Report on Governance, Risk & Compliance - ICA Diploma, Jan 2019

This report provides an overview of governance, risk, and compliance (GRC) within organizations, highlighting the importance of regulatory compliance and a strong compliance culture. It discusses the purpose of regulatory compliance, including protecting organizations, increasing profitability, and ...Read More

Assignment One
1 | P a g e

Table of Contents
Introduction.................................................................................................................................................3
4.Governance, risk and compliance.............................................................................................................3
5.Good compliance culture..........................................................................................................................6
6. Corporate Governance.............................................................................................................................7
7. The necessity of regulation......................................................................................................................9
Conclusion.................................................................................................................................................10
References.................................................................................................................................................12
2 | P a g e

Introduction
Complying with the rules and regulations of the country is the basic requirement to be followed
by all the companies. An important person to help in this regards is the compliance professional.
Over the decades, the role of compliance professional has been constantly changing. A
compliance professional plays an important role for stakeholders, by accessing the relevant
information and interpreting it for them. The compliance professional is expected to have soft
skills including inter-personal and soft skills. As a fundamental skill, managing the change is
often ignored. Compliance is related to change and therefore the compliance professional is
supposed to be adaptable the changes taken place in the procedures.
4.Governance, risk and compliance
Governance, risk and compliance(generally termed as GRC) is the most essential mechanism of
an organisation or a firm. With the help of GRC, an organisation controls, directs and manages
their actions and strategies. Generally, regulation works on various levels which can further be
subdivided. Different sectors of market and categories of consumers are provided numerous
beneficial services in association to various products. It is very critical for the success of a firm
(John, Litov and Yeung, 2009).
Purpose of regulatory compliance
In general, compliance refers to the formation of a set of rules, policies, specifications or laws.
Regulator compliance illustrates those objectives that the firm wants to attain in their efforts in
order to comply with the rules or policies formed. For an effective regulatory compliance, GRC
system plays a very crucial role (Bedard and Johnstone, 2009).
A governmental body executes a law, termed as regulation, which grants a regulatory agency to
execute the authority. For example, Health Insurance Portability and Accountability Act of 1996
3 | P a g e

(HIPAA) regulated an act in relation to the decurity of a patient’ information and acknowledged
the US. Also, Sarbanes-Oxley Act of 2002 (SOX) executed a law for registering financial
compliance and acknowledged the SEC(Securities and Exchange Commission) to authorize the
enforcement. The Public Company Accounting Oversight Board (PCAOB) was also formed in
order to look after the audit rules.
The main purpose of a regulatory compliance is to ensure the ability of a firm to adopt, change
and manage the efforts to maintain their effectiveness and the fitness for their desired purpose.
Moreover, regulatory compliance ensures the financial benefit of an organisation. It provides
such guidance that helps a business to succeed (Laeven and Levine, 2009).
Some of the purpose of regulatory compliance are-
 Protecting an organization
The potential impact of regulatory compliance can save you from accidental or malicious
manipulation of an information. A report on regulatory compliance which is brought to the
Board of Directors must contain the information about the risks related to the threats.
Regulatory compliance requires the guidelines that secure the assets that might be at risk. This is
the way by which it provides additional security for the information (Frigo and Anderson, 2009).
 Increasing profitability
Due to the rise in malicious attacks, the consumers always have a doubt whether a company is
protecting their data or not. In addition to that, more resources are invested in vendor
management by those clients who are seeking a chance to collab with third parties. With the help
of regulatory compliance, the companies market themselves in a better way. SOC1, SOC2 and
SOC3 type of reports help the client to trust their consumers and prove ongoing SOX
4 | P a g e

