A Proverbial Approach to GRC Success
By Jason Rohlf
I’m a quirky individual. One quirk (of which I am acutely aware) is my tendency to reference traditional English proverbs to state a point. We’ve all heard and used these famous proverbs at one time or another. While my wife, kids, friends and coworkers love to roll their eyes and give me grief for this personality trait, I’m a firm believer that many of these proverbs have stood the test of time for a reason, and they’re as true today as they ever were.
I’m the first to admit that I often throw out a proverb as a way to state the obvious. When a friend tells me how frustrating it is to pour effort into a proposal that their management won’t buy into, and I say, “you can lead a horse to water but you can’t make him drink,” I’m not bringing much to the table. But because I do believe there is wisdom within our traditional proverbs, I’ll take this opportunity to invoke some of my favorites and put them into terms that might prove useful when applied to challenges in the realm of Governance, Risk and Compliance (GRC).
A Stitch in Time Saves Nine
This proverb often leaves people scratching their heads, but to me it’s pretty straightforward. If taken literally, you might think that if I had a hole in a piece of clothing, better to expend the time and effort to put in one stitch rather than nine times the effort down the road. To put it another way, if you are facing an issue that you know will require effort to address, you are much wiser to spend the time addressing it as soon as it becomes known rather than waiting until it grows into something that will require significantly more effort, or worse, becomes totally irreparable.
In my everyday work, I apply this saying when crafting specific business requirements for GRC process implementation. I would rather spend the time working through each line of the requirements document and resolving all issues and concerns before I set down the path of designing and implementing the process. For example, if I’m engaged with an internal audit team to help them gain efficiencies in their audit planning, field work, issue management and reporting, I have to know the challenges they’ve experienced to date and work through the details of solving those challenges on paper before jumping to a technical solution.
If I simply assume that the requirements are “fully baked” and progress into the design and build phase of my engagement without formal buy in, it will take significantly more time, effort and energy to back out of what I’ve done to address any subsequent issues. The proverb, “An ounce of prevention is worth a pound of cure,” also comes to mind here.
A Chain Is Only as Strong as Its Weakest Link
In the course of my consulting work, I typically engage with large teams in very large organizations. Throughout my career, I have worked for companies, departments and teams of all sizes. Regardless of the situation, this proverb has held true time and time again. No matter how many people you involve in an initiative, the strongest members can carry that team only so far.
If you have a team of ten people with two all-stars, seven solid performers and one under performer, it takes only one action by that under performer to tarnish the reputation of the entire team. Another way to state this could be, “A few bad apples spoil the bunch,” but the message is the same. It takes focus and effort from everyone involved to ensure that expectations and deliverables are in line.
Actions Speak Louder Than Words
While many of the proverbs are structured and phrased in a more “old English” sort of manner, this one gets right to the point in a modern, straightforward way. It’s easy to talk about what needs to be done, to explain why you implemented a process a certain way or to justify poor decisions. These words amount to nothing if you fail to take action when issues arise.
While there are certainly risks involved with committing to a specific course of action as you set out to accomplish your goals or solve a problem, inaction can and likely will be downright crippling, all but ensuring that your goals go unmet and your problems fester and grow. Also remember that “procrastination is the thief of time.” The longer you delay action, the fewer resources you will have at your disposal once you finally set yourself to the task.
A Poor Workman Always Blames His Tools
Much of my consulting work involves leveraging various GRC technologies to enable business processes. Some of the problems I’ve encountered in my time using these tools have been more challenging than others, but our goal always remains the same: to maximize the technology’s benefits while working around the limitations.
We all have our wish lists, and most of us realize that there comes a time where compromises must be made. Yet, I have also seen my fair share of situations where individuals become mired in what the tool can’t do, what functions and features it doesn’t have and how they won’t get any benefit out of it. While I can certainly understand the need and desire to have certain features available to help you do your work in a more effective and enjoyable manner, many of the concerns I’ve heard have been over minor features that don’t add much value. Or worse, the missing functionality is identified long after the software selection process has passed (putting the user squarely into “stitch in time” territory).
Here’s the bottom line: There isn’t a tool out there that will give you 100% of what you need (or think you need), and more often than not we are left to do the best with what we have. Blaming a tool for the inability to accomplish objectives is certainly easy and at times acceptable, but that doesn’t mean you will be released from your own responsibility in the matter.
Rome Wasn’t Built in a Day
I use this final proverb to remind myself that I can’t expect to accomplish everything at once. I tend to get impatient in my work, and I always want my projects to be further along than they are. But sometimes I need to remind myself that it’s OK to slow down, be deliberate, and simply think. I don’t need to have my hands on the keyboard or facilitate a meeting to make positive contributions to the overall effort. My brain is my biggest asset, and I need to be comfortable with moving at a sensible pace. After all, “haste makes waste,” so it’s perfectly acceptable to step back and re-evaluate every now and again.
What proverbs ring true for you? I’d love to hear your feedback!
Reposted with permission from orangepoint.com.