandated (legal) and voluntary boundaries
capability to proactively identify, rigorously assess and address potential obstacles to achieving objectives; and the risk that the organization will step outside of mandated (legal) and voluntary boundaries
capability to proactively encourage compliance with established policies and boundaries; the ability to detect noncompliance; and the ability respond accordingly
mindsets of individuals and an organizational climate that promotes ethics, integrity, respect, trust and accountability
Standards & Frameworks
Benefits of Standards
• Reduce Cost– Design– Implementation– Integration– Evaluation
• Increase Objectivity– Benchmarking– Internal Evaluation– External Evaluation
• Leverage Experience– Multi-Industry– Multi-Functional
• Opportunity for Recognition from Stakeholders
IncreasedPerformance
Types of Standards
• Principles-Oriented• Process-Oriented• Technical
Disciplines / Standards
• Governance– SOX, SEC, NYSE, NASDAQ– BRT, NACD, Conference Board– TIAA-CREF, CalPERS, AFL-CIO, CII– OECD– American Law Institute
• Compliance / Legal Management– Federal Sentencing Guidelines / Thompson– Australian Standards– OCEG Standards– Various agency guidelines (e.g., HHS OIG)
• Ethics / Corporate Social Responsibility– AA1000, SA8000, ISO CSR– Global Reporting Initiative– ILO Conventions, UN Global Compact,
Sullivan Principles– Sigma Guidelines (UK)– Q-RES (Italian)– European Corporate Sustainability
• Risk Management– GARP, PRMIA standards– Australian Standards– Basel II Guidelines– COSO ERM (2004)
• Internal Audit / Anti-Fraud– COSO Internal Control (1992), COCO– SAS 99
• IT Control / Security– COBIT– SysTrust, WebTrust
• Performance Management– Balanced Scorecard– EVA– McKinsey; BAH; Accenture
• Human Capital / Training– ASTD– Bloom’s Taxonomy– Kirkpatrick
• Communication / Change Management
• Quality Management– ISO 9000 series– Six Sigma
• Project Management– Project Management Institute PMBOK®
Exercise
• What standards / frameworks do you use?
OCEG Framework
Involvement
200+ individuals100+ organizations
Integration
• OCEG integrates effective practices associated with multiple disciplines into a framework for managing compliance and ethics
– Governance– Compliance / Legal Management– Ethics Management– Risk Management– Internal Audit– Human Capital Management– Training Development / Design– Change Management– Quality Management– Project Management
Leadership Council
• Aon*• Archer Daniels Midlands• Baker Hughes• Cisco• Corpedia Education*• Dell*• Deloitte*• DuPont• Ernst & Young*• EthicsPoint*• Freddie Mac• Gevity• Global Compliance Svs*• Grant Thornton*• Interactive Alchemy*
• Littler Mendelson*• LRN*• Lyondell Chemical• Marsh*• Microsoft*• PETCO• PricewaterhouseCoopers*• Qwest*• Roche Diagnostics• Sears• Staples• The Integrity Institute*• Unilever• Wachovia Corporation• Others Pending…
The Compliance Consortium Acquisition
• Axentis• Corpedia• Approva• Hyperion• Hyland• Intuition• Jefferson Wells• Navigant• The Network• Staffware
• Objectives– Increase understanding of how to
apply technology– Reduce risks/cost of implementation– Reduce risks/cost of integration
• Approach– Solution Providers + End-Users– Open Process
First Working Group Announced 7/19
“Whistleblower Hotlines/Helplines”
Hotline/Helpline Working Group
• EthicsPoint• Global Compliance Services• Listen Up Group• My Safe Workplace• The Network
• Micron• ITT• University of Texas• Microsoft• ADM• Qwest• Gap• Goodrich• Starbucks
• Wal-Mart• Wachovia• EthicsSA• Catholic Health• Staples• GA Technical Institute• Ernst & Young• Better Business Bureau• Lucent• RadioShack• CIBC• Interpublic Group• Johnson Controls• Countrywide Financial• Delphi Group
OCEG Foundation Guidelines - Status• Public Draft made available May, 2004
– 5,000+ downloads– 100+ organizations and individuals provided
feedback– 50+ person Steering Committee vetted the draft and
the comments
• Application Draft made available May, 2005
• Organizations of all sizes are invited to Beta Test the OCEG Foundation to ensure that the guidelines are practical. OCEG is specifically studying implementation at:
– ADM– DuPont– Gevity– Qwest– Staples– Wachovia– Dell
• Aim to finalize by end of March, 2006
register at www.oceg.org
OCEG Framework
The Foundation describes common elements of an effective program that integrates the principles of good corporate governance, risk management, compliance and ethics/culture
Foundation
Domains provide topical or industry-specific information that integrates with and assumes the OCEG Foundation is in place
Company
Companies can build on top of these models to customize and configure their capability to address unique requirements
Domains
OCEG Foundation
TECHNOLOGY
ORGANIZATION
CULTURE
PROCESS
Company
Domains
detailed view of foundationFoundation
Integration
• Federal Sentencing Guidelines
• Sarbanes-Oxley• COSO Internal Control• COSO ERM• ISO 9000 series• ISO 14000 series• Various regulatory
frameworks and guidance (e.g. HHS)
• Various CSR frameworks and guidance (AA1000, SA8000, etc.)
