Integrated IT GRC framework

The goal of this instrument is to evaluate an enterprise state against our proposed IT GRC framework model. Below the model, you can see the statistics of the functionalities and overall status based on your input.

Direct
Monitor
Evaluate
Report

Direct
Evaluate
Report

Monitor
Evaluate
Report

Monitor
Evaluate
Direct
Report

Audit management status:

Policy management status:

Risk management status:

Issue management status:

Total framework status:

References:

Mayer, N., Barafort, B., Picard, M., Cortina, S. (2015). An ISO Compliant and Integrated Model for IT GRC (Governance, Risk Management and Compliance). In Systems, Software and Services Process Improvement Volume 543 of the series Communications in Computer and Information Science (pp. 87-99). Springer International Publishing
Kitchenham B., Guidelines for performing Systematic Literature Reviews in Software Engineering, EBSE Technical report, Keele University 2007.
Racz, N., Weippl, E., Seufert, A. (2010). A Frame of Reference for Research of Integrated Governance, Risk and Compliance (GRC). In Communications and Multimedia Security (pp. 106-117). Springer Berlin Heidelberg.
Racz, N., Weippl, E., Seufert, A. (2011a). Governance, Risk & Compliance (GRC) Software - An Exploratory Study of Software Vendor and Market Research Perspectives. In proceedings of the 2011 44th Hawaii International Conference on System Sciences (pp. 1-10). IEEE Kauai, HI.
Racz, N., Weippl, E., Seufert, A. (2011b). Integrating IT Governance, Risk, and Compliance Management Processes. In proceedings of the 2011 conference on Databases and Information Systems VI (pp. 325-338). IOS Press Amsterdam, The Netherlands, The Netherlands.
Krey, M. (2010). Information Technology Governance, Risk and Compliance in Health Care - A Management Approach. In proceedings of the 2010 Developments in E-systems Engineering (pp. 7-11). IEEE Computer Society Washington, DC, USA.
Vicente, P., Silva, M. M. (2011a). A Business Viewpoint for Integrated IT Governance, Risk and Compliance. In proceedings of the 2011 IEEE World Congress on Services (pp. 422-428). IEEE Computer Society Washington, DC, USA.
Vicente, P., Silva, M. M. (2011b). A Conceptual Model for Integrated Governance, Risk and Compliance. In Advanced Information Systems Engineering (pp. 199–213). Springer Berlin Heidelberg.
Shahim, A., Batenburg, R. and Vermunt, G. (2012). Governance, Risk and Compliance: A Strategic Alignment Perspective Applied to Two Case Studies. In ICT Critical Infrastructures and Society Volume 386 of the series IFIP Advances in Information and Communication Technology (pp. 202-212). Springer Berlin Heidelberg.
Puspasari, D., Kasfu Hammi, M., Sattar, M., Nusa, R. (2011). Designing a tool for IT Governance Risk Compliance: A case study. In International Conference on Advanced Computer Science and Information System (ICACSIS). (pp. 311-316). IEEE, Jakarta.
Institute of Internal Auditors. 1998. A Perspective on Control Self-Assessment. The Institute of Internal Auditing, Florida.
ISO/IEC 38500:2015: Information technology – Governance of IT for the organization. International Organization for Standardization, Geneva (2015).
ISO 31000:2009: Risk management – Principles and guidelines. International Organization for Standardization, Geneva (2009).
ISO 19600:2014: Compliance management systems – Guidelines. International Organization for Standardization, Geneva (2014).

2016