Enterprise policy-management

© 2015 MetricStream, Inc. All Rights Reserved.
Enterprise Policy Management 101
Michael Rasmussen
Chief GRC Pundit
GRC 20/20 Research
Vasant Balasubramanian
Vice President Product Management
MetricStream

Today’s Agenda
 Inclusive policy creation process
 Policies as links to other areas of compliance
 Enterprise policy enforcement at various levels
 Role of training and targeted communication
 Leveraging technology to effectively manage the policy management program
 Question & Answer

3© 2015, all rights reserved, www.GRC2020.com
Change impacts policy management in the context of business

Battling the Hydra of Ineffective Policy Management

Policy
Management
Challenges
Regulatory
Change
Risk Change
Business
Change
Rogue
Policies
Out of Date
Policies
Different
Templates
Lack of
Ownership
Poorly
Written
Lack of
Defensibility
What is Driving Adoption in Policy Management and Maturity

Case Study in Effective Policy Management
In a report in November 2012,
the DOJ and SEC stated they:
“have often encountered
companies with
compliance programs
that are strong on paper
but that nevertheless
have significant . . .
violations because
management has failed
to effectively implement
the program even in the
face of obvious signs of
corruption.”
POINT: Regulators are tired of
paper-based compliance
programs that look good on
paper but fail in operations and
employee engagement.

Begin by Understanding Your Policies

Policy Governance Strategies
Centralized Policy Management
Federated Policy
Management
Decentralized
Balance
Balance autonomy, best of
breed with centralized
reporting, collaboration, etc.

Policy Lifecycle is Not One Size Fits All
POLICY COMMITTEE POLICY MANAGER POLICY OWNER(S) POLICY AUTHOR

Herding Cats – Getting Everyone Working Together

GRC 20/20’s Effective Policy Management Lifecycle

1) Determine the Need for a New Policy

2) Develop or Update Policy

3) Communicate & Train on Policy

4) Implement & Enforce Policy

5) Measure & Reevaluate Policy

How Technology Enables Policy Management

Deliver a Unified Company Policy Portal in the Format Needed

An Engaging User Experience for Policy Management

Policy Push and Policy Pull

Integrated Information Architecture Drives Effective Policy Management
REGULATIONS &
OBLIGATIONS
RISK &
ANALYSIS
OBJECTIVES
& GOALS
INCIDENTS
& ISSUES
ASSETS &
RELATIONSHIPS
POLICIES &
TRAINING
CONTROLS &
ASSESSMENT
ROLES &
RESPONSIBILITIES

Questions?
Michael Rasmussen, J.D.
The GRC Pundit & OCEG Fellow
mkras@grc2020.com
+1.888.365.4560
Some of the content we have evaluated is OCEG content which GRC 20/20 has an established relationship to use. Please do not copy slides or graphics
without permission. GRC 20/20 highly recommends you consider OCEG membership at www.OCEG.org.
GRC 20/20 Newsletter
LinkedIn: GRC 20/20
Blog: GRC Pundit
Twitter: GRCPundit
LinkedIn: Michael Rasmussen

A Federated & Systematic Approach to Policy Management
Role of Technology
MetricStream

Policies at the heart of GRC Initiatives
Issues &
Remediation
Compliance
(Financial, IT,
HR, Regulatory)
Audits
PoliciesRisks
Dashboards
& Reporting
 Tracking Regulatory
Changes
 Implementing and
Assessing Controls
 Program Tracking
 Assessing Risk
related to non-
compliance
 Quantitative and
Qualitative Analysis
 Issue remediation
 Approvals
 Scheduling
 Electronic Workpapers
 Scheduling
 Reporting

Key Technology Components

Make it Simple
Business users do not have time for a complex enterprise-style interface

Author Policies
1
2
3 Create & Manage Policies
at the most granular level
(i.e. sections in a policy)
2
Drive consistency with
Policy Templates
1
Cross-reference & link
related and supporting
policies and regulations
for each section
3

