A sound approach to King III

The King Code of Governance Principles and the King Report on Governance (King III), which came into effect in March 2010, has been met with a considerable amount of optimism, particularly in light of its relevance in the global marketplace as well as it alignment with the Companies Act no 71 of 2008, which is scheduled to come into effect on 1 July 2010.

However, despite the importance of the code, it is clear that a number of South African organisations still need to take cognisance of it.  Companies have to consider the recommendations in a conscious and concerted effort to gear themselves towards a business that drives compliance willingly rather than grudgingly.

Moreover, King III must be implemented with a strong change management approach in mind.  Similar to a new technology application such as Enterprise Resource Planning (ERP), governance must be propagated from the top down – from the board to the most junior position – to ensure that Governance, Risk and Compliance (GRC), the reason for its existence and how it can change an organisation in a positive manner are clearly understood.

“The reality is no organisation can turn a blind eye to GRC and underscoring frameworks such as King III.  GRC will in the near future form the fundamental of sound business practices.  Importantly, it dictates how organisations run sustainable practices that live in harmony with the environment and promotes good company culture,” comments Jayen Vyravene, CEO of Quency, a member of The Webcom Group.

And whilst King III is non-legislative, it already mirrors many of the principles of the Companies Act and provides a benchmark for all organisations to work from.

“Indeed, with the increasing emphasis on governance from a global perspective, stakeholders will consider sound and enforced GRC conformity a must when investing in your organisation.  Plus, as King III is based on the world’s best practices and methodologies such as CoBIT in IT governance, companies can rest assured that their efforts will be globally accepted and recognised,” says Glen Miller, CEO, The Webcom Group.

Currently, most South African organisations’ governance efforts operate in silos.  What this means is that the nine principles are King III are not being approached in an integrated manner.  Furthermore, companies’ governance maturity levels are relatively low.  With King III, however, they can greatly improve the GRC posture of their organisations.

“Integration is key and should be implemented by the board in an effective and efficient manner.  The fundamentals of King III should form an important part of your annual report enabling you to continuously benchmark your organisation with your peers,” comments Vyravene.

As with all challenges there lies opportunity; if organisations make a concerted effort to align their business model with King III and good GRC practices they will start reaping the rewards sooner than they expect.

So where to start?  A lot of companies are undoubtedly hesitant to embark on a GRC  strategy as they believe it will be prohibitively expensive, particularly from a technology point of view; time consuming and downright cumbersome.

“This need not be the case.  By taking a systematic approach to integration, GRC can become a reality.  Also, companies should take heart; it does not happen overnight which means change management can be implemented in a calculated fashion,” adds Miller.

First and foremost, asses your current GRC situation; are you already meeting some requirements or do you really have to start right at the beginning?

Secondly, create a roadmap that will outline your GRC strategy, challenges and resultant timeframes.  Also, and this is crucial, the roadmap should mirror your business objectives; governance should be one of the vehicles to realise it.

Explains Vyravene:”The implementation phase of the roadmap should start with an education campaign which reaches the board, executive, senior and line managers to ensure that if filters down to all staff; explaining and demonstrating the importance of GRC  and how it will create business opportunities in the future.  Communication is a must.

“Furthermore, the roadmap is a lengthy journey that should be monitored and managed on a continuous basis to ensure that the governance strategy is sound and on track. In this light, it would be prudent to appoint a dedicated governance and risk management expert that can steer a company’s GRC roadmap.  GRC should not be just another secondary job function; it should the individual’s primary focus that will ensure that the roadmap delivers and meet the business objectives.”

Technology will also be a part of your GRC efforts and play an integrated role in your roadmap.  “The good news is that in many instances the existing infrastructure will suffice; if anything governance will ensure that you derive even more value from your investment in technology,” says Miller.

Concludes Vyraven: “King III applies to organisations of all sizes and so does the roadmap approach.  Both will stand you in good stead in the coming years and ensure that all your operations are benchmarked against sound governance principles. The key is to start today; it is undoubtedly a lengthy process but will deliver results throughout not only at the very end.”