Situational method engineering for governance, risk and compliance information systems

Abstract

Against the background of the current financial crisis and an aftermath of increasing regulation, companies enhance and integrate information systems in the areas of risk management, governance and compliance. Based on experience with isolated and often immature partial solution in these fields, major challenges are the evolution of a suitable risk management solution component as well as the conceptual design of an integrated "Governance, Risk and Compliance" (GRC) approach. Another challenge is the rollout of such an integrated GRC solution. In this paper, we develop and evaluate a situational method that supports the implementation of an integrated GRC solution. The proposed situational method is comprised of 21 method fragments that support conceptual, strategic, organizational, technical, and cultural rollout aspects. Furthermore, method configurations are specified that identify only those method fragments that are relevant for certain roles, e.g. project manager or GRC expert.