One Heat Map, Three Risk Languages
A regional health insurer with 2,300 employees has just acquired a 400-person dental insurer. Six weeks after close, the board risk committee asks for a single enterprise heat map and one consolidated risk appetite statement by the end of the quarter. You discover three incompatible inventories: finance's enterprise risk register rates vendor concentration as high, the CISO's IT risk register rates the same exposure as medium, and legal's compliance obligation register does not track it at all. The COO describes GRC as 'the compliance team's job'; the CISO will share incident counts but not raw data; internal audit uses its own taxonomy and has already begun a separate vendor review. You are the new GRC lead with one analyst, a six-month horizon, and no budget for new software. The regulator has asked for evidence that risk decisions are coordinated across the group.
1. The COO proposes combining the three registers into one spreadsheet and calling the result 'integrated GRC.' Using GRC key concepts, explain why this would likely fail and what integration actually requires.
Read the worked answer
Combining registers addresses only the artifact, not the capability. The three inventories rate vendor concentration differently because they use different definitions, scoring scales, and purposes: finance is measuring financial exposure, the CISO is measuring operational and cyber exposure, and legal is measuring obligation coverage. A single spreadsheet would preserve those disagreements while creating an illusion of consistency.
GRC integration requires a common language and shared decision rights before it requires shared data. That means agreeing what 'vendor concentration' means, which risk taxonomy applies, who owns the aggregated view, and which committee accepts residual risk. The COO's framing also reveals a governance problem: if GRC is 'the compliance team's job,' business and technology owners will continue to produce parallel views. Integration must be designed as a cross-functional capability with明确的 accountability, not a compliance-owned data merge.
The regulator is asking for evidence of coordinated decisions, not a prettier file. The test is whether the same exposure gets a consistent rating and a documented acceptance decision across the group. A spreadsheet cannot supply that evidence if the underlying definitions and authorities remain fragmented.
2. Recommend a 90-day sequence for your first three moves and justify the order. Include what you would not do yet and why.
Read the worked answer
First, establish a common risk taxonomy and decision-rights map for the top 15 group risks, starting with vendor concentration. I would convene finance, the CISO, legal, and internal audit to agree definitions and rating criteria. This comes first because every later consolidation depends on a shared language, and because internal audit's parallel review creates a coordination risk if ignored.
Second, pilot the taxonomy on vendor concentration and produce a reconciled rating with documented rationale. A pilot is preferable to a group-wide rebuild because it tests whether the definitions work in practice and surfaces disagreements in a bounded setting. The CISO's refusal to share raw data is less important than agreement on incident counts and risk criteria; I would negotiate access to aggregated metrics rather than force a data-sharing fight.
Third, establish a single risk committee reporting line and a board-ready heat map with explicit assumptions and gaps. I would not buy software, force all registers into one tool, or promise a fully consolidated appetite statement this quarter. Those steps would consume the limited analyst capacity and lock in unresolved definitions. Tooling should follow agreement, not substitute for it.