compliance. The business will start losing customers without these reports and eventually the
profitability of that business will also be affected (John, Litov and Yeung, 2009).
 Opposing crime and terrorism
The occasions of 11 September 2001 in the US and the subsequent 'war on fear' turned out to be
the impetus for the presentation of thorough administrative upgrades inside the US. The USA
PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Apparatuses
Required to Intercept and Obstruct Terrorism) was marked by President George W. Bramble on
26 October 2001, scarcely seven weeks after the fear based oppressor assaults in New York. A
ground-breaking response to these, the Patriot Act contains more than 900 pages of enactment
and had extensive ramifications for budgetary organizations inside the US and all through the
world (Dias, Reyes-Gonzalez, Veloso and Casman, 2010).
This Act isn't just gigantically critical to US monetary establishments in any case, therefore of
the extraterritorial forces guaranteed by the US, it is likewise essential both for non-US
establishments and people who have associations with US nationals or organizations.
The occasions of 11 September 2001 likewise prompted the improvement of a scope of global
best-practice standards structured by the United Nations and the Financial Action Task Force
(FATF), went for keeping the financing of psychological warfare. These standards have now
been cherished in residential enactment in numerous Countries (Hale, Hale and Held, 2011).
In addition to achieve desired goals within a regulated firm, activities related to addressing
behaviours and understanding them can help a lot instead of just focusing on procedures and
rules. One should understand the conduction of a business as well as consumer handling. For
example, if a business provides sufficient facilities to their consumers but is not able to build an
effective interaction among its customers, it can't succeed. One more good example of the above
fact regarding consumer conduct is complaint handling. The way a company treats and manages
the complaints effects the growth of the company regarding the fair treatment given to its
customers (Munshani, 2009).
5 | P a g e

Market confidence plays the same role in achieving the required objectives. Market stability is
also important according to FCA.
5.Good compliance culture
A compliance culture contains high standards in relation to compliance and ethics. The
compliance culture is set by the top management and board of directors. It should be
communicated to employees and it should be consisting of the expectations of senior
management that is being communicated to all employees. All the employees should try to
follow the rules and regulations set by the compliance culture. Compliance always start from the
top management and good corporate culture is the most effectual when honesty and integrity are
incorporated in it (Parker and Nielsen, 2009). There are several fundamentals of compliance
which are listed as below:
Setting policies and procedures in order to comply with the rules- It is with the help of
establishing effective internal policies and procedures within an organization, with the help of
which, a good compliance culture can be established. This is highly integrated with ascertaining
an ethical functioning of an organization. The reason being, if an organization has strong internal
policies and procedures, the employees can successfully comply to it and conduct their duties in
accordance to these policies. This results in ethical functioning of the organization (Chen,
Ramamurthy and Wen, 2012).
Maintaining the internal controls- Effective compliance to these policies and procedures, results
in having effective and strong internal control on the functioning of the organization. As a result,
any kind of unethical operation can be avoided, resulting in strong compliance culture.
Having a framework which contains clarity for accounting and responsibility for the top
management also helps in ensuring that the compliance culture gets internalized within the
organization in a top to down manner (Parker and Gilad, 2011).
For tests and audits- While conducting, auditing and tests, establishment of compliance culture
helps in ascertaining that internal auditing and tests and conducted in a bias free manner. Any
kind of unlawful functioning within the organization would get identified in a successful manner
with its help.
6 | P a g e

For providing training- In the process of providing training, having policies and procedures
established in alignment to effective compliance culture would also turn out to be beneficial. The
reason being, in the process of training and induction, these policies are mentioned. Hence,
further, while working with the company it would clear to the employees that they are needed to
abide to these procedures. Hence, it would help in maintenance of good compliance culture.
For maintaining record keeping standards- In the process of maintaining records, it would be
effective. The reason being, under good compliance culture, it would be essential to maintain
clarity and transparency in record keeping standard. Hence, it would turn out to be beneficial in
ethical functioning in the process (Chen, Ramamurthy and Wen, 2012). .
All the above elements are required for setting a good corporate governance culture by the top
management.
For linking good corporate culture with ethics and integrity an illustration needs to be taken from
FCA regulatory body which is mentioned hereafter:
One of the most respectable names in Banks in UK was Barings Bank in 1995 but it had to shut
down when an employee of the bank named Nick Leeson cheated the company and accrued
losses. The major reason behind it was considered as lack of internal control system being
functional. Also, it raised questions on the ethical requirements set by the senior management
and more importantly on oversight of trading activities (Parker and Nielsen, 2009).
Another example can be taken of Enron which is again one of the leading companies in US; it
shut down due to false accounting done the accountants of the company. Weak internal controls
and corporate governance functioning poorly was considered as the main reason behind its
collapse.
6. Corporate Governance
Global consists of a risk team in which Thomas works. Global has many corporate governance
principle which needs to be followed. Corporate Governance basically refers to the set of
principles, processes, and systems on the basis of which a company is governed. It focuses on
regulatory requirements and provides a historic view. It covers issues like the roles and
7 | P a g e

