28 Okt GRC and Transformations

GRC is now of fundamental importance for the self-image and actions of organizations. This is due, on the one hand, to a growing expectation of organizations from outside and, on the other hand, to the orientation of an organization (mission, vision, code of conduct) and the attitude of the individuals working in an organization based on this orientation. The existing interaction in the internal/external relationship of GRC can be typified in causal terms as a “chicken-and-egg relationship”.

The situation is similar if one compares the GRC complex of topics with the transformation complex of actions and states. What is the trigger here and what represents the consequence? A clear assignment of what is at which point in the causal chain is not possible from the outset. On the one hand, the requirements induced on an organization by GRC can lead to changes that are implemented as part of a cross-organizational transformation; in this case, GRC is the impetus for a transformation. Legal requirements (compliance) in particular require the adaptation or creation of an organization’s processes, behaviors, structures and techniques, which can only be managed as part of a comprehensive transformation. For example, the consistent implementation of the General Data Protection Regulation in many organizations resulted in a comprehensive adaptation in the areas mentioned, including the establishment of new positions and roles to ensure compliance with the introduced regulation.

However, the opposite mechanism is also conceivable, namely that the GRC area must undergo a change (by way of a transformation) as a result of transformations in the organization. For example, the use of new technologies and the resulting processes, as well as implicit adjustments to the organizational structure, may well lead to a situation in which fundamental guiding principles (vision, mission of an organization) that have been part of GRC and the self-image of an organization up to now have to be adjusted. Of course, such inductions will not change the validity of compliance requirements by law; but the validity of previous governance is likely to be questioned if in now autonomous, self-responsible teams the strictly hierarchical responsibilities defined so far require a changed regulatory framework. Here, a transformation within the organization induces a further transformation of GRC. Thus, GRC can be both the cause of a transformation and itself the object of a transformation, which in turn was triggered by an initial transformation.

In the ongoing process of change and adaptation to which every organization is constantly subject as a result of both external and internal factors, it is true that not all developments can be influenced in the same way. Through targeted transformation engineering, however, it is very possible to effectively promote the desired changes in each case and thus ensure that the intended stage of development is reached more quickly.