Your GRC Journey

Many organisations think that spreadsheets are a cost effective solution to monitor and track a what can be a comprehensive process. Formalising and developing a GRC framework that is enduring, workable and scalable, is far more cost effective using the right tools and getting it right the first time.

In some organisations, the IT Department will suggest an internal solution and there are many reasons why this is not cost effective. Whilst spreadsheets seem like a quick fix, it doesn’t address the lack of cohesion and the greatest cost of internal staffing.

Managing GRC is a dynamic process and static registers in spreadsheets will not meet the requirements of the Board or the regulator. Your GRC platform must have a database that allows users to create relationships between regulations, policies, controls, risks, processes, business units, positions and key risk indicators. Without, it often becomes a collation of a manual process which is costly and prone to error.

While spreadsheets are readily available and understood by most people, they can create just as many risks as they try to monitor. The dictionary defines a spreadsheet as … ‘an electronic document in which data is arranged in the rows and columns of a grid and can be manipulated’ .

Spreadsheets seem like a cost-effective option but can have several limitations, to name just a few:

• There is no effective audit trail or easy way to track change. Being able to manipulate or change data without controls is a risk in itself
• It may not meet regulatory or legal requirements
• If the file is shared, version control becomes an issue and you are asking ‘Is this the current version?’
• Reporting becomes inconsistent and open to manipulation
• They become ‘Mary’s’ spreadsheets and sometimes only ‘Mary’ understands
• You cannot have attachment to spreadsheets evidencing risk reviews, incidents or control checks
• Mistakes in the spreadsheets are not easily identified, allow errors to manifest over many years