I often speak with business leaders who recognise that their governance, risk, and compliance processes are manual and difficult to report on, but are unsure where to begin when selecting a new solution.
If you’re considering a new GRC software here are key questions to help guide your decision-making process.
1. Replicating your Processes
Evaluating how much change the new software will introduce. A crucial question!
- Do you need to adapt your processes to the software, or can the system meet your process requirements? (forms, approvals, workflow, reporting).
- Look for a solution that can replicate your operational processes as closely as possible, to avoid unnecessary process re-engineering and disruptions.
2. Implementation Strategy
Risks and Expertise.
- Ensure there is a realistic, clear and manageable implementation plan to minimise risk.
- The best software providers offer comprehensive support to make the transition as smooth as possible.
- Check references!
3. Ease of Modifications
Flexibility is essential.
- By definition, GRC evolves continually.
- How easy will it be to make adjustments as compliance requirements evolve or business needs change?
- Is this included in your support package?
4. Information Security
Increasingly important.
- Where is the data hosted and who outside your organisation has access to it?
- How easy is it to export your data in bulk? How does a “Transition OUT” look like?
- What are the agreed backup and DR protocols? What are the agreed RTO and RPOs?
5. All GRC
Many organisations run separate streams (or silos) for WHS, Quality, Enviro, Risk, Training etc.
- Can the system support them all allowing consistency with a common look-and-feel, yet retain each stream’s unique requirements?
- What about elements such as Management Reviews, Internal Audits, Vendor Management, Contract Management, Training Management?
Costs are important but getting any of these wrong will lead to losses of time, $ and effort!
P.S. Whenever you are ready, have a chat with us about ISOPro.
Our promise: if we don’t make a difference within 90 days, you don’t pay.
Gianni Torta and the ISOPro team