There is an old saying: The road to hell is paved with good intentions. At times I wonder whether GRC is one such road.
Thomas Otter has a well researched and thoughtful piece about how governance, risk and compliance strategy is becoming an increasingly important part of the business and technology landscape. In his piece, Thomas addresses the sustainability issue, a key component in GRC. As he says:
…investors are demanding clearer, more transparent and better information on sustainability measures. A couple of paragraphs in the annual report and some nice pictures won’t cut it.
Despite Thomas’s excellent argument, there are real problems that are much more difficult to overcome than by mandating policy or having controls in place. There are for example plenty of complaints about how IFRS is not working to produce the transparency predicted.
Thomas references fellow SAPper Jonathan D. Becher who says:
Dashboards need a certification process for all of the data they contain: goals, initiatives, financial and non-financial metrics. With certification and auditing comes trust. With trust, comes use. With increased use, more impact.
Thomas then adds:
In other words, Reporting is only useful if it impacts behaviour. Words are easy.
I don’t want auditors crawling all over sustainability, but I do want to know that the stuff in the annual report and elsewhere is relevant and material. I want to know who is serious and who is bs’ing me.
This is problematic. While I’d like to believe that both Jonathan and Thomas are correct, I fear they’re not.
There is an implicit assumption that you can modify behaviour by appealing to a person’s cognitive understanding of a situation and by demonstrating that through the notion that something is ‘right.’ That’s clearly not the case otherwise the demand for controls would be irrelevant. Put another way, try making that work with an alcoholic or drug addict. Thomas and Jonathan’s argument, while well meaning, smacks of the corporate equivalent of antabuse. What happens when the treatment stops? Old behaviours return.
Business acts out of what is expedient because money has no moral or ethical compass. It doesn’t exist. The only place that you find those qualities are in people. So for example, Thinking HR’s David Lewan likes SuccessFactors in part because its company ethos is to follow the No A**hole Rule. In a comment to a post by Jason Corsello entitiled: Why SuccessFactors is the Hottest Vendor in Enterprise Software, David says:
I can tell you the number one reason why this company is so hot is…Lars! SuccessFactors CEO and Founder, Lars Dalgaard is the contemporary representation of what leadership should be today…Lars has assembled a great cast of extremely talented and passionate people, but as he puts it…â€no A–holes allowed!â€
How long will that last if SF goes public? Google got a lot of kudos in its early stages because of its ‘do no evil’ mantra. It had an appeal with which we could identify. Can we say the same today? One of the key arguments behind reining back SOX is the perceived capital flight from the US. Where is the morality in that?
Thomas cites Perspectives in Responsible Sourcing on an article entitled: Nike’s New CSR Report. They Just Did It – Again in which author Rachelle Jackson says:
Nike has officially raised the bar on what brands and retailers can and should do to ensure their goods are made in a way that positively impacts the lives of workers, communities, and the environment.
Excuse me for sniggering but that bar was pretty low in the first place. As anyone who has followed Nike knows, its track record for implicitly sanctioning some of the world’s worst working conditions ranks among the most disgraceful industrial stories of modern times. If Nike is changing, you can be sure it is because not to do so is bad PR. It is because it is expedient. While we’re talking about retail, did anyone else see the recent expose of how Tesco instils fear into its employees such that they serve unsafe food?
My point is that all the talk in the world around GRC will come to nothing without a fundamental change in the way we perceive value. Unless we can tie what is good for business to what is good for people as a whole and not just one or other interest group, then GRC and everything that surrounds it IS hot air.
Technorati Tags: compliance, governance, GRC, risk
