In September 2009, the Economist Intelligence Unit carried out a global survey on behalf of KPMG International, assessing the convergence of governance, risk management and compliance (GRC).The research looks at the driving forces behind convergence, the costs and perceived benefits and the barriers to achieving this goal.
Many companies are showing an increased appetite for the convergence of governance, risk and compliance.
Almost two thirds (64%) of survey respondents say that this is a priority for their organization, driven by business complexity, a desire to reduce risk exposure and a need to improve corporate performance.
There is still some way to go before companies achieve full integration of governance, risk and compliance across different functions and regions. While desire for integrated GRC may be widespread, the survey suggests that for many organisations, such an ambition is still in the very early stages of development. Of those surveyed, only 11% report full convergence across geographies, and barely more claim integration across business units, oversight functions and strategies.
The cost of GRC is significant and rising by the year. Half of those taking part in the survey estimate that governance, risk and compliance is costing their business around 5% of annual revenue, and a vast majority (77%) expect to see an even greater outlay over the next two years. Respondents from heavily regulated industries, such as financial services and energy, were more likely to anticipate increased expenditure. Despite this growing investment and interest in GRC convergence, only one-quarter (26%) feel that this will actually help bring down costs through a reduction in duplication and identification of synergies.
Many organisations struggle to realize the benefits of convergence. Just one-third (34%) of those taking part in the survey believe that expenditure on GRC represents an investment rather than a cost, while 45% say it is challenging to build a business case for greater
convergence. Even fewer believe that convergence would help improve corporate performance; the single biggest benefit was felt to be an ability to identify and manage risks more quickly (chosen by 59% of respondents).
People – not technology – present the greatest barrier to successful convergence. Integration is likely to involve a major transformation programme, so perhaps unsurprisingly, resistance to change is considered the single biggest obstacle (44%), followed by complex convergence processes (39%) and a lack of available experts (36%). Less than one in ten mentioned inadequate technology as a hurdle to overcome.
The executive management team and regulators are exerting the greatest pressure on organisations to improve their convergence of governance, risk and compliance functions. There are a number of reasons executive management is pushing for change, among them a need to reduce risk exposure and a desire to improve corporate performance.The survey indicates that the influence of non-executive
directors is considerably less strong. And when it comes to publicly-listed companies, only one-quarter (25%) feel that non-executive management is pushing hard for convergence, which is surprising given the higher governance responsibilities and fiduciary duties facing such individuals in the wake of Enron and other scandals.
