IT GRC: Bridging the Gap: between the Digital and Physical World

Digital technologies are no longer the preserve of IT departments. Freed from the shackles of  siloed manual processes & paperwork, businesses are embedding software systems, platforms, and applications into their daily operations to gain competitive advantage. Now an expectation, digital operations have become the touchstone of modern business models. According to research, 93% of organisations have adopted or have plans to adopt a digital-first business strategy.

Although being entirely digital or aspiring to get there offers businesses enticing benefits – such as improved efficiency, enhanced customer experience, and cost reduction – it also exposes them to new digital risks and increasingly robust compliance obligations.

In an age where the line between the digital and physical worlds becomes increasingly blurred, understanding Governance, Risk Management, and Compliance (GRC) – in both a digital and physical context – has never been more critical. This blog delves into the complexities of managing risk and ensuring compliance in both domains.

How GRC is evolving into ‘IT GRC’

To be successful, modern organisations must be flexible enough to manage the growing complexity of IT environments alongside the traditional physical risk & compliance requirements they’re exposed to. The need to strike a balance between the two has prompted the emergence of a contemporary approach to GRC that integrates these emerging digital requirements – resulting in the term ‘IT GRC’. 

IT GRC is the term used to refer collectively to a whole host of technology capabilities that enable an organisation to ensure their company data is secure by managing IT related risks, threats, and vulnerabilities, and ensuring compliance with data privacy laws & regulations. It also involves implementing a strategy that ensures IT infrastructure is fit for the future – making sure systems, software licences & equipment are up to date and implementing business continuity & disaster recovery plans.

Of course, to manage all these requirements, IT teams are finding that they benefit from using many of the capabilities available in traditional GRC software. Functionality like digital risk registers, online risk assessment forms, and incident management tools can all be used in an IT context, to manage and resolve cyber related risks & incidents. Similarly, traditional compliance obligations libraries & policy management tools can be used to ensure compliance with data privacy regulations & legislation and internal IT policies & procedures.  In addition, GRC technology offers a variety of workflows to implement IT governance, manage IT assets & licences, and ensure the correct handling of company data and usage of IT equipment. 

With risk & compliance requirements from both the physical and digital worlds benefitting from much of the same GRC technology capabilities, it is becoming logical for organisations to integrate digital risk management & compliance requirements into their existing GRC programme. Managing both in the same platform enables organisations to understand the impact of digital risk & IT related compliance requirements on other areas of the business.

The challenges of managing digital requirements

IT systems and the digital data they collect are vital to keep up with the sheer velocity of change in the corporate landscape and ensure long-term success. However, a continuous innovation cycle with a digital-first perspective exposes businesses to potentially crippling challenges if not managed expeditiously. Risk areas that are heightened when a company is largely digital include:

• Cybersecurity: In its 12th Risk Barometer, Allianz ranked cyber incidents (34% of responses) as the most important organisation risk globally for 2023 – remaining at the top for a second consecutive year. As cyber-attacks targeting organisations continue to escalate both in terms of frequency and sophistication, many digital operations are struggling to keep pace with this pervasive threat – exposing them to reputational damage and legal penalties. 
• System downtime: An utter reliance on digital systems brings application unavailability, technical glitches, network outages and natural disasters into sharp focus for businesses. Even a short system downtime can paralyse operations, potentially leading to remediation costs, lost productivity, poor customer experience, and a reduction in sales.
• Regulatory compliance: The regulatory screw has been tightened against the backdrop of escalating cyber-attacks that aim to compromise personal and corporate data. This requires organisations to become compliant with a constant stream of new data privacy laws, regulations, and standards like GDPR in Europe and NIST in the US and the globally recognised ISO 27001 standard.

Digital and physical risk interdependencies

Risks in the digital realm can lead to tangible consequences in the physical world and vice-versa – this is referred to as risk interdependencies: the effects that different risks have on each other and the overall objectives of a project, programme, or organisation. Risks can generate positive or negative outcomes, depending on how they interact and how they are managed. Organisations must therefore recognise how vulnerabilities and threats in the digital & physical worlds can impact another and take proactive steps to address these interdependencies to enhance their overall security and resilience.

Supply chains are increasingly dependent on digital technologies for tracking and managing inventory. Cyber-attacks on these systems can disrupt the flow of physical goods, leading to production delays and shortages. Meanwhile, power failures & internet downtime can disrupt the operation of digital systems, including data centres and cloud services. Without power & online capabilities, critical digital infrastructure may become inaccessible, leading to data loss, service interruptions, and financial costs.

The interdependencies between digital and physical risks amplify the need for business continuity plans. These robust strategies, procedures, and plans provide essential functions with the know how needed to maintain or quickly resume operations during & after digital & physical incidents.

Managing physical risk with IT data

This ability to bridge the gap between IT-related GRC activities and traditional GRC requirements can be leveraged to understand likelihood & severity physical risks. Various systems & applications used across the organisation collect and process vast amounts of data from a variety of sources – which can be analysed to identify patterns, anomalies, and potential risks in the physical environment. For example, abnormal temperature fluctuations in a data centre could result in the physical risk of fire, late payments in the accounting system could signify a cash flow risk, or failed customer deliveries or bad reviews could lead to a drop in sales.

Traditional risk management and compliance measures remain crucial in a digital age

Although business models are becoming more digital and relying on a variety of systems and applications to run their operations, traditional risk & compliance requirements should not be forgotten. Common GRC focus areas like safety regulations, supply chain governance, and the mitigation of operational failures remain fundamental in the digitally-enabled business world – and should not be overlooked in favour of emerging digital risks. 

