Governance, Risk And Compliance Research Articles

Leveraging business analytics to build cyber resilience in fintech: Integrating AI and governance, risk and compliance (GRC) models

The rapid evolution of fintech has brought significant advancements in financial services but also increased vulnerability to cyber threats. This review explores how business analytics, artificial intelligence (AI), and Governance, Risk, and Compliance (GRC) models can be leveraged to build cyber resilience in the fintech sector. It begins by discussing the growing cyber threat landscape and how AI-driven solutions and predictive analytics enhance fintech cybersecurity. The paper further examines the integration of GRC frameworks to ensure effective governance, continuous risk monitoring, and compliance with regulatory standards. By synergizing AI, business analytics, and GRC models, fintech companies can strengthen their defenses against evolving cyber risks. The review concludes with recommendations for fintech firms to adopt a proactive, data-driven approach to cybersecurity, promoting long-term sustainability and protection in an increasingly digital financial environment.

From COBIT to ISO 42001: Evaluating cybersecurity frameworks for opportunities, risks, and regulatory compliance in commercializing large language models

This study investigated the integration readiness of four predominant cybersecurity Governance, Risk and Compliance (GRC) frameworks – NIST CSF 2.0, COBIT 2019, ISO 27001:2022, and the latest ISO 42001:2023 – for the opportunities, risks, and regulatory compliance when adopting Large Language Models (LLMs), using qualitative content analysis and expert validation. Our analysis, with both LLMs and human experts in the loop, uncovered potential for LLM integration together with inadequacies in LLM risk oversight of those frameworks. Comparative gap analysis has highlighted that the new ISO 42001:2023, specifically designed for Artificial Intelligence (AI) management systems, provided most comprehensive facilitation for LLM opportunities, whereas COBIT 2019 aligned most closely with the European Union AI Act. Nonetheless, our findings suggested that all evaluated frameworks would benefit from enhancements to more effectively and more comprehensively address the multifaceted risks associated with LLMs, indicating a critical and time-sensitive need for their continuous evolution. We propose integrating human-expert-in-the-loop validation processes as crucial for enhancing cybersecurity frameworks to support secure and compliant LLM integration, and discuss implications for the continuous evolution of cybersecurity GRC frameworks to support the secure integration of LLMs.

Governance, risk and compliance frameworks applicability in the organizations

Governance, Risk and Compliance (GRC) is an emerging study embedding the importance of each element of the GRC and its strength in managing the organization and its sustainability. It becomes almost unavoidable to not have such a system in place. However, having it, can be costly and not efficient if the organizational system is not mature enough or financially stable enough to sustain the implementation and continuity of the GRC. The research investigates GRC systems in depth by (a) reviewing the literature on existing GRC frameworks, and (b) presenting a field study on GRC framework application in industries and organizations. The aim of this exploratory study is to understand the aspects and the nature of the GRC system following an enterprise systems approach. The result of this study is a framework of GRC characteristics that need to be taken into consideration when these systems are put in place. Structurally, this research was done based on the analysis, it is highlighted · Overview of the GRC framework; · Industry was GRC framework is most applicable; · Organization size, they mostly fit in. The result of this study is a guideline of GRC characteristics that need to be taken into consideration when these systems are put in place. By it, meaning, when deciding which governance system to put in place it is good to evaluate how it can help you in business continuity of the organization, and ability to mature and be cost effective for the organization. Further discussion about the issues, the concerns, and the diverse views on GRC would assist in developing an agenda for the future research on the GRC field.

Understanding the Recognition of Occupational Safety and Health: A Critique of Corporate Culture

In the era of globalization, in the face of industrial competition, companies are attempting to instill a culture of Occupational Safety and Health (OSH) as a symbol and image of their existence. However, it is unfortunate that the presence of OSH in the company does not always serve as a barometer of the company's normative compliance with OSH. In practice, the rules governing worker behavior still show varying degrees of permissiveness.
 The practice of OSH must be accompanied by moral values in order to achieve the desired condition. Therefore, there are two behavioral approaches in OSH communication practices in companies: (1) do the things right, which means following the rules. This does not necessarily resolve OSH problems, as ‘rules’ at the minimum only regulate employee behavior and (2) do the right things, which is moral in nature, which allows workers to act and behave according to their nature because what is outlined in the rules does not always reflect free will, so in the end each worker must find a way to do what’s best.
 The critical-interpretive approach with phenomenological method in research focuses on the meaning and awareness of OSH caused by communication distortion in the company on workers' behavior towards social reality as something complex, continuously evolving and full of meaning. In the development of Axel Honneth's conceptual dimensions of recognition theory (love, rights and solidarity) has a central role and solution in the distortion of corporate communication, especially in the implementation of OSH programs that emphasize the importance of recognizing worker relationships and developing self-confidence, self-respect and self-esteem, in the context of Good Corporate Governance (GCG) and Governance Risk and Compliance (GRC), recognition theory provides implications for the importance of recognizing workers’ contributions to the goals achieved in the company, thereby increasing workers' dignity and individual values in the company.
 Without social recognition, OSH will not be able to serve as operational barometer of a start-up company. It will only serve as a framing to protect the company, “as if” it already fulfills its legal obligations towards OSH.

