Are your contracts in order? Your time, reputation, and revenue are at stake.

When organizations think about governance, risk, and compliance initiatives, managing contracts is not typically the first thing they think about.  However a contract is, by its nature, a governance tool that is designed to mitigate risk.

In a recent webinar, we explored the challenges and risks of poor contract management, and outlined best practices for effective contract administration that can be implemented by organizations of any size.  Watch the recording of our webinar for the full story, or keep reading to see the highlights!

Do any of these sound familiar?

Whether we are helping organizations manage contracts from the buy side (contracts with vendors or suppliers) or from the sell side (contracts with their customers), there are some common challenges that organizations face.  Do any of these sound familiar?

  • We waste a lot of time tracking down contracts when we need them.
  • Contracts have renewed automatically before we had a chance to renegotiate the terms.
  • We received an invoice for a service that we weren’t using, but the contract continued to auto-renew.
  • We have been in non-compliance with a client contract due to a lack of communication around non-standard terms.
  • Our company has multiple service providers for similar services, because we were not aware of all of our existing contracts.
  • It seems like we’re always wasting time trying to remember who has to approve what and when.

 

timemoneyreputation2

What’s at risk with poor contract management?

Managing contracts well is good business.  Poor contract administration wastes time, damages your reputation, and impacts your bottom line.

Simply put:  Your time, reputation and money are at risk.

 

Seven contract management best practices for any size organization

Good contract management involves people, processes and technology – and we’ve outlined seven best practices that require all three.  The best practices below can be implemented by companies of any size – and policyIQ’s GRC platform can provide the technology you need!

goodcontractmanagement

  1. Central Repository
    Identify or procure a central location that can be accessed by the right people at the right time.  Cloud-based solutions are a great choice, as they offer accessibility from any location on a 24/7 schedule.
  2. Define & Capture Meta Data
    Identify key data, and capture those details within your repository.  Expiration or renewal dates, contract value, contact information, and details about non-standard terms can all be critical data points that will feed into…
  3. Key Reports & Metrics
    Use that meta data to create key reports and metrics that drive your business decisions.  When evaluating contract administration systems, validate your ability to customize the data captured, as well as the flexibility of reporting on that data.
  4. Robust Search
    Your central repository should provide a robust search, so that you can find contracts by key word or phrase, searching through all contract documents.
  5. Identify Contract Owner (outside of procurement!)
    Most organizations identify a contract owner, but often the internal contact is not the business user of the product or service.  Clearly identify, and maintain, the contact person for every vendor or supplier contract – and ensure that the contact knows and understands how those products or services are being used.
  6. Alerts and Reminders
    Don’t miss a deadline or allow a contract to renew without notification.  Be sure that you can set up alerts – via email or regular reporting – to let the right individuals know when contracts are up for review.
  7. Clear Procedures
    All of the technology in world is only as good as the procedures that are designed to ensure that it is used properly.  Create procedures that instruct your employees on the who, what and where of contract management – and keep that documentation accessible.

 

policyIQ can help!

pIQ_CMBP

Would you like to improve your contract management process to decrease risk?  Contact us today, and we’ll be happy to help you lay out a plan for the people, process, and – our specialty – the technology you need!

Let’s talk about the elephant in the room: heavy GRC technology.

RGP’s policyIQ team is seeing a lot of movement in the governance, risk, and compliance (GRC) technology market. Organizations are complaining of complex tools that are difficult and time consuming to implement. Many have expressed frustration and regret after investing several months—years, even—and tens to hundreds of thousands of dollars into the implementation of GRC platforms only to find they were still not producing the promised benefits. They struggled with finding the right time to cut the cord. Others tell tales of the constant perks in the flashy sales and marketing process that ended in crickets after they signed the dotted line—there was very little support to help them make the application do what they expected it to do. Some companies got up and running in a tool and later found it was very cumbersome to manage as business needs evolved.

Are you wrestling with heavy, cumbersome GRC Technology?

