Positioning GRC as an Enabler with Integrated Data

Megan Phee: Hi, I'm Megan Phee, and this is GRC& Me, where we interview industry thought- leaders in governance, risk and compliance on hot topics, industry- specific challenges, trends and more to learn about their methods, solutions and outlook in the space.

Andy Ruse: Hello, GRC& Me listeners. I am Andy Ruse, President of Field Operations at LogicGate, and I'm back once again as a guest host. For today's episode, I sit down with Mike Curl, who has years of GRC experience, most recently as the Regulatory Data Manager at Honeywell. Mike and I talk about the benefits of building dashboards from the bottom up, how to get organizational buy- in when it comes to change management, and Mike's unique culinary approach to executive reporting. We hope you enjoy listening to our chat today on GRC& Me. Hey, Mike. It's great to catch up.

Mike Curl: It's awesome getting to sit here and talk with you.

Andy Ruse: For our listeners out there, maybe just give us a little background on GRC, and how you got into this and where you're at today.

Mike Curl: Honestly, I took a really unusual path to get here. I was in the service very early. I joined up at 17. I literally worked in armaments, so we were building bombs. So process, risk mitigation: all of that was beaten into me from being a teenager. But I went on to be a chef and there just came a point where I needed to get out of that for scheduling reasons for my family. So I started working with a company that had no QMS, no quality program, and I basically attacked it like troubleshooting. No formal education in it; everything that I did was from the ground up, learning the hard way, running into the brick walls everybody's already found ways around. That company, I was there for a decade and built their quality and ERP system. But then I moved to Honeywell for a while. Started in quality, went from quality to regulatory, worked under an absolutely wonderful black belt who really was a great mentor, helped me see it. And honestly, the risk management, fell right back into working in the service and the process and that type of meticulous attention was no different than being in a kitchen. So I found something I excelled at that I just got to it in a very different way.

Andy Ruse: We always talk about change and new things. What is the one thing that you see coming that people should think about?

Mike Curl: At least from where I sit, the biggest thing to me is organizations are now looking to integrate that into their everyday. We used to be the oddball uncle that came out at the holidays and carpeted everybody, and nobody was that happy to see you because you only showed up when it was wrong. Getting this move from reactionary to... The data we have brings value and allows you not to have these problems, but it has to be integrated into the organization to do it.

Andy Ruse: And how frequent are you driving this into the organization? I think a lot of people only look at their risk program once a year. They report on it and it goes away. How are you driving more of a daily- action approach?

Mike Curl: When you look at your frontline users, they're often so siloed apart, but you can't. You have to have those risk personnel talking to your quality personnel. From my background, it was all manufacturing, so we were right in there with the manufacturing teams. And to be able to say, " Hey, we see this heading off the rails," before you ever got there. Once quality and regulatory and risk all had that joined voice, people started to see we're not just there to slap your hands. We're there to help you not have a problem.

Andy Ruse: I love that integrated approach. You've been leading GRC teams for more than a dozen years. That's quite a bit of time to think about the evolution of the market and the needs and the focus that's starting to come into play. What do you think is the biggest trend risk managers should be thinking about next?

Mike Curl: I really think it's going to be data integration. You start looking at some of these large inaudible language AI programs that are coming in. You start looking at the integration of augmented reality: some of these non- invasive brain machine interfaces that are coming out. The environment that people work in is about to radically change, and if I can go into a warehouse with a pair of safety glasses on that are literally scanning the barcodes, showing me what needs to happen, or working on some machinery somewhere and the blueprints are right there, this is going to leverage information for those frontline workers in so many ways, but it's going to open up so many risks. And if your risk management is often a silo on its own, the consequences of not having that integration and that communication... I hate to think about what some of them will be.

Andy Ruse: It's amazing. We talk about this all the time: the pace of change; the complexity of the systems you have to bring together. But risk is really about helping you make decisions so you can grow your organization.

Mike Curl: As long as you use it proactively, you are in such a wonderful place.

Andy Ruse: Yeah. We've been talking about risk management and different approaches that leaders have taken over their careers, and one of the things that I thought was really interesting was the approach of how you started to tie the frontline of the organization and the C- level executives together. Look, maybe you can walk me through that again.

Mike Curl: Well, it was interesting, because when I first started using the tool, I know the tool, but I don't know each of these individual person's jobs. So the first thing I did was come to them and say, " What's difficult?" And I started at the bottom, but I went to every level and said, " Where's your challenges? What aren't you getting?" And it was really, really funny. Once we'd walked that path, and we sat down and we looked at all the challenges and what they were, there were some gross misalignments in the upper metrics and what was really holding up the work on the front lines. And it made this wonderful conversation about aligning the day- to- day activities with the important metrics for those C- level executives. And it really improved and left a much better culture of conversation and communication throughout the organization. So having to figure it out had so many unseen benefits. It was fantastic.

