GRC - governance, risk and compliance Flashcards
Governance
set of rules principles, policies that an organization must achieve in order to align with its business goals
Risk management
Identifying, evaluating and monitoring the risk (legal, financial, security)
=> creates value and contribute to achievement of objectives + improvement of performance
Risk management system
Technologies + people + processes => enforce risk mitigation
Framework for Risk
ISO 31 000: guidelines for managing risks
Framework for Governance
ISO/IEC 38500:2015: Governance is part of corporate governance
IT management
internal + present oriented focus
IT governance
external + future oriented focus
Compliance
ORG adhering to government regulation, industrial standards and internal policies (failure: financial penalties + legal issues)
Success of compliance
ORG should track and control internal + external compliance requirements and provide training to employees
Digital trust
confidence in the integrity of the interactions among providers and consumers within a digital ecosystem
Digital trust relevance
brand reputation + operational resilience
Key factors of DT
quality, availability, security, privacy, ethics, transparency, honesty, resiliency
GRC capability model 3.5 (OCEG)
integrates risk governance and audit, ethics/culture, IT and compliance
OCEG
open compliance and ethics group
=> help solve problems using interdisciplinary approach
4 components of GRC capability model
Learn
Align
Perform
Review
Dimensions to assess total performance
Effectiveness
Efficiency
Agility
Resilience
Structure of GRC Capability model 3.5
GRC concepts
GRC capabilities
GRC glossary
Principled performance
Reliability
Achieving objectives
Address uncertainty
Act with integrity
Assurance
provides reliability and confidence to management
Assurance quality
- Competence/rigor
- Objectivity
Maturity model
- Siloed
- Transition
- Managed
- Transform
- Advantaged
Success of maturity journey
Top management commitment
Budget and resources
Performance and acceptable risk
stakeholder involvement
GRC tools
Audit & assessment
Control library (ICS)
Policies and instructions
Risk management
Templates and checklist
Dashboard and reporting
Action item management
All under 1 roof approach (Control library)
Control standard
Assets category
Functional scope
ISACA
- Information system audit and control association
- provider of GRC tools, trainings and certifications in the context of digital ecosystem
COBIT
Control objectives for information and related technology
=> provides guideline for directors on the effective use of IT within ORG
Process Reference model of governance and management objectives (ISACA)
Governance + management view
APO01: Management view
Managed information & Technology mgmt framework
Domain: Align, plan, organize
Director should govern through 3 tasks:
- Evaluate (current and future use of IT)
- Direct (implementation of plan and policies to meet business goals)
- Monitor (conformance to policies + performance)
Governance perspective
board level (EDM)
=> ensure objectives met by evaluating stakeholders needs
=> set prioritization and decision making
=> monitor performance against agreed direction and objectives
Management perspective
executive level (PBRM)
=> plan, build, run, monitor activities (business processes) aligned with governance body to achieve ORG goals
IT refers to
department responsible for technology
I & T refers to
all information a company generates
key concepts
Internal stakeholders
executives, board members, business managers, IT managers, Assurance providers, risk managers
key concepts
External stakeholders
regulators, IT vendors, business partners
6 principle for governance system
- Stakeholder value
- Holistic approach
- Dynamic governance system
- Distinction between MNGT and GOV
- Tailored to enterprise’s needs
- E2E GOV system
5 domains - Core components
GOV
EDM: evaluate direct monitor
MGMT
APO: align plan organize
BAI: build acquire implement
DSS: deliver service support
MEA: monitor evaluate assess
Components of a GOV system
- Processes
- ORG structure
- Policies/principles
- Information
- Culture/ ethics
- People/skills
- service infrastructure and APP
3 types of design factors
Enterprises strategy
Threat landscape
Role of IT
When should be the design factors considered ?
When designing and implementing Enterprise governance of information and technology (EGIT)
Process EDM01
Ensured governance framework setting and maintenance
APO12
Managed risk
COBIT 19 tools
- Management awareness diagnostic
- RACI by role
- GOV mgmt objectives - practices- activities