Practical&
ActionableGuidance
Translate
Integrate
Simplify
RESPOND / IMPROVE
OCEG Foundation
PREVENT / PROTECT /
PREPARE
MONITOR / DETECT / EVALUATE
PLAN / ORGANIZE
ORGANIZATION
CULTURE
PROCESS
TECHNOLOGY
INFORMATION / COMMUNICATION
INFORMATION & COMMUNICATION
OCEG Foundation - Reality
ORGANIZATION
CULTURE
PROCESS
PLAN /ORGANIZE
PREVENT /PROTECT /PREPARE
MONITOR /DETECT /
EVALUATERESPOND /IMPROVE
Continuous Execution and Overlap of Key Processes
TECHNOLOGY
TECHNOLOGY
OCEG Foundation
ORGANIZATION
CULTURE
PROCESS
PLAN / ORGANIZE
• PR1 – Controls, Policies & Procedures• PR2 – Code of Conduct• PR3 – Training & Education• PR4 – Workforce Management• PR5 – Physical Infrastructure• PR6 – Risk Sharing & Insurance• PR7 – Preparedness & Practice
ONGOING MONITORING• M1 – Control Assurance & Audit• M2 – Hotline & Helpline ReportingPERIODIC EVALUATION• E1 – Evaluation Planning & Reporting• E2 – Effectiveness Evaluation (DE, OE)• E3 – Program Performance Evaluation
• R1 – Issue Management• R2 – Special Investigations• R3 – Crisis Response• R4 – Discipline & Disclosure• R5 – Remediation & Improvement
• PO1 – Scope & Objectives• PO2 – Business Model & Context• PO3 – Boundary Identification• PO4 – Event Identification• PO5 – Risk Assessment• PO6 – Program Design & Strategy
C1 – Ethical Culture C2 – Risk Culture C3 – Governance Culture C4 – Workforce Culture
O1 – Leadership & Champions O2 – Oversight Personnel O3 – Strategic Personnel O4 – Operational Personnel
PREVENT / PROTECT / PREPARE MONITOR / DETECT / EVALUATE RESPOND / IMPROVE
T1 - Technology
INFORMATION / COMMUNICATION
• I1 – Information & Records Management • I2 – Communication • I3 – Internal Reporting • I4 – External Reporting & Filings
Risk Area DomainsThe Risk Area Domain Guidelines identify a number of areas to which most organizations are exposed. Each organization is unique and will focus on specific domains as appropriate.
governance
anti-corruption
competitive practices
employment
financial assurance
information management
international dealings
workplace health / safety
environmental
product quality / safety
government dealings (USA)
intellectual property
Employment Domain Subtopics
• Compensation• Executive Compensation• Workplace Violence Benefits• Anti-Harassment• Anti-Discrimination• Contingent Workforce• Hiring / Retention• Termination / Reduction• Employment Information Privacy• Accommodation / Leave• Labor / Collective Bargaining• Global Migration• Anti-Retaliation / Whistleblowing• Other Employment Torts
How does this affect corporate performance?
