Governance, Risk and Compliance

Student’s name

Instructor’s name

Date

Governance, Risk and Compliance

Q1

Why Do Organizations Need GRC?

An organization uses GRC to manage the general governance, initiative risk management and compliance with guidelines. It is a structured approach that aligns information technology with business goals while managing risks effectively and meeting compliance needs. A well-planned GRC plan has a lot of benefits like improved decision-making, more optimal information technology investment, removal of silos, and fragmentation among departments. The organization develops the framework for leaders, organization and organization’s operations to ensure that they support and strategic objectives are reached. The framework specifies defined measurable that make organization efforts outshine. The IT GRC solution created helps to coordinate strategies that control regulatory compliance requirements. The solutions usually are cloud-based which increases efficiency and minimizes complexity.

Despite the kind or dimensions of an organization one can be a leader or worker, there is a collective set of optimistic outcomes that institutions need to attain. High-performing firms share a standard set of characters with one another. Leaders in a group ensure that every departments work as one to attain the business purposes. The positive culture motivates higher outcome and encourages responsibility, honesty, trust, and communication. The stakeholders comprise workers, board, investors, and partners. They trust that the organization is performing the right thing and heads towards a promising future. High-performing firms are prepared to tackle risks, and a shift in regulatory needs also has the ability to bounce back misfortunes. They take steps to mitigate adverse outcomes, detect possible issues, reduce impacts, and tackle problems as they arise. Governance, risk, and compliance play a vital role in a firm’s ability to attain principled performance. When an organization has strong GRC capabilities, it helps navigate and prosper in the current challenging and complicated business environment. After all, business today should grapple with a host of factors. The Act that applies is the Federal Information Security Management Act (2002) that needs the directors of the officer to oversee national agency info security strategies and practices. The national agency is expected to identify and offer information that concerns security protections commensuration with risks and harm that resulted from unauthorized use, disruption or destruction of data.

Different roles of internal stakeholders involved in supporting effective GRC practices

The OCEG stresses the significance of shared responsibilities and incorporation in GRC actions. It is found that the moment risk organization, CSR program, compliance and sectors are soiled, they are always unproductive. Additionally generates problems like high cost, inability to risk, inability to tackle threats, and challenges in gauging risk-attuned performance (Racz & Seufert, 2010). Alternatively, when a firm’s diverse roles are working as one, sharing information, using standard procedures and shared technology load, they can ensure that the right individuals get the correct info at the right moment. Thus right purposes are created, and the right activities and controls are put in place to handle uncertainty in a steady way. The integrated way of approaching GRC results in decreased prices, decreased replication of actions and condensed effects on the operation. Additionally, it helps attain a complete view of risks and advances the group’s capability to collect info faster and attain a significant capability to replicate procedures consistently.

GRC affects the entire business and can’t be the duty of one person or a sector. Senior leadership, IT leaders, product leaders, business operators, and compliance professionals all take part. For instance, IT and security leaders execute definite safety controls (Tarantino, 2008). Designers should know when encryption standards apply during software improvement and adhere to the chosen procedure to evaluate codes for security breaks. Senior management should set top from the top, order the group’s risk acceptance profile and support the recompenses plans for workers. Human resource plays a role in persuading workers to whole compliance training on data discretion and cyber security responsiveness. Various stakeholders have different roles they play in GRC success. For example, the governing organizations offers perception and high-level direction to organization consisting of setting the duty, visualization and values, ethical standards, risk acceptance ad high-level statement of objectives and goals.

The chief financial officers assist executives by creating and explanation of the decision-making standards linked with the financial approach of the firm. The CFO’s upkeep is crucial to GRC’s achievement since it supports initiative deemed significant in attaining organizational objectives. The risk executive looks at risks and chances presented to a firm and conducts threat analysis (Tarantino, 2008). The compliance managers ensure the group is within specific limits while aims to meet goals. It is attained by utilizing organization activities and control. Small business faces a lot of risks when they are not well defined, manageable approach to GRC. The most common impact of these attacks on small businesses is losing sensitive information of the customers and workers. Furthermore, it is mentioned that the security of the organization is ineffective in preventing attacks.

Q2

Regulatory initiatives implemented,

Financial and human resources initiatives are always infinite though they are scanter and more valuable now than at any moment in a generation. Determining where to assign them is therefore hard and riskier since wrong decisions could harm an institute. Yet administrators should make resource sharing choices and swiftly lessen the effects of the downturn. Simultaneously, they are expected to watch the horizon and organize the firm to prosper when enhanced days finally reappear (Brache & Bodley-Scott, 2009). Due to complexity and threats during the decision, the process for evaluating the project should be coherent. In most cases, the process called optimal project portfolio is recommended. 

