Four systems, four versions of the truth
Where the risk and control record actually lives in most organisations of this size.
Where the record lives
Systems holding risk, control or obligation records, and which of them is authoritative
| System | Records | Authoritative |
|---|---|---|
| Spreadsheets on shared drives | 5,400 | Disputed |
| Legacy GRC tool | 1,180 | Disputed |
| Ticketing system | 3,900 | Disputed |
| Document library | 12,700 | Disputed |
Why it matters
23,180 records, and no single one of these systems can be pointed at as correct. The quarterly pack is assembled by reconciling them, which is why it takes three weeks and why it is out of date the day it is presented.
The cost is not licences
The cost is that judgement gets crowded out. A risk team spending most of a quarter agreeing what the numbers are has very little of that quarter left to argue about what the numbers mean.