Big Picture
Must Stay Within Boundaries &Effectively Steer the Organization
Corporate Governance
objectives
business model
strategypeople, process, technologyinfrastructure
designed to achieve
shareholder
suppliers
regulators
customers
underwriters
society
board
employees
management
STAKEHOLDERS
MISSIONVISIONVALUES
Bottom-Line
We must understand enterprise strategy to ensure that we appropriately:
– Align– Design– Implement– Manage– Operate– Evaluate
…and to ensure that we get the appropriate budget to do it!
Objectives
• Many ways to define enterprise objectives
• Common elements– Categories– Criteria– Cascading
• Perspectives– For Profit– Nonprofit
Balanced Scorecard
FINANCIAL
CUSTOMER
INTERNAL PROCESSES
LEARNING & GROWTH
To succeed financially, how should we appear to our shareholders?
To achieve our vision, how should we appear to our customers?
To satisfy our shareholders and customers, what internal processes must we excel at?
To achieve our vision, how will we sustain our ability to change and improve?
Stakeholders
shareholder
customers
regulators
suppliers
underwriters
society
enterprise
board
employees
management
Balanced ScorecardLong-Term
Shareholder Value
Improve CostStructure
Improve AssetUtilization
New RevenueSources
IncreaseCustomer Value
Growth StrategyProductivity Strategy
Fina
ncia
lCu
stom
er E
xp.
Inte
rnal
Pro
cess
Lear
ning
& G
rowt
h
Price Functionality Quality Availability Selection Service Partnership Brand
Operations Management Processes
Supply ProductionDistribution Risk Mgt
Customer Management Processes
Selection AcquisitionRetention Growth
InnovationProcesses
Opportunity R & DDesign Pd Launch
Regulatory & Social Processes
Environmental EmploymtGovernance Etc…
Human Capital (readiness, training, recruitment, retention, etc.)
Information Capital (transactional systems, information systems, data storage, infrastructure, etc.)
Organizational Capital (culture, leadership, alignment, etc.)
product / service attributes relationship attributes image
Cascading Performance
Department Performance
Enterprise Performance
Team Performance
Cascading Performance
Compliance & Ethics Program Performance Enterprise Performance
System ModelILLUSTRATIVE
corporateperformance
employeeproductivity
fraud& abuse
reputation customerloyalty
employeesatisfaction
employeepurpose
errors& omissions
-
-
strongformal
controls
strongculture
& informalcontrols
“earlywarningsystem”
- +
+
+
+
-
-
-
+ +
+
+
+
-
+
Success Factors
Simple, balanced view of the organization's progress towards its objectives
– Less is more (sometimes)– Leading and Lagging– Hard and Soft– Strategic Alignment
“If you can’t measure it, you can’t manage it”Kaplan and Norton, 1996
Types of Measures
LaggingHard
ObjectiveOutcomeControl
LeadingSoft
SubjectiveCulture / Perceptions
Leadership
Types of Measures
LaggingHard
ObjectiveOutcomeControl
LeadingSoft
SubjectiveCulture / Perceptions
Leadership
OCEG Performance Measurement Framework
• Effectiveness (Quality)– Does the program promote the right mindset and
climate?– Is it properly aligned, focused and authorized?– How well does the program prevent noncompliance?– How well does the program detect noncompliance?– How well does the program react to noncompliance?– How well does the program protect the entity and reduce
the impact of adverse events?– How well does the entity evaluate and continuously
improve the program?
• Efficiency (Cost, Capital)– How much does it cost to execute core processes?– How well do we utilize capital?
• Responsiveness (Speed, Agility)– How quickly can the program execute core processes?– How quickly and effectively can the program respond to
new requirements and change?
Effective
Responsive Efficient
Indicator Category Relationships
Effective
Responsive Efficient
There is, generally, an inverse relationship between indicator categories. For example, if an organization seeks to increase efficiency (drive down costs), responsiveness and effectiveness often suffer. This is particularly true when organizations seek incremental changes.
