10 Powerful Facts About Big Data

The top 10 IT spending priorities for governance, risk, and compliance could serve double duty as a list of the fears that keep IT executives awake at night. Yet most organizations still use 1990s technology to handle their GRC needs, according to a survey released in May by the nonprofit Open Compliance and Ethics Group (registration required).

More than half (53%) of the 237 respondents to the OCEG survey said their organizations use mainly spreadsheets, emails, and documents to handle GRC. The rest use an internally developed GRC application (17%), a single commercial GRC application (24%), or two or more commercial GRC applications (6%).

GRC is practically an industry unto itself. US federal agencies, for example, publish an average of 14.7 final rules and 9.4 proposed rules each workday, according to Osterman Research. Then there are industry-originated compliance programs such as PCI in retail. And every company needs to have quick access to data for e-discovery in the event of a lawsuit.

[If your company hasn't yet faced a software audit, it will. Here's how to prepare. Prepare To Be (Software) Audited.]

The OCEG survey reveals just how scattered GRC duties are across organizations, making it hard for IT to create a tech roadmap that serves all departments. Consider the roles and departments of survey respondents:

Slightly less than half the respondents (46%) said their GRC technology is well utilized, while 51% said it's underutilized, and 3% were unsure. The vast majority (81%) of GRC applications used by survey respondents are either focused on a single department's needs or designed to resolve a specific GRC issue. As such, they're generally not integrated with other GRC applications.

The OCEG offered a choice of 27 categories of GRC technologies and asked respondents to identify their priorities (multiple responses were allowed). The following categories topped the final list.

{Table 1}

GRC technology decisions are made at an enterprise level and span departments, according to 44% of the respondents to the OCEG survey. Another 35% say those decisions span multiple departments but haven't quite reached the enterprise level. For 10% of respondents, GRC technology decision making is left to a single department, while 3% said it's a group decision focused on a specific issue, and 8% were unsure.

Spending on GRC technology will increase this year for the organizations of 64% of the survey respondents, while 22% said their spending will remain flat, and 14% plan to decrease their GRC spending.

So where does IT fit into this picture? The OCEG advises IT leaders to:

IT should then work with this group to identify the following GRC needs.

The OCEG advises organizations to then take an inventory of the people, processes, and technology currently in place, as well as the vendors being used, and identify GRC needs that aren't being met.

How does your IT organization handle (or avoid) GRC management challenges? How involved are you in making GRC technology decisions for your company? Which, if any, of the steps outlined above is your company already taking? What other advice do you have for IT pros dealing with GRC? Tell us all about it in the comment section below.

IT leaders who don't embrace public cloud concepts will find their business partners looking elsewhere for computing capabilities. Get the new Frictionless IT issue of InformationWeek Tech Digest today (free registration required).