IoT-based generalized multi-granulation sequential three-way decisions

In the context of the Internet of Things (IoT), decision models and GRC (Governance, Risk, and Compliance) can be used for data processing and decision-making processes. The IoT involves a large number of sensors and devices, some of which enable “device-free” functionality, meaning that specific devices or sensors are not required to obtain the necessary information. This technology utilizes the signals present in the environment to determine the location of individuals without them carrying any specific devices. By incorporating “device-free” sensor data into decision models, we can process IoT data more efficiently and achieve accurate location positioning. The prevailing hierarchical sequential three-way decision models (STDM) follow a common pattern of constructing a hierarchical tree of conditional attributes to acquire knowledge. However, these models fail to meet the diverse needs of users when it comes to rule mining complex hierarchical data with multiple levels and views in real-world applications. Additionally, the pursuit of simplified rules remains a significant topic of interest. To address these challenges, we propose a novel approach that integrates multi-granularity, device-free localization, and STDM. By leveraging IoT and device-free localization, we collect data from various devices and sensors to accurately determine the positions of individuals. Using this data, we construct a generalized hierarchical decision table by creating a concept hierarchical tree with decision attributes. This framework offers a comprehensive solution for overcoming the challenges of device-free localization and IoT. Subsequently, we establish a granular structure by partitioning the complete set of attributes. In this paper, our proposed approach improves the efficiency and accuracy of data processing in machine learning models and enables users to better process and understand complex datasets. Finally, the performance is experimentally validated for the models in this paper. Such models greatly enrich the theoretical framework of three-way decision making. Overall, the abstract provides a concise and succinct overview, outlining the motivation behind the research and presenting the contributions made.

Evaluation of Internal Audit Role as a Governance, Risk and Compliance Partner, Trusted Advisor and Value Driver to Implement Strategy

This study aims to evaluate the alignment of the scope of internal audit activities with the strategy of Indonesia’s Social Health Insurance Provider (BPJS Kesehatan). The perception of the added value provided by the internal audit is often described as hazy and enigmatic. Therefore, Eulerich and Lenz (2020) defined the internal audit role into three scopes: Governance, risk and compliance (GRC) partner, trusted advisor and value driver. This qualitative research uses a case study method by collecting internal organisational documents, questionnaire surveys and interviews. The results show that BPJS Kesehatan’s internal audit can act as both a GRC partner and a trusted advisor. However, its internal audit activity is not prepared and aligned with the implementation of the organisation’s strategy. The internal audit function is nevertheless moving towards aspects in which it may add more value to the success of the organisation’s strategy.

Governance, Risk And Compliance (GRC) In Digital Transformation: Investor Views

Governance, Risk And Compliance (GRC) In Digital Transformation: Investor Views

Discussing Hierarchic Viewpoints Theoretical Considerations and a Practical Example

Enterprise Governance, Risk and Compliance (GRC) systems are key to managing risks threatening modern enterprises from many different angles. Key constituent to GRC systems is the definition of Controls that are implemented on the different layers of an Enterprise Architecture (EA). Controls become part of a “Concern” of the EA, which allows to use an EA viewpoint to cover Control compliance assessments. In this article we explore this relationship further, derive a metamodel linking Control and EA, and elicit how this linkage give rise to a hierarchic understanding of the viewpoint concept for EAs. We complement these considerations with an expository instantiation in a cockpit for Control compliance applied in an international enterprise in the insurance industry.