Breakthrough Thinking
Effective
Responsive Efficient
An exception to this rule is when organizations successfully engage in “breakthrough thinking” that actually changes the size and shape of the triangle altogether. The application of technology and automating processes is a typical way to accomplish this.
OCEG Performance Measurement Practice Aid
Measurement, Indicators & Metrics
comments / questions should be submitted to:
Scott L. Mitchell Open Compliance & Ethics Group
7119 E. Shea Blvd Suite 109-478
Email: [email protected]
Phone: 602.234.9278 Fax: 928.441.1544
Measurement, Indicators & Metrics
comments / questions should be submitted to:
Scott L. Mitchell Open Compliance & Ethics Group
7119 E. Shea Blvd Suite 109-478
Email: [email protected]
Phone: 602.234.9278 Fax: 928.441.1544
Prevent
Scope / Objectives Aligned - % program objective mapped to entity objectives- % program objectives that are measurable
Risk Management Focused - % reduction in inherent risk
Strategy Allocated / Authorized - % strategy that is fully funded- % strategy that is fully resourced and staffed
Mindset Stakeholder Perceptions - % employees believe management wants them to do the right thing- % employees who have observed misconduct / reported misconduct
Climate Stakeholder Perceptions - % employees that believe there is an open environment to report
Knowledge / Skills Training, Communication, Helpline - % employees tested for reaction (level 1 test)- % employees tested for knowledge (level 2 test)- % employees tested for skill (level 3 test)- % employees evaluated for skill (level 3 test)
Tools / Resources Training, Communication - % employees that believe the code of conduct guided their behavior- % employees that believe training guided their behavior- % employees that believe the helpline guided their behavior
Incentives Human Capital - % employees that believe incentives are meaningful- % employees eligible for incentives, receive them
Detect
Systems / Controls - % controls that operated as designed and detected failures- % false positives- % false negatives
Hotline - # total legitimate issues, by category- % calls that resulted in legitimate issues
Periodic Assessment - % controls under evaluation that are effectively designed- % controls under evaluation that are effectively operating- % controls that were evaluated (design, operating effectiveness)
Issues - % issues that were proactively detected by the business- # issues by category (geography, type, stakeholder, severity)- # validated issues by category
React
Investigations - % investigations resolved, by category
Crisis Management - # control failures that became public- % public control failures that were proactively disclosed by organization
Discipline - # employees disciplined- % employees disciplined according to policy
Improve - % validated issues that resulted in program changes- % program controls modified
Tier 1 Metrics (Candidates)
• Culture– % workforce that believes org wants
them to do the right thing– % workforce that believes climate is open
to raise issues– % workforce that believes senior
management does the right thing– employee satisfaction– % workforce understand how their job
contributes to the enterprise
• Prevent / Protect– $ Value at risk (VAR)– % risks addressed by preventative
measures (code, policies, training, human capital, other control)
– % workforce confirm understanding of code of conduct
– # calls that prevent noncompliant actions– % controls appropriately designed
• Detect– % early, mid, late, un-detected– % workforce who observe noncompliance
but do not report (and why)– % of controls that operate as designed– False reports– Time / $$ to confirm issue
• React– Rate of resolution / close– Total time from detect to begin
investigation– Time / $$ to investigate / resolve issue– Total time from detect to resolve– Actual loss per issue
Extra Information
OCEG Development Process
assemblefull working group
break into subgroups (optional)
analyze and consolidate
findings
circulate“controlled drafts”version 0.1 – 0.4
analyzeinternal feedback
post “public exposure draft”
version 0.5 – 0.8
analyzepublic feedback
post“application draft”
version 0.9
analyzeapplication feedback
post“final draft”version 1.0
assemble the right team to develop and review the product in a controlled environment
solicit public feedback so that the work product is complete and correct
analyze and integrate public feedback and encourage individuals to implement the product in a real environment – and solicit feedback from actual use so that the product is practical
analyze and integrate feedback from those organizations that actually used the product and publish a final draft
1
2
3
4
• co-chairs direct work product and schedule• review board works with co-chairs to make final decisions• general members participate in the process
Rigorous process aimed at careful and incremental development to ensure that the work product is complete, of high quality and practical