If you look at an enterprise organization today, they rely heavily on countless applications to run their business, each of which has critical requirements associated with them in terms of governance and risk. Given the climate today of relentless cyberattacks and creative avenues that allow for financial fraud, the hardening of business applications – both via application security and controls automation – is top of mind for many organizations. And if it’s not – it should be.
Today, securing applications, and the processes and data within them, is largely a manual, disconnected effort. In most organizations, GRC and cybersecurity, in general, are managed by different people or departments, with different priorities. As a result, organizations are faced with gaps in their application security strategy resulting in increased costs in terms of not only resources, but also money lost to fraud, cyberattacks, failed audits, and inconsistent reporting.
However, close integration, alignment, and knowledge sharing between these functions are critical for the success of GRC and cybersecurity strategies.
Integrating Application Risk Management with Security
Application security – access and process controls, coupled with hardening and vulnerability management – must be a major component of an enterprise-wide GRC program. Below are some of the most important key attributes of an effective GRC program:
- GRC must unite a top-down process with a bottom-up operational process—senior management and the board specify the risk tolerance and hand it over to their executive teams to implement the appropriate strategies.
- Business application security and risk should be a core component of the GRC process—data privacy and cyber risk became more important issues as the pandemic accelerated online transactions, homeworking, and cash-free shipping.
- Integration between GRC and cybersecurity—there is a symbiotic connection between GRC and cybersecurity, and the two cannot be separated.
With these attributes in mind, here are three strategies that we often discuss with our customers, that you can use to arrive at an integrated approach to managing risk, while best preparing for regular audits:
- Work across different departments and teams
Several departments make up GRC. Stakeholders must work across different teams and departments—as interdependencies can be used to create a holistic approach. For example, information from compliance might help with risk planning and the other way around. Attacks on business applications such as ERP, supply chain, and HR systems represent a considerable business risk, including lost revenue and regulatory fines. The technology and various business teams which rely on these various applications should collaborate to define what risks are truly material to the business.
- Ensure easy access to all relevant information
Having access to relevant information is essential for successful risk management. However, in many organizations, the information required for GRC is not readily available. A concerted effort is needed across departments to ensure risk information is standardized and distributed effectively across the organization. Having information locked away in individual apps, or worse, spreadsheets, does not facilitate effective risk management.
- Minimize departmental silos
An integrated approach to application security and GRC minimizes departmental silos, which also provides the CIO/CISO, and the distributed risk managers the information they require, when it’s needed, to discover and mitigate risk and fraud. Information may be communicated faster within an integrated GRC strategy, speeding up an organization’s response to these types of threats.
To secure the valuable data within their business applications, organizations should periodically review their application controls strategy, which includes roles, how those roles are provisioned, and what employees and 3rd parties are able to do with those roles.
A successful GRC strategy puts application governance at the forefront and prioritizes the implementation of a 360-degree solution to test and prove controls while automating audit activities. Organizations should place the utmost importance on simplifying the testing of their critical applications and process controls by automating the largely manual and disconnected processes related to audits and compliance reporting. By monitoring and acting on all applications, users, activity, and risks in real-time, there will be little to no room for disconnected gaps for fraud and risk to be exploited.
