BPS Resolver

One of the obstacles to the effective rollout of enterprise software across a company – and GRC software is no exception – is that it is designed to appeal to so many types of users. Unfortunately though, the screen flow and design often feel less like one-size-fits-all, and more like one-size-fits-no one.

Users get frustrated at having to look through all sorts of features and information that don’t apply to the task in hand. Some people, particularly infrequent users, can feel like they are being forced to play some cruel game of Where’s Waldo? when they look at an unfamiliar and cluttered interface.

In GRC Cloud we have worked hard to minimize this issue by making each field configurable for any user role, setting it as editable, read only or hiding it completely from view. In our new Workflow concept we have gone one step further.

In Workflow, a user may work on an item in more than one step – or state – of a workflow. In each state he or she may be required to complete different information and read different information that has been provided. In fact they may be required to attach evidence in the form of an external file in one state, but need to be prevented from doing so in another.

GRC Cloud’s Workflow Builder enables you to manage not only what a user can see or change, but when the user can see or change it. This enables your users to complete their work more quickly, as they do not have to search for the relevant information and wonder whether they are doing the right work at the right point of the business process.

For administrators, by simplifying the interface not only do you have happier users (and thus more buy-in to the program), you can also train people more quickly on what they need to do and when and you get fewer questions from people once they start their work.

We believe that workflow is all about providing the right information to the right people at the right time. The easier it is for people to work in your GRC program, the more enthusiastically it is adopted and the better input you will receive
This begs some questions.

• If you could expand the reach of your governance, risk or compliance program without increasing your training budget or administrative workload, would you do so?
• Could you ask people to assess more risks or evaluate more controls if they could do the work more quickly?
• Would you invite more people to participate if you knew your process and software design was intuitive and those additional people would provide valuable insights?
• Wouldn’t this make your company a more effective GRC organization?

By the way, the new workflow capability is introduced in GRC Cloud 6 which is being launched in January.

In a recent survey, 73% of BPS Resolver Ballot operators/facilitators responded that using Ballot in workshops enables their company to make better decisions regarding business risks. Only 1% disagreed with the statement!

So why is it so effective?

At its simplest, BPS Resolver Ballot is voting software. (Think in terms of the Ask the Audience lifeline in Who Wants to be a Millionaire.) Risk managers ask a group of managers to rate the likelihood and impact of potential risks on a sliding scale using keypads.

As part of our product research, from time to time I sit in on customer risk workshops and training sessions. I once attended a risk assessment technique training session at one of the major risk management professional services firms. The program was for new consultants and was given by a long time user and advocate of Ballot at that firm. As he knew I was in the room I think he was being tongue in cheek when he told the new recruits that the risk assessment software had nothing to do with making risk assessment workshops effective. But he did have a serious point.

If you only want to gather opinions from a group, Ballot is certainly an efficient way to capture information quickly and an interactive and engaging approach for participants. But just because it is quick and fun, does not mean that you get better answers. BPS Resolver Ballot is truly effective when it is used to reach conclusions based on a collaborative, consensus-building process. If you are just using it to collect votes you are missing out on this powerful methodology.

Here is how the approach works. The first thing to understand is that the voting is anonymous. Therefore people give their views on likelihood or impact of a risk without concern they are going to be identified and directly criticized by a dominant personality or a more senior manager in the group.

So far, so good, as all views are represented in the voting. But if you just accept the majority vote and move on, you still have nothing more than an efficient system. Voting results are now used to kick-start a discussion. The facilitator uses the spread analysis (see the screen image of the voting results) to see if there are marked differences of opinion represented in the voting and, if so, starts probing the participants. As the votes were anonymous, she has to seek out a volunteer to represent one of the points of view and explain how their experience led to that view. She then seeks out someone to represent the opposing viewpoint. However, during this discussion she gives everyone in the room an opportunity to chip in and build on opinions expressed. As a result, people often hear a new take on a subject from people with different experience from their own.

OK, so how does the anonymity of the voting translate into a truly open discussion that avoids the risk of strong personalities or senior individuals dominating the discussion? Well, as all participants have seen the votes, they know that there is range of opinions in the room. A person who holds a less popular viewpoint will typically see that he or she is not the only one to do so and therefore is emboldened to share that view, knowing someone in the room will back them up. However, sometimes there is only one “outlier” who may not feel comfortable expressing that view and so the facilitator uses techniques to get other people to be “devil’s advocate” and represent those views. I won’t get into the details of these techniques here, but the end result is typically a healthy banter, that enables all participants, including the senior voices and strong personalities to hear differing points of view. This airing of diverse opinions and perspectives must take place to avoid “Groupthink”.

When the subject has been more fully discussed, the facilitator puts the question to a re-vote and typically one of two things happen. Either the re-vote doesn’t change the overall result but provides a lot more consensus, or the original minority view has persuaded the other participants to reconsider their views on the issue.

Either of these outcomes is valuable. Obviously if discussion and consideration have led the team to come to a conclusion they would have otherwise not made this is hugely valuable, preventing the company from making potentially expensive mistakes in under-controlling or over-controlling a risk. However, there is also value in achieving greater consensus. After the workshop has finished there may be mitigations to be put in place. These are more likely to be effectively resourced, prioritized and acted upon when all the people responsible feel they were part of the decision-making process that identified the actions to be done. At a minimum, participants leave the room with a representative understanding of the varying perspectives in the company, an effect which does not occur when the most senior or loudest voices in the room dictate the discussion’s tone.

