Today I've seen a blog entry which claimed that GRC is dead. That reminded me about the closing keynote of our European Identity Conference 2009 where I had a discussion with Paul Heiden of BHOLD Company about GRC. Paul claimed that GRC is just dealing with FUD (fear, uncertainty, doubt) and that there is no real business value in this.
So - is the market for GRC solutions (Governance, Risk Management, Compliance) dead before it really blossomed?
Yes, if GRC is limited to auditing, with focus on some dashboards and some information extraction for auditors.
No, if GRC is understood as something which goes well beyond this and isn't limited to a narrow one-way-road. And that is how we understand the GRC market and how we have defined this market segment in our GRC Market Report 2008.
There are some real value propositions for GRC solutions, beyond "avoiding penalties" as the classical negative inhibitor:
- On the lowest level, one standardized approach to GRC issues tends to be more efficient than many point solutions.
- Much more important is the ability to not only audit but control - Enterprise Authorization Management (or Entitlement Management) is one of the key elements of GRC solutions, providing business control for the access to IT resources.
- This is, by the way, much more efficient than the granular, isolated management of access controls on lower levels. A relatively small number of business roles and rules usually covers a significant part of all access controls on lower levels in the infrastructure, down to the system level. These lower level controls can be derived, with some added exceptions.
- The probably most important aspect is that GRC done right enables a more efficient management, focused on exceptions. Defining and measuring risks provides this ability.