Integrated GRC Infuse GRC at Every Level AMR

Integrated GRC - Infuse GRC at Every Level AMR Research‘s governance, risk and compliance (GRC) maturity model Step 4: Orchestrating Step 3: Collaborating Step 1: Reacting Panic • Get it done! • Operate in isolation • Marshal resources as necessary from wherever Tactical Step 2: Anticipating Acceptance • Efficiency • Automation • See connections between multiple programs • Plan future approach Coordination • Identify risks • Assess exposure • Prioritizing actions • Reuse technology components for multiple purposes Manage in Unison • Set enterprise objectives • Coordinate analysis and action • Complete visibility to risk, exposure, performance Maturity varies by industry / geography Strategic • Source: AMR Research, 2006

Integrated GRC - Infuse GRC at every level AMR Research‘s governance, risk and compliance (GRC) maturity model Step 4: Orchestrating Step 3: Collaborating Step 1: Reacting Panic • • Excel Spreadsheet • Get it done! • • Documentation of of • Operate in isolation Controls • Marshal resources as necessary from wherever Tactical Step 2: Anticipating • Acceptance Access Controls Efficiency • • Global Trade • Services Automation See connections • • Process Controls between multiple programs • Plan future approach Coordination • Risk Management • • Identify risks Industry Specific • Assess GRC exposure • • Prioritizing actions Environmental • Reuse technology components for multiple purposes Manage in Unison • GRC Repository • • Set enterprise Corporate Social objectives Responsibility • Coordinate analysis and action • Complete visibility to risk, exposure, performance Maturity varies by industry / geography Strategic • Source: AMR Research, 2006