Many compliance officers, auditors, controllers, and IT directors have stories about how long they have tried to hang on and make it work.

It’s time.

It’s okay to say it out loud. There are other options that are easy to configure and customize for your team’s specific needs that don’t break the bank. Clients have raved about the flexibility of policyIQ and their ability to make adjustments in just a few moments when the business, market, or regulatory bodies call for it. They have praised the speed of deployment of policyIQ and return on investment that they observed almost immediately through improved effectiveness in meeting their objectives.

We understand if you’re feeling a little skeptical…

…after what you’ve experienced. Let us show you! We offer a 30-day free trial and are happy to show you YOUR data in the trial site as proof of concept before you buy.  You can spend time kicking the tires, so to speak, and working with your implementation expert and the policyIQ Support team.

P.S. The policyIQ Support team will be by your side for the long haul! We enjoy reviewing our team’s interactions with clients—we are prepared to tackle your tough business questions, to help you expand or adjust as needed, and we can’t help but celebrate the friendships we make serving our clients over time.

We are excited to partner with you, too! Contact us to start your free trial.

1 in 3 do not have a plan!

The policyIQ team recently hosted a webinar presented by GRC analyst, Michael Rasmussen, focused on how to drive employee engagement through effective policy management and communication. During the session, we asked the audience: “Does your organization have a policy communication plan?” Remarkably, one in three respondents answered, “no”.

In recent posts, we have drawn attention to the potential hazards of NOT keeping your employees informed, trained, and certified. No doubt, some companies have learned a multi-million-dollar lesson on why it is important to build out a policy communication plan. In case your organization can relate to the third of respondents who identified with not having a formal plan, we want to share some ideas on how you can get started crafting your plan and reducing legal exposure right away.

What is the risk?

1 in 3 respondents reported not having a formal policy communication plan in place.

Are you having a hard time figuring out how to prioritize your policy updates? Consider, first, how your policies are related to your risk environment and what practices you must have in place to protect the organization from the top down. Next, you may wish to focus on the policies and procedures that you have in place to safeguard your organization: security policies and procedures. The next area in need of attention, depending on your type of organization, may be documentation related to ensuring that product, process, or service quality is delivered. If you have a quality system in place, you likely already have associated documentation on a regular cadence of review.

How will you know that all of these practices are actually taking place and operating as designed? You could also prioritize the documentation and routine practice of monitoring, from an operations and financial perspective. Auditing your business and finance functions will go a long way to provide assurance that you have the right practices in place.  

Can your organization provide evidence that your house is in order?

Who is the audience?

Retail store managers, truck drivers, accounting and finance personnel, nurses, IT project managers—there is a seemingly infinite list of roles in the pool of potential policy and procedure audience members. Rather than drafting policies and simply publishing them for broad access or distribution on the company’s intranet, you may want to take a step back and consider more closely, again, the level of risk associated with the documentation. Starting with your areas of greatest exposure, which of your employee roles would be impacted by the absence of the policy or documentation? Pay particular attention to those roles that are directly tied to your high-risk areas and critical controls.

How will you reach them?

The question, here, may be two-fold: What level of assurance does the situation demand? What media is most accessible to the audience?

Policies related to hours-of-service limits for truck drivers and anti-bribery policies for employees working in high-risk geographies may be among your top priorities as it relates to communicating your organization’s values and practices, but they certainly do not have the same work environment or access to information. An important step in your communication plan is the consideration of the level of assurance that the situation demands. Simply publishing some policies may be enough, but for others, it will be critical that you capture a receipt of your employees’ review, their attestation that they understand and agree to follow your policies, and some may warrant training and certification evidencing the employees’ understanding of the critical values and practices.

Can your training materials for efficient and repeatable distribution when possible, but be sure to bring employees in for training on values and practices that are mission critical.

If you want to better ensure engagement by your employees, you may also wish to consider whether the content requires live and in-person training or if delivery to your employees’ mobile devices will be satisfactory. Getting into the flow of what your employees do and see every day is the best way to boost the likelihood that they will see and interact with your content.

