{"id":788128,"date":"2025-11-28T17:27:02","date_gmt":"2025-11-28T16:27:02","guid":{"rendered":"https:\/\/www.devoteam.com\/?post_type=expert-view&p=788128"},"modified":"2026-01-06T10:56:07","modified_gmt":"2026-01-06T09:56:07","slug":"the-crucial-foundation-for-success-in-grc-system-implementations","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/en-dk\/expert-view\/the-crucial-foundation-for-success-in-grc-system-implementations\/","title":{"rendered":"The crucial foundation for success in GRC system implementations"},"content":{"rendered":"\n
\n
\n

If you are considering implementing ServiceNow<\/a> or any other system to support your GRC (Governance, Risk & Compliance) functions and processes, you should be aware of the key prerequisites for success. Some of these are obvious, while others are a little more hidden and only identified later. It is therefore important that you give careful consideration to whether you have the right foundation to build on.<\/p>\n\n\n\n

It is like building a bridge. The supporting structure must be solid before building the runway. And yes – sometimes it is necessary to build the bridge while driving on it, and that can also be done, as long as you are aware that the asphalt may be a little soft in a few places.<\/p>\n<\/div>\n\n\n\n

\n
\"\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n

Compelling objectives<\/h2>\n\n\n\n
\n
\n

There are many objectives in investing in a new system to support your GRC functions and processes, and some of these objectives can be so compelling that you might rush the investment and implementation and discover too late that you were not entirely ready.

Generic objectives<\/mark><\/strong> include digitalisation, automation of manual workflows, scaling across functions, replacing legacy technology, standardisation, breaking down organisational silos, as well as complying with your overall platformization strategy.<\/p>\n\n\n\n

GRC-specific objectives<\/mark><\/strong> \u00a0include increased information security and resilience, organisational robustness, and compliance with standards, external legislation, and internal policies.<\/p>\n<\/div>\n\n\n\n

\n
\"\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n

These objectives, combined with more frequent and more severe threats to the company’s operations, as well as growing and stricter demands from authorities and customers, may lead decision-makers to set high demands for the implementation of new solutions. And although overly extensive preparation can get in the way of execution, it is important to find the right balance and focus on the part of the preparation that will help ensure that the execution brings you closer to your goal within the boundaries of the project.<\/p>\n\n\n\n

Key components of your foundation<\/h2>\n\n\n\n

Many good books and articles have been written about the preparation and execution of projects in general, so I will focus here on the parts of the preparation that I believe are particularly crucial for GRC system implementations. Many pitfalls and obstacles can be foreseen and managed with good preparation.<\/p>\n\n\n\n

Recommendation: Think holistically across the organisation, processes, and technology.<\/strong><\/p>\n\n\n\n

Consider how the new system will affect your existing processes and workflows, will replace, complement, and possibly integrate with other systems, and how the many stakeholders may have conflicting objectives and expectations. And remember that you cannot achieve security and compliance through system implementations alone.<\/p>\n\n\n\n

Often, a new GRC system will replace homegrown, complicated, and advanced Excel-based systems that key stakeholders themselves have been involved in developing, have used for a long time, and are very comfortable with. It therefore requires a focused effort to carry out this transformation – not only technologically but also to a large extent organizationally, as people must get used to using a completely new system that they are not as comfortable with as the old one.<\/p>\n\n\n\n

Recommendation: Anchor in the business – not in IT.<\/strong><\/p>\n\n\n\n

Although system implementations heavily depend on your IT organisation, GRC systems are so closely linked to critical business functions that the anchoring and ownership of the implementation should be within the business, where many of the key stakeholders are located, with IT as an important partner. And yes – IT plays a vital role in both providing large parts of the foundation and in ensuring that the GRC system fits into the overall platform strategy and enterprise architecture.<\/p>\n\n\n\n

This anchoring should be applied throughout the implementation, from selecting the system and implementation partner, planning and executing the implementation, and especially during the organizational implementation.<\/p>\n\n\n\n

Recommendation: Find your ‘sweet spot’.<\/strong><\/p>\n\n\n\n

A sweet spot is the point on a racket where the greatest effect is achieved with the least effort. In this context, it means that you must find the areas where you have the best combination of:<\/p>\n\n\n\n