Governance, Risk, Compliance (GRC)

So I put together what I call The Accountability Framework. A reasonable question to ask is if there are any other similar accountability frameworks or similar related frameworks.  All this seems to fit into what is referred to as: Governance, Risk, Compliance (GRC).

There seem to be several different organizations in this space and closely related spaces:

COSO

COSO  (Committee of Sponsoring Organizations) is dedicated to providing thought leadership through the development of comprehensive frameworks and guidance on enterprise risk management, internal control, and fraud deterrence designed to improve organizational performance and governance and to reduce the extent of fraud in organizations. COSO is a private-sector initiative jointly sponsored and funded by the following organizations:

  • American Accounting Association (AAA)
  • American Institute of CPAs (AICPA)
  • Financial Executives International (FEI)
  • The Institute of Management Accountants (IMA)
  • The Institute of Internal Auditors (IIA)

COSO grew out of efforts to improve financial reporting and internal controls. Its ERM framework links risk management to strategy and performance. The COSO Cube which relates to internal controls management and the COSO Enterprise Risk Management (ERM) framework are the best-known outputs of COSO.

COSO Internal Controls Cube: (integrated framework)


COSO Enterprise Risk Management Framework (ERM):


The Accountability Framework is more like metadata and semantics oriented.  COSO seems to provide the “operational mechanics” of governance, risk, and control, with a significant focus on internal audit.  The Accountability Framework provides the semantic and logical explanation for why governance, accounting, reporting, and assurance exist and how they combine to produce trust. I would characterize COSO as a control architecture and the Accountability Framework as an accountability ontology/theory. I think they fit together quite well.  COSO also seems to focus on the enterprise perspective of accountability, one "silo" of accountability. The Accountability Framework tries to not create silos, but to pull all the moving pieces of accountability together.

OCEG

OCEG (formerly Open Compliance and Ethics Group) created the term "GRC" and defines it as the integrated capability that enables an organization to reliably achieve objectives, address uncertainty, and act with integrity.

OCEG's emphasis is broader than risk management alone. The most prominent output of OCEG is their GRC Capability Model (Red Book) which provides useful models, methods, and tools for GRC professionals to establish and operate GRC capabilities. (OCEG provides a free download of the Red Book).


Many organizations use COSO as the risk/control framework inside a broader OCEG-style GRC program. OCEG itself positions its model as something that can integrate with frameworks such as COSO.

ISO 31000 Family

The ISO 31000 Family was designed for risk management. ISO 31000 provides principles, a framework, and a process for managing risk across any organization. It emphasizes integrating risk management into governance, strategy, planning, reporting, policies, values, and culture.

IIA Three Lines Model

The Institute of Internal Auditors' Three Lines Model defines the major accountability roles within an organization: First Line: Management owns risk; Second Line: Risk/compliance functions monitor and challenge; Third Line: Internal audit provides independent assurance. (Download PDF of Three Lines Model)

The Three Lines Model takes a principles based approach to clarify how assurance and advisory activities across the organization collectively support effective governance, risk management, compliance, and control processes.

COBIT

COBIT is ISACA's framework for enterprise governance of information and technology (EGIT). It focuses on governing and managing enterprise information and technology to create business value while managing risk.

NIST Risk Management Framework

The NIST RMF integrates security, privacy, and supply-chain risk management into the system lifecycle through a structured process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor)

ISO 37301

ISO 37301 is an international standard for compliance management systems (CMS). It provides guidelines for establishing, developing, implementing, evaluating, maintaining, and improving an effective and responsive compliance management system within organizations. Stated primary benefits are:
  • Promotes ethical business practices and reduces the risk of non-compliance
  • Enhances trust among stakeholders
  • Improves management processes and operational efficiency
  • Supports corporate governance and responsibility

Here is a Whitepaper on ISO 37301:2021. This graphic comes from that whitepaper:

The Accountability Framework: A Meta-framework?

It seems to me that The Accountability Framework isn't competing with COSO, OCEG, ISO 31000, COBIT, or the Three Lines Model. It is trying to provide the conceptual "operating system" that explains how all of them fit together into a coherent model of trust, stewardship, reporting, assurance, and accountability. That is the hallmark of a meta-framework.

Perhaps the OMG MOF can help figure out the precise relation. (Meta Object Facility).

I will point out this.  First off, those other frameworks are not formally defined using something like the Semantics of Business Vocabulary and Business Rules (SBVR). SBVR is intended to formalize complex compliance rules.  It seems to me that (a) all these different frameworks relate to each other in some ways and (b) all the different frameworks related to The Accountability Framework; it seems to be an overarching framework.  Basically, why would all this stuff NOT fit together with clarity? Seems like that would be beneficial.