Next steps:

RGP’s own policyIQ is an easy to setup and use SaaS platform that can be leveraged to author, manage and share policies, procedures, links to training materials, certifications, and other related documentation on an employee’s device-of-choice. Click here to learn more about our policy management solution or reach out to us, directly! We are happy to help you see your data in a free policyIQ trial site.

And if all of this still feels like a lot to consider, you may wish to reduce your organization’s exposure sooner than later by bringing in a subject matter expert to spearhead the effort. RGP’s professional consultants can help to assess your organization’s documentation and lead the effort to map out and implement the execution of your policy management program and communication plan. Click here to be put in touch with an expert in your area.


Again, special thanks to GRC 20/20’s Michael Rasmussen for sharing his expertise with our audience (and us, too!). If you are interested in learning more from Mr. Rasmussen, we encourage you to check out his website and, specifically, his “Policy Management by Design” white paper.

What comes to mind when you hear “digital evidence”?

Who cares?

I mean, who actually has to care about digital evidence? Consider the audiences or different roles of people who need to produce or rely on digital evidence: management and business unit leaders; auditors; information management, technology, compliance, and security professionals; and the officers of your organization. We are producing unstructured data, much of it valuable, at a breakneck pace. Do you know who your producers of quality digital evidence are?

When I hear digital evidence, I think of the artifacts that may be considered digital evidence such as raw data, reports, signed documents, test results, specifications, and performance receipts. Documentation of activities that provide assurance, including procedures, work instructions, training sessions and materials, and attestations are also critical. Have you identified which practices and assurances are closest to your significant accounts, risks, and controls?

How do we wrap our arms around digital evidence?

There are systems and practices that provide the bookends for ensuring relevant and reliable results contributing to digital evidence such as systematic management and monitoring of workflow, milestones, deadlines, analyses, and remediations. Digital evidence also relies on the trail of bread crumbs that show who touched what and when including the audit trail of changes, versions, handoffs, and approvals. Without a central portal or system in place, it is plain to see, we cannot reliably manage digital evidence.

Are you taking advantage of all that policyIQ has to offer in these areas?

Alerts, dashboard notifications, and email generated systematically by RGP’s policyIQ helps employees know when work is required of them. The taxonomy of the digital content is configurable and can be subject to the information governance preferences of your organization with appropriate read, write, and approve rights established during initial configuration. policyIQ can provide an enforceable framework to manage contributions, the complete capture, monitoring, and reporting on critical documentation and evidence.

If your opportunity has more to do with the quality of your existing evidence or the need for corroborating evidence, RGP’s subject matter experts can help to assess your need and to fill any gaps identified. Right now—whether related to technology, process, quality, or completeness—make a note of some of those gaps or pain points that just crossed your mind. And then reach out to us: Information@policyIQ.com; 412-263-3330.

5 Simple Steps to GRC Technology Implementation

Whether for IT Security Compliance, Enterprise-wide Policy Management, Contract and Lease Administration, your organization’s GRC or Audit program, policyIQ can be up and running in 5 simple steps. Read on for more information and contact us to automate your initiative in Q1!

Step 1: Configuration
A policyIQ expert will assist you and/or your RGP Consultant to customize the design of the user interface in policyIQ for input of data, navigation, reporting, content and user security based on your input and feedback. Of course, we do not progress to step 2 until you, the client, approve of the configuration.

Step 2: Prepare data
RGP Consultant requests data from your team or organization, then scrubs provided data to help ensure completeness and accuracy. You give approval regarding the condition of the data before progressing to step 3.

5 Simple Steps to Go-Time!

Step 3: Populate
RGP Consultant populates approved data (import or authoring, depending on your needs) and subsequently validates the completeness of what is in the system to the approved data. The RGP Consultant will provide you with a walkthrough of your site and data for feedback and your approval.