responsibilities of Chairman, board committee, control assurance, risk management, and
compliance etc. It includes committee like audit committee composed of independent non-
executive directors so that good corporate governance is ensured (Brefi, 2015).
The key aspects of the code of conduct to be followed by Global as per FCA are as follows:
a.) Leadership- For long-term success a company should be led by an effective board. It is
essential for the board leading the organization, to have clarity about the elements of
corporate governance that are integral for the company. It is only with the help of clarity
on the part of the board, regarding its corporate governance, with the help of which, it
employees can gain information and clarity about it and adhere to it (Singh, 2009).
b.) Effectiveness- The board should discharge the duties effectively. In this regards, for
ascertaining effectiveness of its functioning, the organization is needed establish to main
board committees. One board committee is needed to be comprised of non-executive
directors. Another board committee would be the nomination committee. The
collaboration of these two boards would help in ascertaining effective functioning of the
organization.
c.) Accountability- Accountability of all the levels in the hierarchy of the company should
be clear.
d.) Remuneration- Executive director’s remuneration to be defined in order to promote the
long-term success of the company.
e.) Relations with stakeholders- Responsibility towards stakeholders should be fulfilled.
(Brefi, 2015)
The illustrations regarding these following illustrations are there:
In the US, there was a firm named as Lehman Bros which was established in 1850 and it has
one of the most important pillar as investment community which is allowed to fail. But, no
rescue package built in by US central government. Failure as an investment bank, it was very
shocking, and did not affect directly affect to the common man and was not expected to
reduce the market confidence. In both cases i.e. Lehman Bros and Fannie Mae, the mortgage
guarantors collapsed and the Government guaranteed their businesses.
8 | P a g e

The concept of harmonizing the nonfinancial measures with financial reporting is known as social
responsibility accounting. It is also known as corporate social responsibility accounting. Social
responsibility accounting is covered under sustainability accounting where economic vitality of the
company and responsibility regarding the environment is also covered. SRA covers social
responsibility towards the community, customers, and employees and also towards the natural
environment. It covers the following information:
 Employee’s health and accidents related to job
 Hazardous waste generated
 Scarce resources utilised
 Ethical initiatives like labour practices, human rights etc
 The linkage between sustainability and executive pay (Bizfluent, 2017)
7. The necessity of regulation
As discussed earlier, a regulation is a set of rules or protocols applied to a company or a firm in
order to help it in achieving desired goals. As it can be seen, limitations are very important in
order to succeed. One has to work under the given set of protocols so that the limit must not be
crossed as well as it protects the firm from various different types of problems including
financial scandals, data breaching, etc. As an example of financial scandals, FCA fined £105
million to the Rabobank for misconduct which was related to LIBOR (Holm and Laursen, 2009).
Despite of the fact that there are some regulatory failures, it doesn't mean that a firm doesn't need
regulation. Regulation functions very clearly regarding its role in helping a firm to achieve
9 | P a g e

