CIO HandBook 2011 "GRC Readying for Growth in India"

The GRC market in India with less than 30% penetration is nowhere near saturation. Forrester Research report says that the GRC technology industry comprising software, consulting, and related services is currently growing at 24% y-o-y, and is slated to grow from $2.6 bn in 2009 to over $24 bn in the next 5 years.

According to a recent India Fraud Survey report 2010 by KPMG forensic advisory, 75% agree that fraud in corporate India is on the rise while 81% have concurred that financial statement fraud is a major issue. Interestingly as per the survey, 87% believe that the value of financial frauds is more than `1 mn.

Risk management has grown into a complex issue over the last few years, therefore organizations are being forced to expand on the reach of their risk management functions.

Even now many organizations have their risk functions existing in silos, thereby disconnected from the companys business strategy. This lack of coordination can hamper an organizations ability to manage, and capitalize on the risk.

The enterprises are increasingly turning to GRC solutions to improve visibility into their enterprise wide risk posture, and automate compliance processes. GRC helps in meeting security best practices, and protecting business critical information. Combined with rich vulnerability data and compliance intelligence gathered, GRC becomes even more effective. The demand for GRC software products have increased significantly over the past year, says Maneesh Sharma, head, business analytics and technology, SAP India.

The GRC market in India is gaining traction in the BFSI industry followed by healthcare, life sciences, energy and utilities, IT services sector, and manufacturing. Increasingly companies are beginning to realize that the GRC strategy should be approached in a unified manner, and not in silos as it will culminate into an issue to manage in the long run.

Key Drivers

The GRC market in India is being largely driven by issues like regulatory compliance, senior management sponsorships and organization size, and internal control maturity.

On the regulatory front, enterprises are expected to demonstrate sound compliance processes, and this can only be possible by using sound GRC technology which can then help measure, verify, and report on the compliance activities.

The sponsorship by top management to help support sustainable internal control processes, and with reporting lines into the CEO/CFO can highlight the importance that senior management places on GRC processes.

For organizations having a global presence, complex trade relationships and country specific compliances are some of the drivers to make the shift.

Such organizations have been practicing sound internal control policies, to help manage incidents. A single platform to help manage the same can be far more optimal against a siloed approach.

Vendors in the Fray

The adoption of GRC solution is growing. Most organizations have now understood the importance of governance risk and compliance, and do not look at it as an extra expenditure.

For instance says Sharma, SAP customers like BPCL, Ranbaxy, ABB, Vodafone India Services, Sterlite Industries India, Tata Teleservices have adopted our GRC offerings.

Even the company stakeholders are demanding effective governance. Some of the players in the market include SAP, Oracle, Alert Enterprises, Approva, Newgen, CURA, Oversight, Pentana, etc.

For the enterprises, some of the key focus areas in India include increasing focus on enterprise wide risk management frameworkrisk based approach to planning and executing audit and assurance activities, streamlining access management (segregation of duties), network security, document management, data quality, master data management, regulatory intervention in the role of independent directors, and finally continuous monitoring tools will be a major focus area in GRC market in India.

Stuti Das
stutid@cybermedia.co.in