Review & Approve Policies
1
2
3
Standardize and streamline
the Enterprise Policy
management program
1
Set Policy Implementation
and review due dates
3
Manage Policy versions2

Communicate and Attest
1 Choose Geographies,
Business units and
Individuals for policy
Implementation

Manage Exceptions
2
1
3
1 Establish and follow
consistent procedures for
exception capture, review,
approvals reporting,
2 Manage policy
exceptions and potential
risks
3 Track policy exception
status, due dates in real
time

Drive Awareness and Training
1
2
3
Train and create awareness
around policies
1
Identify, streamline and
manage “end to end” training
and certification
requirements
2
Managing e-Learning and
other forms of training3

Monitor Policy Compliance
Use reports and analytical dashboards for insights into the policy inventory and to monitor policy compliance.

Selected Case Studies
Leading North-West Regional Community Bank
• MetricStream Solution: Integrated GRC for Policy management, ORM, Internal Audits, Financial
Reporting, Regulatory Compliance, IT Governance and Issue Management
• Improved coordination across various assurance groups, provided real-time risk-control intelligence,
and minimized operational redundancies
• Deployed Over MetricStream Cloud
Fortune 500 Technology Company
• Used by nearly 120,000 employees worldwide
• Enabled a centralized, and consistent approach to policy development, communication, and
implementation across the organization’s worldwide operations;
• provided a single, common framework to standardize policy related processes
Large Regional Not-for-Profit Health Care Provider
• Provided an integrated framework for managing policies across the enterprise
• Helped collaborate on policy creation and review, enabled policy process tracking, and mapped all
policies to compliance requirements for complete transparency

Benefits
• Simplify the development, review, and approval of polices and relevant documents.
• Enable a federated approach to policy management and enforcement at local, regional, departmental, and
headquarter levels.
• Leverage a central library of standardized policy content, templates, and best practices.
• Simplify and accelerate the retrieval of policies and documents, including reference and supporting
documents and linked policies.
• Identify, streamline and manage training and certification requirements
• Gain enterprise-wide visibility into the status of policy and document management. Proactively address
issues and gaps.
• Strengthen regulatory compliance by mapping regulations and standards to organizational policies.

About MetricStream
• Over 1,800 employees
• Headquarters in Palo Alto, California with offices worldwide
• Over 350 enterprise customers
• Privately held – backed by leading global VCs, Goldman Sachs, Sageview Capital
Integrated Governance, Risk, Compliance and Quality Management for Better Business PerformanceVision
Apps & Solutions
• Risk Management
• Compliance Management
• Audit Management
• Business Continuity Management
• IT GRC
Partners
Differentiators
• Technology - GRC Platform – 9 Patents
• Breadth of Solutions – Single Vendor for all GRC needs
• Cross-industry Best Practices and Domain Knowledge
• ComplianceOnline.com - Largest Compliance Portal on the Web
Organization
• Policy & Document Management
• Third-party Management
• Quality Management
• EHS & Sustainability
• Content and Training

Q&A
Please submit your questions to the host by typing into the chat box on
the lower right-hand portion of your screen.
Thank you for participating!
Michael Rasmussen
Chief GRC Pundit
GRC 20/20 Research
Email: mkras@grc2020.com
MetricStream
Email: vasant@metricstream.com
A copy of this presentation will be made available to all participants in next 48 working hours.
For more details on upcoming MetricStream webinars:
http://www.metricstream.com/webinars/index.htm

THANK YOU
Contact Us:
Website: www.metricstream.com | Email: webinar@metricstream.com
Phone: USA +1-650-620-2955 | UAE +971-5072-17139 | UK +44-203-318-8554

Enterprise policy-management

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Enterprise policy-management

Similar to Enterprise policy-management (20)

Recently uploaded

Recently uploaded (20)

Enterprise policy-management