relevant objective. The main threat to a company is the risk of data breaching. The protection of
data is very important and so is regulation. If regulation is removed and market participants are
left to operate freely, it will be more difficult for a firm to achieve its objectives. The outcome
will be more problematic than it currently is (Racz, Weippl and Seufert, 2010).
For example, if a company lacks regulation and operates freely in the market, it will not be sure
about the outcomes of the working of its IT systems or other fields. Eventually there is a lack in
confidence which further leads to the demotion of the value of company in the market. This lack
in confidence can be improved by working with appropriate and experienced technology experts
who can implement, design, and maintain the systems which are formatted to maintain regulation
within business operations.
In the present time, nearly each and every firm follows some regulations whether it is Health
Insurance Portability and Accountability Act (HIPAA),state,local, federal or international laws
and rules. If a firm fails to maintain the above regulations, it becomes a serious issue that has the
potential to weaken its business operations (Frigo and Anderson, 2009).
No one wants the punishment of losing reputation, huge financial fines, jail issues, etc. That is
the reason why a business need to start investing in regulation. The necessity of regulation
affects in every aspect, a business may operate. Moreover, better working environment is also
established by regulatory compliance. When business is conducting in a proper manner, it is easy
to deliver the client an appropriate required standard. Thus, regulation is very important for a
firm to stand in this struggling world of competition.
Conclusion
To conclude, it can be said that good corporate governance needs to be followed by the
companies and the governance, risk and compliance requirements should be followed by each
and every member of the organisation. Also, proper checks should be installed towards risk that
the risk is under control. The probability and occurrence of risk should be checked timely.
Measures should be taken that the risk is under control and internal control should be very strong
to monitor it. The internal control should be able to monitor it timely and measures should be
taken to control it. Hence, the corporate governance rules laid down by FCA should be followed
10 | P a g e

by the banks and other financial sectors in order to have transparency and control over the
business.
11 | P a g e

References
Bedard, J. C., and Johnstone, K. M. (2009). Earnings manipulation risk, corporate governance
risk, and auditors' planning and pricing decisions. The Accounting Review, 79(2), 277-304.
Bizfluent, 2017. Bizfluent. [Online]
Available at: https://bizfluent.com/info-7904492-accounting for societal responsibility.html
Brefi, g., 2015. Brefi group. [Online]
Available at: https://brefigroup/code-for-joint-administration.html
Chen, Y., Ramamurthy, K., & Wen, K. W. (2012). Organizations' information security policy
compliance: Stick or carrot approach?. Journal of Management Information Systems, 29(3), 157-
188.
Dias, M. B., Reyes-Gonzalez, L., Veloso, F. M., & Casman, E. A. (2010). Effects of the USA
PATRIOT Act and the 2002 Bioterrorism Preparedness Act on select agent research in the
United States. Proceedings of the National Academy of Sciences, 200915002.
Frigo, M. L., and Anderson, R. J. (2009). A strategic framework for governance, risk, and
compliance. Strategic Finance, 90(8), 20.
Hale, T. N., Hale, T., & Held, D. (Eds.). (2011). Handbook of transnational governance. Polity.
Holm, C., and Laursen, P. B. (2009). Risk and Control Developments in Corporate Governance:
changing the role of the external auditor?. Corporate Governance: An International Review,
15(2), 322-333.
John, K., Litov, L., and Yeung, B. (2009). Corporate governance and risk‐taking. The journal of
finance, 63(4), 1679-1728.
Laeven, L., and Levine, R. (2009). Bank governance, regulation and risk taking. Journal of
financial economics, 93(2), 259-275.
12 | P a g e

Munshani, K. (2009). The impossibility of regulating Terrorist Finance-A critical study of the
nine special Recommendations formulated by the Financial Action Task Force on Anti-Money
Laundering. J. Islamic St. Prac. Int'l L., 5, 40.
Parker, C., & Gilad, S. (2011). Internal corporate compliance management systems: Structure,
culture and agency. Explaining compliance: Business responses to regulation, 170-197.
Parker, C., & Nielsen, V. L. (2009). Corporate compliance systems: could they make any
difference?. Administration & Society, 41(1), 3-37.
Racz, N., Weippl, E., and Seufert, A. (2010, May). A frame of reference for research of
integrated governance, risk and compliance (GRC). In IFIP International Conference on
Communications and Multimedia Security (pp. 106-117). Springer, Berlin, Heidelberg.
Singh, j. H. T., 2009. A change in organization and its morality. Administrative Science, 31(4)
(Quaterly), pp. 587-611.
Tichy, N., 2012. The act of ultimate leadership. SAGE OURNALS, 4(YEARLY), p. 12.
13 | P a g e