Andy Ruse: That's really amazing. I often call that the voice of the employee, going out there listening to what people need and connecting to the work; to the metrics. That is fantastic. Now, as you did that and you started connecting these dots, the work that was going on in the executive dashboards, what were some of the things that you discovered along the way? I got to imagine that you found some really interesting things.

Mike Curl: One of the biggest ones that we found was really, as soon as we started looking forward with the dashboards, we found so many work imbalances. In one particular group, in one quarter, we had one individual with 33 regulatory tasks to complete, another with 29, and six individuals with one. And just having their managers be able to see that right off the bat and in their face... I mean, balancing out the work. And oddly enough, over a few months, the teams, because they were logging into the same dashboard, started self- balancing and helping one another out. We also found out that we were in a regulatory cycle where everything was queued up for the end of quarters, and we had almost no work Q1 and 2. Q3, we went nuts, and at the end of every quarter, it was just crazy, and the end of the year, brutal. And of course, everyone in the industry is trying to get through at the same time. It just killed our lead times, and shifting those dates just made everyone's life easier.

Andy Ruse: I got to imagine employee engagement, the mental health at the organization after making these changes and all that, showed up.

Mike Curl: It did, and what really was funny was, because we asked people, "What do you need? How do you want it to work?" The ownership and the pride that they had in the process... and to my detriment, I kept telling them, "If you think of anything better..." So I was constantly bombarded with the what's better, but that's a great problem to have, when your end users and your management are looking at exactly the same thing and get to the same goal. It was wonderful, but it was crazy at the same time, and I loved it.

Andy Ruse: I love this continuous- improvement mindset, but I think as leaders we often struggle with change management, and that's really a lot of what sounds like, as we were discussing, what you had to do. How did you start getting buy- in?

Mike Curl: For me, the biggest part of getting the buy- in was literally just telling people, "I'm here to make your life easier. Tell me what's hard. Can I do something to impact that?" And in some cases, there was nothing you can do. Certain parts of jobs are just that way. But the overwhelming majority of things, we were able to streamline it; change it. One of the hugest requests we had was we were constantly bombarded with other groups within the company looking for documentation, asking for reports, different things. We started down the path of APIs, a few different things to spread that data, and one of the individuals just went, "Can't we just let them have LogicGate too?" And once we went in and categorized things so that we could use the permissions properly, we just opened it up, and all of a sudden, it turned into data on demand. The groups that needed the data got it immediately, didn't interrupt our workflow, and in some cases, our customers went from three- day turn times on request to having the email with the document before the phone call to customer service ended. So it made everybody's life so much better.

Andy Ruse: I love that. 72 hours to self- service. Get it immediately. One of the other things that I found interesting in our conversation was these executive reports. We've all been in these C- level executive meetings and have seen some really beautiful reports, but you have a different way of thinking about dashboards and executive reporting.

Mike Curl: To me, it's no different than eating. And you walk in somewhere, and you've got one of those 18 patties stacked up burgers in front of you. How do you attack that? How do you break that down? If you want data consumption to be effective, you need it clear. You need it right to the point, and it has to be to pieces of data that matter to the people seeing it. And building the dashboards from the bottom up, let those C- level personnel see these were things that we had completely missed, and to read it at a glance and be done with it, was amazing. Don't get me wrong; for strategic planning, sometimes you need those big dashboards that have everything under the sun, but day- to- day operations, no. Give me something simple, quick, clean and accurate.

Andy Ruse: That's fantastic. Well, thanks for getting together with me today. One last question here, maybe something a little more personal. What are you looking forward to in the next couple months?

Mike Curl: Probably the biggest thing I've got coming is I've got some friends in a writing club and we're doing a big charity dinner for 250, so I'm literally attempting to teach these bikers how to cook well enough to pull off that scale of a charity event. And let's just say it's been humorous in certain parts.

Andy Ruse: That's fantastic. Sounds like a little bit of risk management, taking some of our learnings about how to build processes and tools and technology and give them back. What a wonderful contribution you're making there.

Mike Curl: It's going to be fun. Love it.

Andy Ruse: Right on. Well, thanks for joining me. I can't wait to see you around in the near future.

Mike Curl: My pleasure, and it's great talking to you as always, so...

Andy Ruse: All right. Thank you. To learn more about risk clouds, dashboards and reporting, visit us at logicgate. com today.