OCEG Announces the 2012 GRC Achievement Awards and Principled Performance Prize

WASHINGTON--(EON: Enhanced Online News)--The Open Compliance & Ethics Group (OCEG) is pleased to announce that today it has recognized four organizations with the 2012 GRC Achievement Awards. The recipients of this year’s awards are:

“and this year’s winner, Sybase, impressed our panel by describing successful efforts to integrate governance, risk and compliance into the rhythm of the business.”

• The Federal Home Loan Bank of Chicago
• Lanka ORIX Leasing Company of Sri Lanka
• The U.S. Treasury, Bureau of Public Debt, Office of Financing
• Sybase, an SAP Company

In addition, the judging panel has selected Sybase to also receive the Principled Performance Prize, which is awarded to the organization with the winning project that best demonstrates an overall approach to integrating the governance, management and assurance of performance, risk and compliance.

“The GRC Achievement Awards recognize the great strides that companies, government agencies and other organizations have made in improving and integrating their approaches to governance, risk management and compliance (GRC) to achieve Principled Performance,” says OCEG President, Carole S. Switzer. “One recipient of the GRC Achievement Awards selected by the judging panel as the project that best exemplifies a pathway to Principled Performance,” she continued, “and this year’s winner, Sybase, impressed our panel by describing successful efforts to integrate governance, risk and compliance into the rhythm of the business.”

“The goal of Principled Performance - the reliable achievement of objectives, while addressing uncertainty and acting with integrity – is supported by taking an integrated, rather than siloed approach across your business areas and the processes of governance, assurance and management of performance, risk, and compliance,” says OCEG Chair and CEO, Scott L. Mitchell. “OCEG established the GRC Achievement Awards in 2010 to offer recognition to organizations that have undertaken to gain Principled Performance and to provide examples and inspiration for organizations of all types and sizes to follow,” he continued, “and we know that this year’s winning projects will do just that.”

The awards were formally presented to the recipients before the audience of the Compliance Week conference on June 5^th at the Mayflower Hotel, in Washington, D.C.

“We were very honored to have the services of an excellent judging panel,” said Ms. Switzer, “and I’d like to thank committee chair, Brian Barnier, who serves as an OCEG Fellow, for coordinating their activities, and also thank each individually for their thoughtful consideration of the nominated projects.” The judging panel included Ms. Switzer and the following individuals:

• Katherine Combs
  Director and former Chair, Interim President and CEO of the Society of Corporate Secretaries and Governance Professionals

• Michael Cangemi
  Author and business advisor; former President, CEO and Director of Etienne Aigner Inc. and Financial Executives International

• Matt Kelly
  Editor and publisher of Compliance Week

• Jon Lukomnik
  Managing Partner of Sinclair Capital; Executive Director of the IRRC Institute

• Brian Barnier
  OCEG Fellow and Principal Analyst, ValueBridge Advisors

Decisions were made by the judges based on review of submitted videos describing the projects each nominee had undertaken as part of their efforts to integrate governance, risk and compliance processes or technology applications. These may be viewed on the OCEG site at http://www.oceg.org/about/2012-grc-achievement-awards

About the 2012 OCEG GRC Achievement Awards Winning Projects

Sybase, an SAP Company

Sybase, an industry leader in enterprise and mobile software to manage and analyze information, undertook a multi-year project to, as they describe it, “integrate governance, risk and compliance into the rhythm of the business.” The goal was to create an effective governance, risk and compliance (“GRC”) framework at Sybase that would help drive overall company performance with three important components: integrating GRC principles within existing management structures, enhancing management thinking around risk by refining GRC methodology, and improving GRC analysis across the organization by the implementation of GRC automation. Starting with the driving force of CEO involvement, Sybase created enhanced capabilities and cross-functional risk and compliance committees and communication. Through performance of entity-wide risk and compliance assessments, Sybase’s GRC capability can now identify risk drivers and indicators, link risks and controls, and enhancing the quality of reports and analysis. This has led to a positive impact on performance and revenue, as well as reduction in risk incidents and enhanced ability to facilitate reporting internally and to customers. www.sybase.com