Compliance-innovation: A quality-based route to sustainability

The areas of Governance, Risk and Compliance (GRC) and innovation are under-explored in research generally, and specifically in sustainability-oriented research. In this paper we propose a practice-based concept of Compliance-Innovation and set out its significance for sustainability. Development of the concept is based on a literature review and exploratory qualitative research with eighteen practitioners. The concept acknowledges the central role of knowledge integration across business domains as the basis of modern competitive advantage. The absence of such integration in the GRC and innovation domains, revealed in practice, opens opportunities. The governing force for such integration is presented here as sustainability, when applied as a strategic orientation for business. We outline how the integration of GRC and innovation domains drive commercial exploitation for environmental sustainability and business sustainability. Building on the concept of Absorptive Capacity we identify both external and internal sources of knowledge as determinants of organization's selected sustainability goals, which are relevant across the phases of organizations' innovation activities throughout its Innovation Value Chain. We argue that a quality-based orientation is necessary to derive value from the networks employed in applying the concept in practice.

Towards data-driven decision support for organizational IT security audits

Abstract As the IT landscape of organizations increasingly needs to comply with various laws and regulations, organizations manage a plethora of security-related data and have to verify the adequacy and effectiveness of their security controls through internal and external audits. Existing Governance, Risk and Compliance (GRC) approaches provide little support for auditors or are tailored to the needs of auditors and do not fully support required management activities of the auditee. To address this gap and move towards a holistic solution, a data-driven approach is proposed. Following the design science research paradigm, a data-driven approach for audit data management and analytics that addresses organizational needs as well as requirements for audit data analytics was developed. We contribute workflow support and associated data models to support auditing and security decision making processes. The evaluation shows the viability of the proposed IT artifact and its potential to reduce costs and complexity of security management processes and IT security audits. By developing a model and associated decision support workflows for the entire IT security audit lifecycle, we present a solution for both the auditee and the auditor. This is useful to developers of GRC tools, vendors, auditors and organizational decision makers.

On the role of ontology-based RegTech for managing risk and compliance reporting in the age of regulation

This paper addresses important questions such as: what challenges are presented by new regulation to banks’ infrastructure, risk management and profitability, and how can these challenges be best addressed? It also examines the potential impact FinTech has on the riskiness of banks and proposes RegTech as the solution. Following a brief overview of the impact and costs of regulation since the financial crisis, the paper introduces RegTech in the context of challenges facing financial institutions and the limitations of governance, risk and compliance (GRC) systems. This paper’s main contribution is in its delineation of a regulatory compliance and risk ontology, the technologies that underpin it and the related objective-risk-control (ORC) model. The paper argues that these provide a platform on which RegTech can perform effective risk management and compliance reporting in a global post-crisis regulatory environment.

Data governance: going beyond compliance

Information security, in its broadest sense, is often an afterthought in an organisation's IT planning and spending and rarely gets the high-level attention it needs and deserves. The problem is worse when you look at the specific aspects of data security that fall under the umbrella of governance risk and compliance (GRC). In this interview, Danielle Jackson, chief information security officer at SecureAuth, thinks that's changing. But is the change heading in the right direction or is the responsibility simply being shifted? Information security is often an afterthought in an organisation's IT planning and spending and rarely gets the high-level attention it needs and deserves. The problem is worse when you look at the specific aspects of data security that fall under the umbrella of governance risk and compliance (GRC). In this interview, Danielle Jackson of SecureAuth explains how she thinks that situation is changing. But is the change heading in the right direction or is the responsibility simply being shifted?

Understanding governance, risk and compliance information systems (GRC IS): The experts view

Although Governance, Risk and Compliance (GRC) is an emerging field of study within the information systems (IS) academic community, the concept behind the acronym has to still be demystified and further investigated. The study investigates GRC systems in depth by (a) reviewing the literature on existing GRC studies, and (b) presenting a field study on views about GRC application by professional experts. The aim of this exploratory study is to understand the aspects and the nature of the GRC system following an enterprise systems approach. The result of this study is a framework of particular GRC characteristics that need to be taken into consideration when these systems are put in place. This framework includes specific areas such as: goals and objectives, purpose of the system, key stakeholders, methodology and requirements prior to implementation, critical success factors and problems/barriers. Further discussion about the issues, the concerns and the diverse views on GRC would assist in developing an agenda for the future research on the GRC field.

The financial industry maturity model for anti-money laundering

The financial industry maturity model (FIMM) for anti-money laundering (AML) described in this paper is a governance risk and compliance (GRC) framework that describes the essential business process components that are necessary for effective implementation of AML and combating the financing of terrorism (CFT) obligations. It has been devised based on two key fundamentals; the theory of maturity models which represent growth in capability as a progression through a series of levels and the extant international legislation, regulation and best-practice information that pertains to anti-money laundering. The key objective of the FIMM (AML) model is to ensure consistent execution of AML processes by facilitating the embedding of an AML risk aware and compliance culture in financial services organisations. (Note: for the sake of brevity we will only refer to AML in the paper to cover both AML and CFT).