In the first step, project prioritization criteria are developed just like a reserve, the portfolio should be varied. It consists of planned and strategic initiatives, customer-focused, cost-driven initiatives, with worker-focused projects. The second step is to examine resource capability. When it comes to obligating a specific number of enterprises, one doesn’t need to bite off more than you can chew and at the same time need to utilize opportunities (Brache & Bodley-Scott, 2009). For instance, improve systems, see the customers better or improve workers’ development and retention hence the importance of measuring resource capacity. The third step is to gather and organize information on the present and planned project. The Act enforced is the New York Business Corporation Law that mentions issues of international business. The state permits foreign companies to do their business after it is authorized through the jurisdiction of its incorporation.

Since the financial disaster in 2008, there is an enduring flow of new controlling and compliance enterprises in the business services firm. Globally, the regulatory bodies and administration have been permitted to push reforms for financial organizations to decrease their risks, intensify their constancy, offer clarity, defend their customers, increase their liquidity and strengthen their capital basis (Reyes‐Rodríguez et al., 2016). Currently, regulations cover the entire value chain for financial services institutions. The rule isn’t new to financial service firms, but where they previously executed regulatory needs; these organizations now link regulatory requirements directly to company policies. Many financial service firms undertake three stages in terms of how they have achieved rules. As the initial stage, most financial industries handled regulatory needs in a more outdated, sensitive way. New mandates from regulators were assessed in detail to comprehend their impacts on firm. Lastly, the new necessities were executed in a slender way to reduce the distraction to business.

Due to significant regulatory needs and elaborated costs, financial organizations have started to contemplate different features and identify the worth of proactively combining controlling and corporate needs to attain a competitive advantage and give to a bottom line. As an outcome, banks progressively connect regulatory enterprises with business needs. A change happened, and many financial organizations began to contemplate such projects as a chance instead of an aggravation. They began to combine the regulatory necessities with business enterprises like competence advance, business procedure reengineering, and CRM renewal to attain goals simultaneously (Reyes‐Rodríguez et al., 2016). Most financial service organizations are recently one step ahead, with regulatory matters becoming the core part of their tactical plan. The connection between governing and industry policies is of great importance. The need of comprehending the strategic extents of rules and their impacts on business is a reason why senior regulatory compliance directors are involved more in strategic scheduling.

Practical Aspects of Environmental Strategy

The execution of an environmental management system is a portion of a proactive environmental plan whose aim is to establish organizational capabilities that lead to differentiation, better reputation, client loyalty, and improvement. The systematic process utilized by the organization applies to environmental strategy goals and offers a verification path for external auditors. It includes detailed documentation, procedures, internal resources, and responsibilities. The main reason for the adoption of this system is that it reduces environmental impacts, improves process efficiency, and boosts workers’ motivations. The adoption of design is a process of organizational change, and every organization may decide to choose its goals in response to internal and external factors.

The management accounting procedures and data are essential to numerous aims such as assessing environmental costs, fair product pricing, compliance with regulatory demands, and budgeting f risks. Environmental improvement is a reformation of products, production procedures, and business methods. The main aim is to attain and preserve corporate legitimacy. Firms have legal rights to function though they should earn their moral rights to be part of the community. Positive effects can extend to attain a competitive advantage, advancing corporate image, encouraging better customer relation and tax benefits from regulatory authorities.

Q3.

Ministry of business innovation and employment

The MBIE is in charge for designing and overseeing sixteen regulatory systems. The regulatory system comprises regulations, institutions, skilled workforce, practices, and understanding that combine to create rules of a sector effective. The main reason that ministry of business innovation and employment established a regulatory system program is to release the stewardship roles (Arun & Turner, 2004). The MBIE regulatory system assessment ensures that individual scheme is performing well and can respond to upcoming problems and trends to remain fit for purpose. The corporate regulatory system is a foundational structure in various ways. It offers the infrastructure for creating business and corporate strategies for the benefit of the economy. Every worker in New York must comply with the SHIELD Act due to private information. Beyond that, most businesses are expected to adhere to the regulations applied to any company that maintains the personal info of New York citizens. Given the SHIELD Act’s breadth and it enforces needs directly relevant to HR experts, each employer needs to understand and address the Act implication for business.

The regulatory system assessment offers an insight into how well a regulatory structure is working at a specific point in a moment within an existing strategy and institutional standards. Assessment isn’t an analysis of what regulations should e nor is they full assessment of policies and capabilities of government agencies involved in the system. It is the role of performance improvement frameworks (Arun & Turner, 2004). The assessment of the corporate regulatory system started in late 2015. A public image is a well-functioning approach that attains a good outcome for the United States by setting rules and incentives for how organization entities are structured, controlled, and dissolved. It, in turn, offers the rational foundation for business and nonprofit organizations to attain their aims and ensure markets and participant confidence. The main strengths of the system are in the continuous maintenance of the system from an operational and strategy perceptive and the daily delivery of services to users. 

