Governance, Risk Management, and Compliance (GRC)

• Governance, Risk Management, and Compliance (GRC) comprises three pillars for organizational success.

Governance Part 1

• Objectives are defined as intended outcomes.
• Control increases the likelihood of achieving objectives.
• Internal Control is a process designed to provide reasonable assurance of achieving objectives.
• Risks are events that can impact the achievement of objectives.
• Risk Management involves identifying, assessing, managing, and controlling risks.
• Governance ensures an entity effectively and efficiently directs itself toward meeting its objectives.

Major Components of Governance

• Strategic Direction determines the business model, overall objectives, risk-taking approach, and limits of organizational conduct.
• Oversight includes risk management, internal, and external assurance activities.
• Governance practices should reflect the unique culture of an organization.
• Organizational Culture sets values, objectives, and strategies.
• Roles and behaviors are defined and performance is measured to specify accountability.
• Governance ensures compliance with legal and regulatory rules.
• Governance satisfies business norms and enhances stakeholder interests.
• Reporting to stakeholders is ensured fully and truthfully.

Governance Part 2: Business Ethics

• Values are enduring beliefs and ideals that are socially enforced.
• Principles are specific boundaries for behavior and often become the basis for rules on human rights.
• Morals are personal philosophies that define right and wrong.
• Business Ethics includes organizational principles, values, and norms.
• A Moral dilemma occurs when two or more morals conflict.
• Ethical culture includes organizational principles, values, and norms adhered to by the company.
• Corporate social responsibility prioritizes actions associated with interests of various stakeholders.
• Sustainability relates specifically to the environment.
• Business ethics contributes to employee commitment, investor loyalty, customer satisfaction, and profits.

Stakeholders and Ethical Issues

• Ethical issues in business are approached using stakeholder theory.
• Normative approach identifies ethical guidelines that dictate how firms should treat stakeholders.
• A descriptive approach focuses on the firm's behavior and how decisions are made for stakeholder relationships.
• Instrumental approach describes what happens if firms behave in a particular way.
• Primary stakeholders are absolutely necessary for a firm's survival, (customers, shareholders, employees, and suppliers).
• Secondary stakeholders are not typically engaged directly in transactions with a company.
• Other stakeholders have a "stake" in some aspect of a company's products, operations, and outcomes.
• A classic agency problem involves the separation of ownership (investors) and control (managers).
• Managers act as agents for investors, aiming to increase the value of the stock.
• Corporate governance mechanisms are needed to align investor and management interests.

Foundational Values and Ethical Decision Making

• Integrity is considered an element of virtue and unimpaired condition.
• Honesty is defined as truthfulness or trustworthiness.
• Fairness is just, equitable, and impartial.
• Equality is the distribution of benefits and resources.
• Reciprocity is an interchange of giving and receiving in social relationships.
• Optimization is a trade-off between equity and efficiency.
• Ethical awareness is the ability to perceive an ethical dimension in a situation or decision.
• Ethical issue intensity involves the relevance or importance of an event or decision.
• Moral intensity involves individuals' perceptions of social pressure and the harm they believe their decisions will have on others.
• Those more familiar with ethical decision making due to education or experience are likely to spend more time examining and selecting different alternatives to an ethics issue.

Risk Management Part 3

• Risk is the possibility of an event impacting the achievement of objectives and is measured terms of impact and likelihood.
• Residual Risk remains after a risk response.
• Opportunity positively affects the achievement of objectives.

Risk Appetite and Tolerance

• Risk Appetite is the amount of risk an entity is willing to accept in pursuit of value.
• Risk Tolerance is the specific maximum risk that an organization is willing to take regarding each risk.
• Risk Management involves identifying, assessing, managing, and controlling events to provide reasonable assurance regarding achievement of objectives.

Risk Management Process

• Risk Identification is performed for the entire entity using audits, brainstorming, and SWOT analysis.
• Risk Assessment and Prioritization uses event probabilities and potential effects to prioritized the risks.
• Processes involve estimating impact, assessing likelihood, and considering means to manage.
• Risk Modeling uses qualitative (listing, ranking) and quantitative methods (probabilistic, weighted models).
• Risk Avoidance avoids the activity.
• Risk Retention accepts the risk.
• Risk Monitoring tracks identified risks, evaluates risk response, monitors residual risk, and identifies new risks.