So BPS Resolver Ballot risk assessment softwareimproves the efficiency of a workshop for sure, but better risk management decisions emerge when the technology is combined with training in the methodology and skills to bring ideas and opinions out of people. Together they are the cornerstone of probably the most effective way to assess business risks.

You can’t see the future, but you can understand the way different events will impact you.  Resolver*Ballot, BPS Resolver’s risk assessment workshop software, features a great tool called “relationship modeling” which, through a series of questions, helps risk managers paint a picture of the interrelationships between various risks.

Say what?

By posing a series of logical questions to a group, Resolver*Ballot creates a visual depiction of patterns of influence that show how one risk event increases the likelihood or impact of another. This picture is generated in real-time in a risk workshop, and can be done together with—or independently  from—the anonymous assessment.  The result is a map of interconnected risks with ratings of the impact on the organization.

Wow!

Here’s an example. The screen image below shows the impact that a new acquisition may have on an organization.  As a risk manager, you may or may not have visibility on M&A activity, but this visual representation helps us understand the sequence of risks that are more likely to come about if that event occurs.

Studies in psychology indicate that people are naturally good at seeing one or two levels of influence, but how many of us would look at an acquisition and immediately think of inadequate IT security (#4) and the increased probability of IP theft (#9)?

Now take the same picture and simply overlay the impact vote from a regular risk assessment workshop and you get something even cooler.

From the color coding (green is low impact, yellow is medium and red is high), you can see that according to the group’s votes, the acquisition risk (#7) is ranked as a medium impact risk. But seeing the risks in this view, it prompts us at least to reconsider #7 as a high impact risk, since it leads to an increase in probability for many other risks including, in this case, a high impact risk (#9). (F0r the same reason, risks #4 and #5 should also be considered for upgrading to high impact.

With this information in hand, a good risk manager who goes through an acquisition simply opens up their model and examines the types of risks that fall out from an acquisition. In this scenario some diligent work in the IT department to beef up the two new joined networks has the potential of stopping the flow of increasing likelihood between the risks.

I think this is pretty cool but I’d love to hear your thoughts…

One of the most commonly accepted frameworks to achieve a unified Governance Risk and Compliance approach is the GRC Capability Model defined in the OCEG (Open Compliance and Ethics Group) Red Book. The model views GRC as a single activity with a set of detailed practices and components and is the cornerstone for any corporate sustainability initiative. The BPS Resolver GRC platform provides technology to support the key elements of the OCEG model.

The OCEG framework is broken down into several practices and in the table below we have mapped the OCEG GRC elements against key features and functionality in the BPS Resolver GRC Suite.

For more information on  GRC Suite’s capabilities please contact our account team or call 1-888-891-5500 or +1 416-622-2299.

If you are tasked with implementing a GRC solution you are almost certainly acquiring software that people outside your own department have to use. As the success of your program is dependent on these people’s willing participation, selecting technology they find intuitive and easy to use is vital.

When reviewing potential software applications it is vital to view them from the perspective of all your types of users. Some buyers fall into the trap of purchasing the tool that best meets the needs of the “owners” of the GRC program, without considering what is most important to the regular – and irregular users – of the tool.

At BPS Resolver, we tend to think in terms of three types: Administrators, Heavy Users and Light Users. Although the definition of heavy and light users varies with how the software is used and the company that is using it, Each of these groups has very different usage patterns, needs and preferences.

The Administrators, who build frameworks, manage permissions, design reports and such, are often daily users who know features and functionality in detail. At the opposite end of the scale are the light users, who access the software quarterly or annually, and frankly forget a lot of what they know between these regular cycles.

As there are typically more light users than administrators, an intuitive interface and an ability to get to their tasks quickly and easily (i.e. very few clicks from the home page) is vital to assure their ongoing use of the system.  Our experience also shows that easy access to immediate reporting (pre-built or ad hoc) and the ability to click through those reports to underlying information is valuable to many types of user.

When we configure sites for customers we spend a lot of time thinking through making the site as intuitive as possible to use. Techniques include:

• Custom roles and permissions, so that a user’s view of content is limited to what they need to read and answer and not cluttered with details that other types of user require
• Custom workflows that refine the view to show just what is needed in each stage of a process, as well as define the work item’s path through the organization.
• Corporate terminology, that ensures terms currently used by the company are reflected in the software, rather than the company have to adopt the software’s terms
• Custom icons that appear on screen and in reports that reflect the corporate terminology or any company’s “house style”.

In the world of the smartphones, people see their consumer technologies rapidly becoming much easier to use, and thus their expectations of the technology they use at work are also increasing. Although an enterprise GRC application is always going to require more of a learning curve than an iPhone app, people are not afraid to click on things any more. And when they do click on something, they expect something intuitive and useful to happen, such as drilling down from a chart to a report.

We are regularly contacted by companies whose first GRC software deployment has failed due to their people not accepting the tool provided and who now want to replace their current solution. To ensure a successful software rollout, make sure the application – and professional services team – you select provides customized, intuitive experiences for all your user types.