Key regulators are operating effectively, and there is a robust fixed practice of reaching out to customers to understand and meet their needs. In context to the present risks to New York’s reputation for maintaining a well regulated corporate system, the main issues facing the system are in articulating a commonly understood set of system targets and in ensuring string stewardship of the plan (Vignjević-Đorđević, 2014). The system’s main objective is to create more unity across the structure and for all its parties to comprehend better how they contribute to the system’s health. The panel considered that a clarified allocated stewardship role would aid in identifying and manage systems risks. It is specifically essential to ensure that New York’s international reputation is maintained. More has to be done to understand what the corporate system consists of and arrange further tasks around rational focus areas. The works involve confirming the scope of structures and making precise essential subsets of the systems. It will help to build buy-in and collective comprehension for system participants. 

The policy and operational roles of the ministry of business innovation and employment (MBIE) are being delivered at a high standard and are considered by the participants. The panel found that there is a scope for strategy development to be more proactive and to tackle main strategic queries (Vignjević-Đorđević, 2014). The organization officer’s enforcement strategies are not well comprehended, and there is a chance to promote better compliance and implementation work to offer a robust deterrence outcome. The leading causes of agency issues are the lack of effective corporate authority in the segment and presence of information asymmetries. The recommendation is that the central bank has developed a policy measure and reforms to mitigate for reoccurring. These measurements include enforcement of corporate governance code to make the company strong. The second way is to introduce tenure restrictions for financial institution directors to mitigate sit-tight managing directors who can manipulate their way around easily.

Q4 Compliance team in an organization

The compliance team in an organization is responsible for enforcing the rules. In firms where the culture of compliance is strong, the team can protect the franchise and find opportunities to assist the business in meeting its sales and growth objectives. Rather than looking at the violation and conducting tested strategies and procedures in a year, the compliance team in an organization is involved in discussing new products and services offering and taking part in a talk concerning procedural changes residents (Afiah & Rahmatika, 2014). The compliance team’s primary mandate is to protect the firm and its image. To achieve that, compliance officers need to communicate effectively, especially internally, with people at all departments. The compliance team is responsible for protecting the franchise from threats that need every member to participate. This team should deliver compliance messaging and training to rank and file workers in each department in a way that can be understood. Compliance in most financial service companies is no longer restricted to complying with the latter of regulations. More than before, the compliance team is tasked with serving in advisory roles for the firm and monitoring and ensuring compliance with applicable rules. In turn, it creates opportunities to aid adherence in fulfilling its core functions to ensure the business is protected from risks.

Apart from New York’s false claim Act that addresses false claims; there are some other common laws to interact with the administration. The specific jurisdiction that relates to is the NYS social services regulation. It is a blasphemy to knowingly obtain or try to get payment on services furnished under a social service program using a false statement.

Potential factors that influence the development of regulation

Economic downturn affects the local budget in two ways. First is the revenue reduces mainly revenue on sales or revenue levies which are further profound to the cost-effective cycle. Secondly, during the recession, the remuneration becomes challenging to reach; hence, government aid to local administration may reduce residents (Afiah & Rahmatika, 2014). Additionally, inflation generates uncertainty in administration expenditure and incomes forecast. When the standard of living rises, systematized labor specialists keep salaries current with price increases; through this, regulations are affected. Change in social and demographic factors has a significant influence on the local budgets. When the populace upturns and fixed charges are allocated to families, the consequential economies of scale will reduce per-unit cost. 

Since monetary needs don’t reduce in fraction to residents’ loss, a society with a reducing population has a challenge decreasing outlay. Also, expenditure for public edification, education services public safety is a budget classification that mainly influences the age destruction of a people. Researchers show that growth in personal revenue affects the governmental budget size. Higher-earning families mandate higher and better facilities from the administration residents (Afiah & Rahmatika, 2014). At the local level, the county and city managers are progressively utilizing the budget to comprehend well how people instead of internal partakers are the administration. Such change will have significant influence on budget allocation and the comparative size of the county with city authorities. We should hope for better diversity amongst the local government in the sorts and excellence of services offered as society improves a reputation for having strength in specific facilities. And assumed the dominant distinctions in service preferences that have been acknowledged amongst age groups, we should also hope for advance division of community along generation ranks. The kinds of resident engagement to get citizen response, residents survey, meetings, and interactive websites.

Recommendations

As the compliance officer, one can prepare for economic influence. First, it through prohibition of the sectors from outlaying all their provisions, holding back on authorization to hire new workers or making additional agreements, and creating investments. Secondly, attaining a competitive advantage over other prerogatives is to trade the tax issues, lifting it from resident to no residents (Afiah & Rahmatika, 2014). Such actions minimize taxes on citizens while letting service levels be upheld. Unless the national government also offers total capital to execute the directives, local agencies may have to reduce services to abide by. Societies suffering the special effects of the downturn have been hit instantaneously by unfunded directives and reductions in state expenditure. 