Instead, digital GRC technologies should be leveraged by businesses to become more efficient at monitoring, identifying, and remediating both physical & digital risks and compliance failures. The API integrations available within GRC technology enable organisations to pull in vast amounts of data from other systems & data sources, enabling them to monitor risk & understand compliance violations in real time based on live data. 

Digitalisation can provide a single source of truth that instantly notifies stakeholders of potential risks & incidents and continuously monitors progress. 

By adopting a proactive, automated approach to risk management and compliance, businesses will mitigate the amplification of preventable physical incidents that can result in lost productivity, remediation costs, reputational damage, and legal liability. For example, monitoring physical risk using information that’s derived from the collation and analysis of digital data provides clarity around the cause of an incident in real-time- facilitating a proactive and timely response.

IT GRC: A unified approach

A unified approach to GRC can help an organisation operate seamlessly, ethically, and responsibly by recognising that these three critical functions are interrelated and whether physical or digital – they should be managed together. An IT GRC framework integrates governance, risk & compliance within an organisation to streamline processes, improve efficiency, and enhance decision-making – by understanding risk & compliance from both a digital and physical perspective. 

An IT GRC programme will ensure digital risks are managed effectively, maintain compliance with data privacy laws & regulations, and guarantee IT infrastructure is fit for the future. GRC technology can provide a unifying platform for the successful implementation of IT GRC processes. Whether risks are digital or physical they still need to be logged in a risk register, have regular risk assessments, and require controls to reduce the risk. Similarly, whether laws, regulations and compliance obligations are related to IT security & data privacy or other business processes like HR, health & safety, or operations – a company still needs a comprehensive obligations register, compliance workflows, governance procedures, and timely policy reviews. 

Managing both physical & digital risks & compliance obligations in the same platform provides a consolidated, single view across an organisation. GRC technology can fill the gaps left by entrenched siloed, disjointed approaches. Strengthening, rationalising, and combining these processes can help improve business performance and enhance decision-making.

Integrated GRC software to the rescue

Integrated GRC software empowers organisations to embrace the synergies between their digital and physical risk management requirements and compliance obligations by leveraging automated tools and processes, including:

Risk Management – Create multiple risk registers in the same platform to capture digital risks and physical risks separately and run combined reports to view risk holistically. Create customised risk assessment forms for each category of risk, ensuring the correct data is captured for both physical & digital risks. Set controls & perform control testing for both digital and physical risks centrally in the same platform.

Compliance – Create a compliance obligations library to manage standard compliance obligations in parallel with any data privacy and cyber-related requirements. Implement strict governance procedures & policies to ensure compliance. Manage regulatory change with comprehensive workflows to automate the process.

Third-Party Risk management – Create an online vendor library for all types of vendors including digital providers, making it easier to manage and track vendor relationships & understand the risks they pose. Roll out vendor risk assessments with conditional workflows and transparent scoring methodologies – streamlining the vendor benchmarking process – allowing organisations to consistently evaluate and compare vendor risk profiles. Implement automated monitoring of key metrics like SLAs, KPIs, and industry benchmark standards to provide continuous oversight of vendor performance. Empowered by the information risk-related data produces, organisations gain clarity when comparing vendors, allowing them to standardise the onboarding and offboarding process and manage contract renewals centrally.

Asset Management – Online asset management registers enable better asset management of hardware, software licenses, and physical assets – ensuring all equipment and licences are up to date and fit for the job. It also provides an overview of out-of-date equipment & licences, simplifying budget planning.

Policy Management – All policies and procedures – from health & safety and HR to IT – can be managed consistently and stored in a central online repository with workflows to flag expiry dates and automate signoff, approval processes, and attestations.

Strategic Planning – Using strategic planning capabilities within GRC software, organisations can plan out their strategic goals & objectives (including any digital strategies). Once defined, software capabilities will make it easy to break down these top-line goals into smaller tasks, projects and actions that can be allocated out across the organisation for completion. As tasks are fulfilled, progress is indicated – making it easy to see how the strategy is progressing at all levels of the business. Ensuring your strategic goals include plans for IT infrastructure will futureproof the organisation.

Audits – Organisations are subject to a wide variety of audits, inspections, and checks. Within GRC software, organisations can schedule and manage internal and external audits and formalise the results and required actions – providing a complete history of all audits and their findings and any outstanding actions.

BCM & Operational resilience – With many organisations relying on multiple digital systems and physical manual work to run their operations, having robust business continuity plans in place is essential to ensure operations can keep running no matter what happens. The loss of the internet, the failure of a supplier or software solution, or a data breach should not halt operations and organisations need to have plans in place for all eventualities. Software can support the creating of BCM plans, business impact assessments, and business process modelling – making it easy to understand the impact of an incident in terms of cost, downtime, and man hours lost.

If an organisation manages its digital and physical GRC requirements in isolation it will engender a disjointed and siloed approach that fails to align with its objectives, creating uncertainty and ultimately hindering performance. Instead, organisations must recognise that digital and physical GRC efforts are not mutually exclusive; they must be considered and managed in unison to create a holistic approach to managing risk and ensuring compliance. 

To bridge the gap between the digital and physical worlds from a GRC perspective, forward-thinking organisations are embracing integrated software that provides a centralised platform for managing all GRC activities. This power to streamline data collection, reporting, and analysis makes it simple to maintain a unified approach to GRC that considers both realms holistically.

For more information about how Camms can support your organisation to implement a comprehensive IT GRC programme, request a demo.