Bottom Line

Maybe The Accountability Framework is not the "root" here.  Maybe "trust" is the root.  The Accountability Framework seems to be less about a governance, risk, and  compliance framework and more of a "general theory of trust for socio-economic systems"; with governance, risk, compliance, accountability, accounting, reporting, and assurance emerging as specialized trust-producing mechanisms underneath it. Maybe "accountability" is a "trust producing mechanism".
  • Trust
    • Accountability
      • Authority
      • Responsibility
      • Stewardship
      • Answerability
    • Governance
      • Objectives
      • Direction
      • Authority
      • Responsibility
      • Obligation
      • Oversight
      • Decision Rights
      • Rules
      • Norms
      • Policy
    • Risk
      • Uncertainty
      • Threat
      • Opportunity
    • Control
      • Prevention
      • Detection
      • Correction
    • Compliance
      • Obligation
      • Requirement
      • Conformance
    • Assurance
      • Verification
      • Validating
      • Evidence
      • Audit
    • Accounting
      • Business Events
      • Language
      • Account
      • Reporting Framework
      • Consistency
      • Controls
      • Traceability
      • Trackability
      • Provenance
      • Measurement
    • Reporting
      • Claims
      • Line Item
      • Subtotal
      • Representation
      • Disclosure
      • Transparency
      • Communication
      • Analysis
      • Comparability
    • Knowledge
      • Information
      • Meaning
      • Explainability
If you have "direct observation", meaning I personally watch you manage my assets; then that direct observation is enough.  But when enterprises get large; direct observation will not work; it does not scale. When you need "indirect observation", you  need accountability to enable the creation of trust. Now we have "artificial intelligence" which makes all this even more interesting. "Machine observation".

Additional Information:

Comments

Post a Comment

Popular posts from this blog

Internationalized Resource Identifier (IRI)

Image
An Internationalized Resource Identifier (IRI) is a standard proposed by the IETF ( RFC 3987 ).  An IRI is a unique sequence of characters that identifies a resource.   IRIs are a generalization of URIs ( RFC3986 ) that permits a wider range of Unicode characters. A  Uniform Resource Identifier (URI) is a unique sequence of characters that identifies an abstract or physical resource.  The difference between an IRI and a URI is that IRIs use the more modern  Universal Character Set (a.k.a. UNICODE)  and URIs use the older ASCII character set. The newer IRI format is compatible with the older URI format. The most  current version of RDF  uses IRIs to identify resources. Don't confuse IRIs with URLs and URNs.  A URL is a web address. A URN is a Uniform Resource Name. This Venn diagram shows the relationship between these different tools: Why are IRIs and URIs important?  If you are thinking in terms of a single database, a silo ...
Read more

Example Financial Statement Holon

Image
As I have mentioned in other posts on my blog, a financial statement is a formal semantic structure , in fact a financial statement is a special type of formal semantic structure referred to as a holon . As I mentioned in my blog posts, Kurt Cagle and Chloe Shannon are providing a lot of very good information about holons on their substack. ( Here is Kurt Cagle's and Chloe Shannon's answers to my questions. Here is an example Kurt Cagle created of a financial statement as a DataBook.) I have provided a bunch of good examples of financial reporting frameworks and reports   In this blog post I want to focus on one specific financial statement and see if I can explain that a financial statement is a "container" of  blocks of information and the "information blocks" that the financial statement contains. Cagle and Shannon point out that a holon is made up of four distinct knowledge graphs that maximize coherence and operationalize the holon which are: The Sc...
Read more

Inhabiting Babel, A Manifesto for Responsible Meaning Engineering

Image
Inhabiting Babel, A Manifesto for Responsible Meaning Engineering is a book written by Nicolas Figay . This book is very practical and easy for a motivated business professional to read. For me, this book has both tempered my expectations as to what is possible and also reassured me of the real possibilities that exist if you do the required work. Accountants and auditors tend to be on the conservative side of the spectrum.  Me included. I am  actually rather conservative in terms of what technology might bring to the table for accounting, reporting, audit, and analysis. I have learned how to "cut the cards" when dealing with sales people and software vendors. What this book does is bring the wisdom from the experiences of an expert in system interoperability, enterprise architectures, and complex systems to helps motivated business professionals and technical professionals that truly want to understand artificial intelligence, cutting through the rhetoric and hype. This boo...
Read more