I have spent that last few weeks wandering through my “Groove Theory of GRC” and am reaching my last postulate. GRC is a groove that underpins the business to optimize decisions and provides the “safety” net that allows the business to grow, mature and progress. My previous blog discussed how GRC programs must establish key processes that impact operations. Now I want to get to the bottom layer of my theory.
One of my early professional musical experiences was playing with a 17 piece big band – 5 saxophones, 4 trumpets, 4 trombones and a rhythm section. Playing songs from Tommy Dorsey, Glenn Miller and a musical legacy that pre-dated me by decades was an incredible experience. I listened to many recordings of the big band era and what struck me was the power of the rhythm section. In those days the bass player had to coax a sound from the acoustic bass that provided a solid beat and remained relevant within the wall of sound created by all of those horn players. Having the luxury of playing the electric bass in that same atmosphere, the fact that those bass players could thump their way into the mix and swing the way they did amazed me. As I have created this analogy – inspired by a fellow bass player unable to easily define “groove” – I picture GRC as a mighty rhythm section.
Postulate #4: The transactions and operations of the business come first and GRC must provide the framework to explore and exploit opportunities.
If we take this analogy to its fullest, the business is playing all of the notes that people notice – the crazy behind-the-head guitar solo; the lilting melody of the vocalist; the frenetic dash of notes from the piano. GRC never really takes a solo. It is the business that is creating that wall of sound. Just like the bass player of the big band of bygone times, GRC needs to thump its way into the mix and remain relevant – shaping the beat, laying the groove down, swinging hard underneath the solos and melodies of the business. This is the unsung hero of the song - the part that would immediately be missed if it wasn’t there but the part that rarely gets the spotlight.
GRC must remember that it is a means to an end – not the end itself. Compliance to laws and regulations are a necessity to avoid fines, penalties or reputational impacts. Managing security, financial, market and other types of risks are part of doing business. These are the important elements of an organization that will keep its name out of scandals and catastrophes and on the front page of the newspaper for the right reasons – explosive growth, innovation, exceeding expectations – things that the shareholders want to hear about - not the data breaches, regulatory violations or business failures that we hear about too often today.
Sometimes GRC professionals can become too focused on the goals of the GRC program. We must maintain our perspective within the big picture. While perfect control execution should be the ultimate objective, GRC programs will have to accept and sometimes even embrace the flat notes played by the business. A good solid rhythm section will help the soloist recover from those missed notes or clumsy phrases that sometime sneak out. GRC should do the same for the business. GRC enables the business to explore possibilities, take chances and exploit opportunities. I have seen bands in the past where the soloist or vocalist stumbles and the entire band falls to pieces. The reason: the rhythm section couldn’t hold it together. If you take a listen to great soloists and vocalists in music history, you will find they all had incredible rhythm sections behind them. Eric Clapton had Jack Bruce and Ginger Baker; Marvin Gaye had James Jamerson and the Funk Brothers; Miles Davis had Ron Carter and Tony Williams. You may not know their names but listen to the songs* and they are there and making magic.
So if you are a risk or compliance professional, your biggest reward won’t be the headline “ACME, INC. PASSES AUDIT” or “BIG RISK AVOIDED”. The spotlight that will not be shined your direction and your name won’t be in lights on the marquee. But that doesn’t diminish the magic that you can make happen. It may sound too poetic but it is true. You are the quiet unsung strength that propels your organization forward unleashing its own talents as a powerful wall of sound.
* Selected discography:
Cream (Eric Clapton/Jack Bruce/Ginger Baker)
Marvin Gaye (I unfortunately couldn't find a live video of James Jamerson with Marvin Gaye. Here is a brief tribute to him from other bass players.)
Miles Davis
