Let's talk governance, risk and compliance – kerrching.

• Tweet

• Tweet

The last days have seen fierce debate among some of my colleagues around the area of governance, risk and compliance or GRC in SAP-speak. The discussion came about following a long piece James Governor wrote (SAP is one of Redmonk’s clients) which basically parroted what he was told by Amit Chatterjee and others and then spun it as a ‘new’ thing. James piece was followed by a light hearted dig by Vinnie Mirchandani who wonders whether SAP is going into the insurance business. It is a clever way of beating up vendors on price/value but as you might imagine, the vendor community is not having truck with that argument.

I find the title of James post worrying: SAP Grocks Governance Risk and Compliance: the new ERP. Companies have spent billions implementing ERP systems over the last 15 years and the subtext I hear is: ‘more of the same.’ Somehow I don’t think so and sincerely hope this doesn’t become the rallying cry.

I’ve talked with a range of interested parties, listened to Thomas Otter and Craig Cmehil’s podcast and read around the topic. The podcast is included below – it is worth the listening. But I’m still concerned.

Compliance
Thomas talks about systemetizing the separation of duties that any competent auditor will require as an example. But does that mean it is an extra feature for which payment should be extracted? It could be a differentiator but I’d expect to see it included in the product. If requested, I might well want to investigate alternatives. The counter argument may be the potential for audit cost savings but there is precious little evidence of auditors prepared to moderate their costs. WIth SOX looking like it will be overhauled, that alone should drive down costs.

As Thomas rightly acknowledges, compliance doesn’t stop with audit and if SAP is trying to run the entire gamut then it is biting off a very big set of problems which might be worth some extra. If it is able to provide coherent solutions that are value enhancing rather than compliance backfilling.

In one post, Thomas draws attention to Hackett Group research, suggesting that best practice companies have reduced relative financial compliance cost. If they haven’t then I’d be deeply concerned so I’m not sure I get his point in this context. I do however agree that the tyranny of spreadsheets has to end. This is something I’ve shouted about for over 10 years. But then there are plenty of other providers out there offering solutions to that problem.

The broader question has to be whether this is something exercising the minds of todays’ senior finance types in the SAP community. If the agenda for the upcoming SAP FBPN group is a litmus test, the answer has to be no. Or at best, not now.

Risk
On risk, the argument goes that enterprises will have a much more transparent way of assessing portfolio risk. That’s a nice idea but SAP spoils it by talking process. In my experience, risk management means companies veer towards being risk averse rather than innovative. Nevertheless, having your arms around an entire portfolio of alternative investments makes sense and is a current topic of interest. In SAPs defense, Thomas points to portfolio balance, which again makes sense. Whether enterprises will take that approach is unclear when assessed against practical application but as an overall concept, it’s got plenty going for it.

Governance
Flavour of the month. Every day I see yet another blog or article seeking to cash in on the green and/or clean agenda. I’m highly sceptical about this as it’s a topic spawning instant pundits. I hold to Al Gore’s view that in many situations, clean policies are good for business. But governance is way more than carbon neutral footprints or planting more trees.

Governance is about culture and ethos. Co-operative Bank for example has very clear policies about where it will and will not invest. Do they need to be told what is right and wrong? The same cannot be said of some of the oil companies. BP for example has a history of entering into shady deals. That despite a clear policy on bribery and corruption.

I don’t see a way you can satisfactorily systemetize that aspect of doing business. In conversation with Amit, he posited that putting appropriate information in front of executives and talking to the issues of reputation is a good start. That’s a fair statement but one that is hard to make stick in practice. Too many companies pay lip service to governance as it is and no amount of software will change that.

On one thing I will agree. Running a well governed business is profitable because we’re moving towards a world where reputation has to mean more than mere platitudes. But whether that’s a message enterprise software vendors should be taking to the market is less clear when I can grab free calculators.

The real problems
Much of what SAP is talking about comes down to documentation and process. Which is fine in itself but as one person said: “If you’ve got a shitty system and document it, you’ve still got a shitty system.” My concerns go further:

• It is impossible to legislate against error, fraud and deliberate acts of omission. Determined individuals will always find a way of side-stepping regulation. Why else is there a UK tax amnesty in place for those hiding assets abroad?
• Most errors don’t occur because of systems failure – at least not these days. They occur because of issues outside the system. How can you guard against that? You can’t. That’s why we have audits to not only test systems but also to test how those systems are used. No amount of systemetizing will solve that problem.
• I’ve seen some of the questionnaire stuff SAP has in place and I see a risk of over controlling. It may add a degree of comfort but it stifles the business. Where for example are the systems that will help you figure out whether a process is over controlled?
• Rather than taking a fire blanket approach, isn’t it better that GRC be assessed from a quality perspective that allows companies to evolve? I’m not hearing that message.
• Amit was beaming at recent sales success but in today’s market, I’d expect his unit to be doing well. I’ll be more impressed when I see the case studies. At present, there is a miserly collection of 25, some of which have tenuous links to GRC while others are clear spin on old stories.

In a final piece of irony, Thomas points to a piece that talks about Sarbanes-Oxley as a scapegoat. It’s also a great way to spread FUD in the name of software sales.

Technorati Tags: accountability, compliance, governance, audit, risk, SAP

Tagged as: GRC