When the GRC vendor announced that it was ending support for this application, it gave UKHS the opportunity to find a better one. The University of Kansas Health System’s search for a replacement GRC system led them to Onspring.

“While evaluating a new tool, we wanted to get the biggest bang for our buck,” Loescher said. “If it could do more than GRC functionality and contracting, maybe we could work with other teams to provide more value to our organization.”

Since starting small with a couple of functions, the University of Kansas Health System has expanded Onspring to 12 different processes and counting, including:

• Contract management
• Third-party risk assessment
• Due diligence
• Risk questionnaires
• GRC document repository
• Risk register management
• Policy management and exceptions
• Internal and external auditing

Expanding GRC and Business Automation with No-Code Development

Blackburn gave an example of another GRC workflow that the University of Kansas Health System is using Onspring to optimize. “Recently, we integrated an additional security tool into Onspring that’s assisting us with continuous monitoring of our third parties, so we get risk quantification automatically,” she said. “It gives us information on 20 technical categories – like patch and asset management and domains – and rates them A through F. We can also let our stakeholders know how likely a third party is to fall victim to a ransomware attack.”

While many systems require years of prior experience or costly vendor services to expand, UKHS has found that Onspring provides the ability to easily create new workflows, dashboards, and reports.

“My favorite feature in Onspring as an administrator is that it’s a no-code SaaS system that’s very easy to learn and utilize,” Loescher added. “You can spin up a new field or different app in no time at all, and that’s been wonderful to create customized experience for our teams.”

Another benefit of implementing Onspring has been the ability to create and distribute reports that visualize key GRC metrics for leaders in many different UKHS departments.

“Onspring has helped us communicate the value of our governance, risk, and compliance function across the organization,” Blackburn said. “We provide leadership with the amount of policy exceptions coming through and the financial impact of these risks. Doing this also identifies if there’s a gap in understanding our policies, allowing us to put together additional training and security awareness.”