Introduction

GRC Framework

A GRC framework provides the organization with a proven structure for addressing governance, risk management, and compliance issues, instead of developing an approach from scratch. Most organizations do not create their own risk categories and controls; rather, they implement (and sometimes merge) recognized frameworks.

Why Frameworks Matter

Without a GRC framework being used during implementation of a GRC program, there will be Fno consistency in terms of the categorization of risks, there will be gaps in coverage, and there will be problems demonstrating compliance to outside parties. The reason why this problem is solved through using a tried-and-tested framework is that there is consistency in all of the above aspects.

The Major GRC Frameworks

ISO 31000

This is an industry-neutral approach for managing risks. While it does not provide certification for compliance, it serves as an approach that companies utilize as the basis for their risk management programs.

COSO

Used frequently in the United States and in enterprise risk management, especially in relation to financial reporting.

The framework developed by COSO is often referred to when talking about Sarbanes-Oxley (SOX).

NIST Frameworks

The NIST Cybersecurity Framework, along with other publications on the subject, is used extensively to manage cybersecurity risks and are often cited by many institutions that are not mandated by any U.S. government standards just because of their comprehensiveness and documentation.

ISO 27001

An information security management system that numerous companies try to get certified on, especially in order to meet the security needs of their customers and partners in B2B sales.

SOC 2

SOC 2 is common amongst technology firms and software-as-a-service providers. It is not really a certification but rather an audit report based on the trust service criteria including security, availability, confidentiality, and other criteria.

Industry-Specific Frameworks

However, for healthcare, one would have to comply with HIPAA, whereas PCI DSS applies to payment card data and other financial services would require other regulatory compliance frameworks.

Choosing a Framework (or Combination)

However, most businesses do not implement any one framework alone; a tech firm can apply ISO 27001 or SOC 2 to address its security concerns, ISO 31000 for risks, and GDPR for data protection.

This mix depends on:

• Industry-specific regulations
• Requirements by customers and partners, especially regarding security certification for enterprise sales
• Regional geographic spread, as the regulations related to data privacy and others depend on the location
• Maturity of the organization, since larger frameworks require more mature processes to be effectively applied

Mapping Frameworks to Avoid Duplicated Work

Since many frameworks include common requirements (for instance, access control policies are common to all frameworks almost invariably), those organizations working on several frameworks usually create control mapping, where one single control is implemented, but then mapped to all the frameworks it addresses. This is one of the greatest advantages offered by GRC solutions compared to traditional spreadsheet management.

Framework Adoption vs. Certification

Applying the principles of a framework within one’s own organization is not the same as getting a formal certification or audit to the framework. Some organizations apply a framework but do not seek any certification from it, especially when it comes to general risk management frameworks such as ISO 31000. There are other organizations that apply for formal certifications or audits because they need to prove something to someone (customers, regulators, partners).

Common Mistakes When Adopting a GRC Framework

• Selection of a framework on the basis of name rather than regulatory and customer demands
• Implementation of several frameworks without a proper mapping strategy leading to duplication of controls
• Implementation of frameworks as a project once in a while without proper monitoring and periodic review
• Misunderstanding the maturity of the organization and processes needed to fulfill the framework completely, rather than making a documentation of it

Bottom Line

The GRC framework offers the necessary framework and common language required for managing risks and compliance. Organizations often end up implementing more than one framework in order to address their regulatory and customer needs, and it is important to align common controls between the frameworks to ensure that there is no duplication of efforts.