Policy Management, Part 1: When and How to Write a Policy
Anyone can write a document and call it a policy, but that puts liability and exposure on the organization. GRC Pundit, Michael Rasmussen discusses the act of responsible authoring.
a capability that enables an organization to reliably achieve objectives while addressing uncertainty and acting with integrity . . . Policy Management in Context
Paper-Based Programs = Policy Management Critical Morgan Stanley: Case Study in Effetiv e GRC Engagement “Morgan Stanley maintained a system of internal controls meant to ensure accountability for its assets and to prevent employees from offein g, p r om i si n g o r p ayi n g a nythi n g o f v al u e to for ei g n government offic i a l s. M o r gan Stanley’s internal policies, which were updated regularly to refle c t regul a t or y d evel o pm e nt s a nd s peci fic r isk s , prohibited bribery and addressed corruption risks associated with the giving of gifts, business entertainment, travel, lodging, meals, charitable contributions and employment. Morgan Stanley frequently trained its employees on its internal policies, the FCPA and other anti-corruption laws. Between 2002 and 2008, Morgan Stanley trained various groups of Asia-based personnel on anti-corruption policies 54 times. During the same period, Morgan Stanley trained Peterson on the FCPA seven times and reminded him to comply with the FCPA at least 35 times. Morgan Stanley’s compliance personnel regularly monitored transactions, randomly audited particular employees, transactions and business units, and tested to identify illicit payments. Moreover, Morgan Stanley conducted extensive due diligence on all new business partners and imposed stringent controls on payments made to business partners.” Emphasis added to illustrate elements of effe c tiv e GRC management and engagement. Source of this statement is at: http://www.justice.gov/ opa/pr/2012/April/12-crm-534.html.
on Policy Management In a report in November 2012 (p. 57), the DOJ and SEC stated they: “have often encountered companies with compliance programs that are strong on paper but that nevertheless have significant . . . violations because management has failed to effectively implement the program even in the face of obvious signs of corruption.” POINT: Regulators are tired of paper-based compliance programs that look good on paper but fail in operations and employee engagement.
Regulatory Change Risk Change Business Change Rogue Policies Out of Date Policies Different Templates Lack of Ownership Poorly Written Lack of Defensibility What is Driving Growth in Policy Management
Centralized Policy Management Federated Policy Management Decentralized Balance Balance autonomy, best of breed with centralized reporting, collaboration, etc.
Policy Resources MetaPolicy – the “Policy on Policies” Core components of MetaPolicy include: 9 Roles, responsibilities and accountabilities 9 Scope of what is governed by MetaPolicy 9 Definitions of governance documents and resources. 9 Structure and content 9 Format & style requirements 9 Use of templates 9 Requirements for central policy repository 9 Policy governance rules for creation, approval, retirement, updating/maintenance, and exceptions 9 Assurance methodologies Other Policy Resources Core components of supporting policy resources include: 9 Style guide 9 Document templates 9 Implementation plan template 9 Executive summary template 9 Exception/exemption request template
+1.888.365.4560 Some of the content we have evaluated is OCEG content which GRC 20/20 has an established relationship to use. Please do not copy slides or graphics without permission. GRC 20/20 highly recommends you consider OCEG membership at www.OCEG.org. GRC 20/20 Newsletter LinkedIn: GRC 20/20 Blog: GRC Pundit Twitter: GRCPundit LinkedIn: Michael Rasmussen
andrewjfrancis
campfire
findyinc
alexanderbyndyu
ryo5043617
acenel
eikohashiba
zvc2022
yuki_yano
o2mami
ar_tama
churadata
kakehashi
yeseniaperezcruz
bermonpainter
akosma
tmm1
dougneiner
maggiecrowley
paulrobertlloyd
jacobian
sonatard
jeffersonlam
frogandcode
hursman
![Michael Rasmussen, J.D. Chief GRC Pundit & OCEG Fellow [email protected]](https://files.speakerdeck.com/presentations/442c41300b9a013275ac52f74ffd8446/slide_23.jpg){kind=link}