Q5

The transparency and accountability of the regulator are crucial to the effectiveness of the regulatory system.

Delivery of regulatory outcomes by government and other regulatory agencies to businesses, Cooperation’s and citizen in the USA is critical to the effectiveness of a regulatory system. Transparency and accountability go hand in hand as they support the performance of regulators and good behavior. Ensuring accountability and transparency enhances a foundation stone for a clear comprehension of the respective responsibilities and roles of various regulators and other bodies in the overall regulatory system. It is essential to enact adequate transparency and accountability practices in a regulatory system that helps in risk management and identifying parties responsible for anything going wrong and all corrective measures to be undertaken where necessary (Mitchell, 2007).

Regulators in the IT sector are mainly tasked with the responsibility of protecting the public interest. Governments and other regulatory agencies conduct audits and investigations intending to make sure that organizations and industries don’t expose the public to threats hence securing the safety and well-being of the people. Regulators are expected to be transparent so that they are accountable to legal reviews and public oversight. For example, the USA government mandates fairness in all personal data processing, explanation of how data should be treated, safeguard against misuse of data, and data portability. Regulators also provide data practice that prevents unlawful discrimination; chances for equal opportunities is to protect civil rights (Fowler, 2017)

Clear and straightforward operational policies related to enforcement, compliance, and decision reviews are supposed to be made publicly available by regulators; this may also include relevant guidance material that may aid users in understanding what is being conveyed. The policies should explain how the regulator will conduct itself and the various ways in which policies will affect the regulatory outcomes. When there is transparency in operational policies of a regulatory system, it will significantly contribute to creating confidence with the public and a clear understanding of what is expected and procedures to monitor, judge, and enforce compliance in case there is a breach of law. Transparency is an essential aspect in assessing the effectiveness of a regulatory system as it prevents reviews of decision making; this is evident if the regulators will explain a decision which will aid in avoiding a large number of appeals to the process given.

Regulators are responsible for imposing penalties for non-compliance establishment and enforcement of performance requirements in having an effective and trustworthy regulatory system. The Federal Trade Commission (FTC) has enforced legislation that applies to unfair and deceptive practices and expects organizations and businesses to implement security measures. Since 2000 the commission has been responsible for imposing enforcement action against

Enterprises and organizations that fail to comply with security measures. In addition to the security measures, New York SHIELD Act has more comprehensive information related to security requirements at the state level, and the New York Department of Financial Services deals with organizations such as insurance companies and banks that have more detailed requirements. Cyber Security and Infrastructure Agency Act established CISA, a department of Homeland security tasked with the responsibility of protecting critical infrastructure in the USA. In conclusion, Regulators in the IT sector are mainly tasked with protecting the public interest, providing clear and straightforward operational policies that relate to enforcement, compliance, and imposing penalties for non-compliance establishment and enforcement of performance requirements in having an effective and trustworthy regulatory system.

References

Afiah, N. N., & Rahmatika, D. N. (2014). Factors influencing the quality of financial reporting and its implications on good government governance. International Journal of Business, Economics, and Law, 5(1), 111-121.

Arun, T. G., & Turner, J. D. (2004). Corporate governance of banks in developing economies: Concepts and issues.

Brache, A. P., & Bodley-Scott, S. (2009). Which initiatives should you implement? Harvard Management Update, 1-5.

Fowler, B. Americans Want More Say in the Privacy of Personal Data. Consumer Reports (May 18, 2017), http://www. consumer reports. org/privacy/Americans-want-more-say-in-privacy-of-personal-data/[http://perma. cc/7H2V-4RQH].

Mitchell, S. L. (2007). GRC360: A framework to help organizations drive principled performance. International Journal of Disclosure and Governance, 4(4), 279-296.

Racz, N., Weippl, E., & Seufert, A. (2010, July). A process model for integrated IT governance, risk, and compliance management. In Proceedings of the Ninth Baltic Conference on Databases and Information Systems (DB&IS 2010) (pp. 155-170).

Reyes‐Rodríguez, J. F., Ulhøi, J. P., & Madsen, H. (2016). Corporate environmental sustainability in Danish SMEs: A longitudinal study of motivators, initiatives, and strategic effects. Corporate Social Responsibility and Environmental Management, 23(4), 193-212.

Sadiq, S., & Governatori, G. (2015). Managing regulatory compliance in business processes. In Handbook on business process management 2 (pp. 265-288). Springer, Berlin, Heidelberg.

Tarantino, A. (2008). Governance, risk, and compliance handbook: technology, finance, environmental, international guidance and best practices. John Wiley & Sons.

Vignjević-Đorđević, N. (2014). Corporate governance: State and trends in the region: A regulatory approach. Ekonomika preduzeća, 62(5-6), 264-280.