An action framework for compliance and governance

Purpose– The purpose of this paper is to propose a framework for clinical governance, in particular, the compliance of data privacy in a healthcare organisation.Design/methodology/approach– The approach of the research was to highlight problem areas in compliance and governance risk management (governance, risk and compliance (GRC)) in general, and then identify knowledge in other domains that could be combined and applied to improve GRC management, and ultimately improve governance outcomes.Findings– There is a gap in the literature is respect of systems and frameworks to assist organisations in managing the complex minutiae associated with compliance. This paper addresses this gap by proposing a “compliance action framework” which builds on work existing in other domains in relation to education, process control and governance.Research limitations/implications– The present research provides a starting point for an implementation of the framework within a number of organisations, and opens questions for further research in the field.Originality/value– The GRC framework proposed in this paper contributes to the state of the art, by proposing processes for improving the governance capability and compliance outcomes within an organisation for governance of data privacy risk and data protection.

Internal Audit's role in the risk assessment process at KeyCorp

With the recent (at the time of this writing) financial crisis and the continued focus on a strong risk management culture at KeyCorp, the need to ensure that the lines of business (first line of defence), independent risk management (second line of defence) and internal audit (third line of defence) utilise a common risk framework has been paramount. This was driven by the desire for timely and accurate reporting to management and risk committees, as well as the Board of Directors. An opportunity to leverage a common governance, risk and compliance (GRC) approach across the institution arose in 2011 as KeyCorp began to leverage GRC software to implement the various risk related activities across the bank on a common platform. A variety of risk assessment tools existed that spanned business units and risk disciplines. However, KeyCorp recognised the need for risk convergence and a consistent approach to risk assessment. Over the next three years a plan was set in motion to implement a number of modules in the new platform including risk and control self assessment (RCSA), findings and remediation tracking, risk profiles, operational losses and others. From an internal audit perspective, the decision was made to re-evaluate the audit universe and risk assessments with an aim towards a common framework with the first and second lines of defence. This presented an array of opportunities and challenges. Additionally, Internal Audit recognised the need to utilise the company's new GRC software for its audit projects, workpapers, risk assessments and findings documentation to further serve these efforts and the journey towards risk convergence officially began.

Why governance, risk and compliance projects fail – and how to prevent it

Governance, Risk and Compliance (GRC) projects can bring unparalleled benefits to an organisation when implemented and used correctly. Business cases for companies implementing or upgrading their GRC tools tend to focus on reducing the costs of compliance and user administration and, of course, improving internal controls. However, even with a well-defined benefits realisation plan in hand, many companies fail to meet their objectives. Why is this the case? How can companies overcome these challenges and ensure that their GRC project will deliver the expected benefits? Business cases for companies implementing or upgrading their governance, risk and compliance (GRC) tools, tend to focus on reducing the costs of compliance and user administration. However, to realise the benefits of cost reductions, increased efficiency and improved controls, the right technology must first be selected and then embedded into the business and compliance process, and the technical aspects must be implemented to a high standard, explains Richard Hunt of Turnkey Consulting.

A maturity model for governance, risk management and compliance in hospitals

In this paper we propose a preliminary model (hereafter referred to as maturity model) to assess and monitor Governance, risk and compliance (GRC) and GRC maturity in Dutch hospitals. Relevant health care literature and a comprehensive comparison of existing maturity models served as input for the developed maturity model. The maturity model was tested and evaluated by interviewing senior hospital managers, representing 12.4% of the total Dutch hospital bed capacity. The need and relevance of knowledge about GRC was repeatedly emphasized by the interviewees. The model consists of 14 different dimensions based on the headlines of the practice in Dutch hospitals and five levels of maturity. The primary value of the model lies in the compact presentation and its practical approach which can guide hospitals to improve their GRC maturity.

The Development of a Data-Centred Conceptual Reference Model for Strategic GRC-Management

Until now there are only few ideas for an integrated governance, risk and compliance (GRC) management available with these referring to the management process of GRC only. In literature, mainly specific questions at a detailed level, like the automation of different controls, are discussed in the GRC context. To be in the position to entirely realise benefit potentials (e.g. improvement of processes), it is necessary to have an integrated GRC-Management focusing on the strategic business objectives. Starting from the requirements, this article deals with general guidelines for strategic GRC-Management showing which aspects have to be considered in terms of an integral approach. On this basis, a data-centred reference model explicates the structural connections of GRC-related data, and lays the basis for the implementation in practice.