Tell Me a GRC Story!
By Jason Rohlf
I wish I had a nickel for every time my son or daughter said, “Tell me a story, dad.” My kids were not easy people to please when it came to telling a story—I could never get away with the old, “Once upon a time there was a prince/princess who really needed to go to sleep so he/she did. The end.” Nope, there was no tricking them. They saw right through that and demanded more. Of course, this makes it sound as if doing so was a chore. Quite the contrary. Laying with them at bedtime, reading books to them, making them laugh with funny voices and mispronounced words—these were and remain some of the best memories I have in my life.
In my role leading the Solutions team at Onspring, I have the distinct honor of being one of our company’s primary storytellers. When your primary responsibility is helping clients piece together the various, individual aspects of their GRC programs—risk assessment software, compliance and control, and other solutions—into a compelling narrative about the overall health of the organization, you quickly realize that this analogy is apt. Each separate element of a GRC team—the compliance group, risk assessment software managers, internal auditors, policy managers, etc.—is responsible for its own part of the story. But it has to be compelling. We work to help them paint a broader picture by highlighting the key connection points and developing solutions that allow them to feature a whole that is greater than the sum of its parts.
In such situations, I find it best to break things down into their simplest parts. And what better way to illustrate the concept of Onspring as a storyteller than by exploring some of the most essential and fundamental aspects of a good narrative:
- Characters help make the tale relatable. They give us someone to empathize with, someone to love or even hate. They make us care. These are the people involved in the process areas whose lives we are trying to make easier—we care about them and want them to have a good experience.
- A story’s plot is its primary driver, and it’s what ultimately pulls us in. It compels us and gives us no choice but to jump in and go along for the ride. When implementing a process in Onspring, we are primarily focused on the business case. We seek to understand the client’s need. We want to join their story and see where we can take them.
- In almost every narrative there is some element of conflict. Protagonist vs. antagonist, human vs. nature, good vs. evil—conflict makes us think, makes us uncomfortable and forces us to choose a path. While most clients enter into the decision to implement a new GRC solution, it is inevitable that conflict will rear its head—usually, it manifests as resistance to change. “We’ve always done it this way and it works just fine.” Most people are uncomfortable with change, but as is so often the case, facing and embracing change is the only way we can truly grow.
- The climax is the culmination of the story, the moment we’ve been waiting for. It enthralls us and brings the tale to its inevitable conclusion. In the software world, this is often referred to as, “go live.” The system is on, the users are in and the new process is up and running, which is when the magic can happen.
- If a story proves compelling enough, we are left wanting more, and that’s where the sequel comes in. For our clients, a successful implementation in one process area leads to interest and opportunity in other areas. New use cases and new users ultimately create a richer story.
Some have argued that the art of storytelling has been in deteriorating in recent times. I have heard many reasons why this has been a running, ongoing belief: declining attention spans, greater expectations of instant gratification, less time, more obligations and so on. I have noticed some of these indicators in our space lately. Many companies tell just one part of the GRC story—they might only cover the risk assessment software portion, leaving major plot holes that are difficult and time-consuming to fill. Others seem to be far more focused on concepts like brand recognition, image or maximizing their investors’ ROI than they are in actually helping their customers build a sound and reliable GRC program that allows them to effectively manage their responsibilities and communicate results to their key stakeholders.
This is one area where Onspring is different. We have been putting a great deal of thought and effort into providing our customers with new features, helping them develop new business cases, fostering the creation of new relationships and connections that will serve them well as they craft their rich and holistic stories in a way that is compelling, meaningful and satisfying. We do this by constantly innovating, by listening to their needs and concerns, and enabling like-minded people to share their stories with us and with one another in the spirit of learning and growth.
I have the honor of representing Onspring at the IIA/ISACA GRC Conference in Florida next week, and honestly, I have not been this excited to attend a conference in some time. I believe we have a great story to tell, and I am looking forward to showing you how we can help you spin your own satisfying yarn.