This builds on a previous post.
Obviously, decision-makers should not adopt a one process-fits-all for landing on what they should do. Decisions vary in terms of impact, urgency, etc. Some belong to the board, while others are executive management’s call, and still others can be made further on down the organization’s management chain.
One might consider decision-making as a “triage of decisions,” since the decision-maker’s time, the affected organizational resources, and the degree of patience on the part of affected parties should be considered to be somewhat scarce by default. So the use of a complicated and time-consuming process for every decision makes little sense in instances where time to decision is more critical. The phrase “analysis paralysis” comes to mind. On the other hand, very quick decisions may result in some very poor outcomes. The adage “ready, fire, aim” applies here. The conclusion is that we should recognize what the situation calls for, and if necessary, strike a balance in the non-extreme cases.
In this methodical spirit, decision-making reduces to two main phases that can leverage selected main components of the OCEG GRC Capability Model. Each of these two phases further decomposes into five-part steps according to the Re Corr et al. Decision Process, which is described in the NACD publication “Decision Making – A Sensible Approach” (April 2013).
Let’s take a moment to further explore how, at a high level, the decision process and GRC capability model are intertwined.
The definition of the decision is a process that primarily leverages three key elements of the GRC Capability Model (for economy of words I will refer to this as simply capability model, or CM for short). Those elements are depicted above, namely: context, organize, and assess. In practice, other elements can come into play, but these are the most critical ones. Furthermore, there is no direct mapping to particular sub-elements.
In order to fully leverage the CM as part of your decision making process, you need to possess sufficient familiarity with it in to enable you to understand what will be applicable in a given situation. Therefore, I encourage you, and decision makers in general, to pursue an OCEG study program and certification to get the basics down with sufficient knowledge on how to apply it in you institution and any particular situation. To that end, I should mention that I am actually a graduate of the March 2010 OCEG GRC Boot Camp which was taught by Michael Rasmussen in Atlanta. It was an intensive 2.5 day course that affords a complete understanding of the CM, as well as strategic and technology aspects of building a strong GRC system. It also prepares you for the GRC Professional Certification test plus 20 hours of CPE credit. You can also learn and prepare online through a 35 unit GRC Fundamentals series of short courses that can be access at your convenience. Please access the GRC Fundamentals link provided to check out the sample lesson, conducted by Scott Mitchell.
You can effectively leverage the CM in the process of defining the decision in several ways. For example, it can point to important internal and external information that may need to be sourced, such as libraries of risks, objectives, business processes, controls, policies, financial statements and reports, press releases, regulations, partnerships, suppliers, competitors, market and customer data, contracts, plans, and strategies. These can provide needed business context for establishing the need for making a decision. The CM can help you organize, plan, and scope resources and information needed as you prepare to analyze the problem. It can also aid in assessing the importance of the decision, and nailing down other important considerations, such as timing and who owns, and who is affected by, the decision.
Making the decision is a process that primarily leverages three other key elements of the CM, namely: context, organize, and assess. As before, other CM elements can and will come into play, but these are primary. Again, there is no direct mapping to particular CM sub-elements that holds generally – you need to customize the process in each situation to fit the purpose and business need. For example, it can help to ensure completeness of information for the decision, including input (distinguishing fact vs. opinion vs. hope), and information impacting the weighting of both quantitative and qualitative factors, e.g. expert advice, values, risk appetite, capital position, and so on. The CM can also help with aspects of the decision approach and identification of key factors and with record keeping. In addition, the range of possible options can be aided through the use of the CM’s helicopter view of the business operation and landscape.
The CM can be leveraged in the area of measurement, which is a critical aspect of deciding upon the best course of action, and also in tracking the outcome. Indeed, interaction is a key to making and implementing the decision, where the CM can guide you through important steps, such as assignment of responsibilities, establishing a timeline, communicating what is expected and what is happening (stakeholder communication program) and in measuring results, validating execution and results, and reporting as needed.
An overall advantage to the Re Corr et al. Decision Process is that deciding what you are deciding (the first part) lands you on the best approach to take before proceeding to making the decision (the second part). Again, the emphasis here is on practical aspects of decision making rather than a more academic treatment. Furthermore, the CM (OCEG GRC Capability Model) provides a workable and very useful framework that integrates naturally into any decision making situation.