A fragmented governance, risk, and compliance (GRC) landscape leaves organizations to sort through a multitude of visions. Blue Hill identifies basic defining characteristics of GRC and how the changing business environment is leading organizations to pay more attention.

1. Governance, Risk, & Compliance
Fundamentals
David Houlihan
Principal Analyst
Blue Hill Research
©2013 Blue Hill Research. All Rights Reserved.
©2013 Blue Hill Research. All Rights Reserved.

2. Need for GRC Solutions is Growing, But
Implementation is Challenging
Compliance becomes top risk priority of Directors
Increasing market / business volatility
Demand
for
Solutions
Regulatory regimes more complex
Agencies more aggressive about enforcement
The frequency and pain of data breaches is growing
Information and function silos results in overlooked opportunities
and exposures
Sorting out GRC vendors visions and value propositions
Challenges
to
Implementation
©2013 Blue Hill Research. All Rights Reserved.
Difficulty conceptualizing ROI
Unclear how to prioritize implementation strategies to maximize
organizational benefit

3. Map GRC Capabilities to
Organizational Needs
GRC is maturing into a enterprise solution, but still suffers
from fractured perspectives.
Operational
?
Users should start by determining functional areas and use
cases that stand to benefit most.
Financial?
Enterprise?
Legal?
Organizations can then map out where core GRC
capabilities can support their business processes.
IT Security?
Core GRC Capabilities
Identify &
Analyze Risks
Set Controls
©2013 Blue Hill Research. All Rights Reserved.
Monitor
Identify
Vulnerabilities
Respond to
incidents
Report

4. The “Success Factors” of GRC
Minimize exposure
Reduce Compliance Cost
Recognize Opp./Risk
Executive
Finance
Maintain Data Security
Technology
Technology
Remove Silos
Reduce
redundancy/complexity
Line of
Business
LOB
Reduce time spent on
compliance tasks
©2013 Blue Hill Research. All Rights Reserved.
Increase profile in
organization

5. Key Themes to Consider
Roll-up of “point” GRC to enterprise GRC
Compliance as a C-suite initiative
Risk agility and intelligence
Data privacy and security
Social media risk
Anti-bribery, anti-laundering, and anti-terror compliance
©2013 Blue Hill Research. All Rights Reserved.

6. Thank you!
To join the conversation, follow us on
Phone: +1 (617) 624-3600
©2013 Blue Hill Research. All Rights Reserved.
Contact Sales: sales@bluehillresearch.com
Contact Research: research@bluehillresearch.com
1