Increasing the pace of small initiatives to integrate governance, risk and compliance is critical in helping Boards with their capacity to gather and manage real-time data on strategic risks – including compliance risks that can impact upon their legal and/or community license to operate, according to Alf Estaban, general manager of SAI Global.

Visibility of these strategic risks is essential for Boards to undertake their core functions, said Estaban, who noted that regular discussions about the adequacy and effectiveness of programs, coupled with an active review of compliance reporting, are key tools in ensuring Boards are confident in managing compliance risks.

He added that Boards also need to actively promote a culture of ethics and compliance through clear policies and other activities which inform staff about desired behaviours.

“Importantly, Boards should promote a culture of openness and provide access to independent whistleblowing services to reinforce that [they are] serious about wanting to know and address serious breaches or incidents,” said Estaban.

“Boards and senior management need to be seen to act in a manner that supports the culture appropriate to their business.”

Heads of compliance should actively partner with governance and risk counterparts on integration, and work assiduously to ensure clarity of compliance risk ownership across the business, Estaban said.

“Additionally, they should be able to explain the return on investment of activities that drive both a culture of compliance and an effective compliance program,” he said.

Organisations also need to ensure sufficient resources to provide the essential foundations of a comprehensive program, said Estaban, including obligations registers, compliance attestation tasks and processes that allow relevant staff to interact and report effectively.

“Once all these things are in place, GRC management software can bring the compliance program alive, drive efficiencies and release compliance resources to focus on assisting the business in achievement of its strategic objectives,” he said.