My week opens with a practice run-through for the BBRT’s upcoming webcast “How to Communicate Change: A Change without Migraines Resource,” featuring expert Rick Maurer. Click on this link to sign up.

Attendees will review the Cycle of Change, which starts with people “In the dark” and hopefully moves to “See the Challenge.” Both of these must be achieved before you can “Get Started.”

As I reflected on this conversation, I realized what difficulty many finance professionals have with change. Yesterday, I received an email from an accounting association executive we are trying to work with on transforming finance. The fact that he sent it on Sunday indicates his hard work and dedication to his mission. Yet his reply left me with great concerns. He and his staff had discussed our Beyond Budgeting proposal. They replied that they were interested in “better” budgeting. It is a response that I often get. more

Boston politics, always an interesting spectator sport, also is providing a lesson in the enforcement of data retention policies. The latest headline: “State orders [Boston] City Hall computers secured in email dispute.” A key insider, it turns out, routinely deleted email messages in clear violation of the state’s public records law.

The top aide to the mayor apparently deleted the messages in a way to avoid the messages being included in the city’s routine server backup. Throw in a contested mayoral election and a juicy bribery scandal involving a disgraced state senator who took payments to help a constituent get a liquor license from Boston City Hall—and no wonder state and FBI investigators as well as the candidates running for the mayor’s job all want to see those email messages. Computer forensics experts are recovering the messages now.

International Data Corp. (IDC) addressed the email retention issue in a recent report, “Insider Risk Management: A Framework Approach to Internal Security.” Insiders like the aide pose grave compliance risks that can suddenly bite the organization. Advises IDC: “Managing insider risk should be a top priority for CISOs, CSOs, and other C-level executives globally.” more

Business process problems happen in all sorts of environments. While most of my career has been spent working in industrial companies, I have recently started to take a look at what goes on in not-for-profits and the academic world. Financial and executive management in all worlds share many of the same challenges and in the vast majority of circumstances are working diligently to do a good job. Unfortunately, I also have learned that just as in the industrial world, there is some bad news about academic business processes to be shared. more

Which is more important to the success of a GRC program – culture, funding, or processes/technology?

As an admitted GRC geek, the question interests me; I’m always looking for the (probably nonexistent) silver bullet.

(In fact, we asked you to respond to this very question earlier this year in Business Finance’s 2009 GRC Maturity Study.)

So, when a GRC executive at one of the world’s largest technology companies offers to answer the “what’s most important” question, I’m all ears. more