The Bureau of the Public Debt

The Bureau of the Public Debt, Office of Financing, an important part of the U.S. Department of the Treasury, undertook its GRC improvement project initially to ensure compliance with the Government Performance and Result Modernization Act (GPRAMA) of 2010, but it found even greater value. The Bureau developed a strategy to measure performance through a risk-based assessment methodology, and created a modular tool to enable that assessment process. The Bureau’s integrated framework for measuring performance has three main components: alignment of strategic plans and initiatives with performance and risk measures; qualitative performance assessment; and quantitative risk assessment. The framework provides a basis for building a level of GRC maturity defined by the OCEG GRC Maturity Model, demonstrating the value of documentation, established measures and continual analysis. Defining success and validating improvements are recognized as key factors in recognizing the integrated efforts as meaningful contributors to performance. This has allowed the Bureau to also identify future needs for continual improvement that will further support operational, strategic and tactical objectives. www.publicdebt.treas.gov

Lanka ORIX

The Lanka ORIX Leasing Company (LOLC) of Sri Lanka faced the dual challenges of governing a growing conglomerate of diverse financial companies, and every-expanding complexity of its risk profile, by implementing an integrated approach to risk and compliance based on the OCEG Red Book standards. LOLC faced a range of corporate cultures throughout its multitude of subsidiaries and branch locations, and difficulty in deploying adequate resources for risk management, while continuing to rapidly expand. LOLC established an organizational structure for risk management finding synergies from use of different departments and skills, and created Integrated Risk Management Committees (IRCM) for each major company and compliance officers for each regulated subsidiary. A central internal audit function addresses all. Then, it introduced a unified risk management policy and framework that each IRCM would use to evaluate and report on risks. Management of policies, training and documentation of risks and controls has been harmonized across the company, enabling meaningful reporting. The framework has been accepted by LOLC’s international funding agencies, reduced duplication between the audit and risk management functions, and strengthened the internal audit function to enable evaluation of the effectiveness of risk mitigation strategies. www.lankaorix.com

Chicago FHLB

The Federal Home Loan Bank of Chicago, a $71.3 billion government-sponsored wholesale bank serving the needs of member housing finance institutions, undertook a re-engineering project to move from a siloed compliance focus, to a coordinated, efficient and effective framework for risk & compliance management across the enterprise. Faced with challenges of increasing regulation, stakeholder demands for transparency, multiple siloed risk evaluation methodologies and widely divergent and views of risks; as well as a narrow focus on compliance, the goal was to improve collaboration and provide a single view into the risk organization. The re-engineering process began with the identification and involvement of all relevant stakeholders within the organization, to set objectives and evaluate various approaches, including the OCEG GRC Capability Model. Collaborative relationships between operations, risk, finance, compliance and internal and external audit were established with strong executive management support. Objectives were defined, including greater transparency about risk and governance process across the organization but particularly to managers, executives and the Board. Other goals are moving to an integrated risk management culture and culture of risk ownership and accountability for line management; as well as providing a cost effective infrastructure to enable an integrated governance framework that would provide better insight and reduce overhead. The Bank has successfully implemented common definitions and standard methods to enabled consistent risk evaluations and independent but comparable risk reporting. It is now better able to baseline risk and control metrics and track performance, thereby reducing resolution time for critical risk and compliance related issues a well as the number of open issues, saving human capital resources. www.fhlbc.com

About OCEG

OCEG is a nonprofit think tank dedicated to helping organizations reliably achieve their objectives, while addressing uncertainty and acting with integrity. This is what OCEG calls Principled Performance, and it is a goal that every organization can achieve by integrating and aligning their approaches to the governance, assurance and management of performance, risk, and compliance. Processes for achieving that integrated approach, commonly called GRC, is supported by the open source standards set out in OCEG’s Red Book GRC Capability Model. The companion set of agreed upon procedures set out in OCEG’s GRC Assessment Tools (the Burgundy Book) provide an opportunity for self-assessment and OCEG certification of the design and operation of an organization’s entire GRC capability or aspects of it as they are matured over time. OCEG offers hundreds of resources, online and live training opportunities, and a community within which individuals can continually build their skills and organizations can collaborate. www.oceg.org