Step 4: Refine (Reports, Dashboard, Planning for roll-out/training)
RGP Consultant demonstrates the policyIQ user interface using the populated data. You provide a live example of a transaction, and with your RGP Consultant’s side-by-side help, you drive the live example from input to reporting. Any additional configuration items identified during this process will be considered for further customization. You give the green light when you’re ready to go-live.

Step 5: Go live and train
Often there are a handful of “power users” who are expected to regularly participate in the process that is being automated using policyIQ. The RGP Consultant sits side-by-side with your power users, individually or as a group, to train on use of the software. Your power users will be directed to policyIQ’s written and recorded materials that you can leverage for your personalized procedural guide. Your RGP Consultant and the policyIQ support team are available onsite or remotely for any questions.

Our methodology your yours?
What initiatives or processes are you looking to digitize and manage more efficiently in 2019? Hit the ground running with RGP’s subject matter experts implementing our proven methodology in our technology or we can support your team to implement your methodology. What kind of support do you need? Contact us, information@policyIQ.com, and we’ll help you to get the ball rolling!

Suffering low morale and a disconnect between executives and those doing the work every day?


 

 

 

 

Art Weeast has helped a number of organizations to “think beyond the task of documenting policies and procedures to the intelligence of the information that is in those documents.” In other words, think of the value or purpose that the documents serve. One of his objectives, as he trains organizations on how to create valuable documentation, is to “keep what’s in it for me, from the end user’s or the employee’s perspective, in mind as you develop content”. The end user and all stakeholders might consider, “What problems and questions can this documentation solve?”

To demonstrate the application of Process Intelligence practices (as Mr. Weeast termed his work), consider three common problems:

  1. Employees and Management do not value the documentation (mainly the procedures).
  2. Work tasks are not clearly connected to executive priorities.
  3. Business Units/Departments/Functions do not collaborate on cross-functional processes, often leading to tension and decreased productivity.

With Art Weeast’s help, let’s tackle each of these problems one at a time.

The problem faced by many (maybe most) organizations: Employees and Management do not value the documentation.

Consider how you can make your documentation useful. Follow this three step process:

  1. Set a course to establish more comprehensive documentation. Rather than tracking just the steps of the procedure, frequency, who performs…think of all of the everyday business questions that come up related to the procedures. Add Roles and Responsibilities, Applications Used, Definitions, Procedure Input and Output–these fields will help you to address common problems. Read further to see how.
  2. Make it easy for process owners and your front-line doers to capture the documentation. You don’t have to complete the fields in consecutive order. Starting with the procedure, then considering what leads into the procedure and what the outcome of the procedure is before moving on to the purpose and other data is a much easier thought process.
  3. Make use of the intelligence that is inherent in your documentation to solve business problems. With updated, comprehensive procedures, you can address common problems…effectively and efficiently!

Put your information to work for you!

Another common problem: Work tasks are not clearly connected to executive priorities. 

The front line doers, on a day to day basis, do more repeatable processes than executives do. At the executive level, it is unlikely that you will see procedures. This is the root cause of the disconnect between the tasks and executive priorities. It’s no wonder that executives generally don’t feel the value of the documentation and therefore, the employees don’t feel the priority from the executives to create and maintain the documentation. So, per human nature, documentation becomes an unwelcome task to do, and usually it is tackled at the last minute with a mad rush to get it done.

The solution?

Help your organization to establish the connection between top priorities of the business and the tasks that hardworking employees carry out day after day.

A master at translating the complex into simple steps, Art Weeast developed a method for creating this connection. He calls it an Operational Map. To build your Operational Map you will:

  • Interview the Business Owner and document Primary Functions and Sub-functions from her perspective
  • Prepare List of Procedures for each Process Owner’s Area
  • Create a visual representation of Functions and their related Sub-functions
  • Map Procedures to related Sub-Function by playing “Operational Bingo” with Process Owners—you hold and call out the Procedures while she identifies the related Sub-function.
  • Validate the mapping with the Business Owner.

The result?

  • Executives come down to a level that they rarely visit—they better understand what it takes to get things done! They begin to appreciate the value—and the NECESSITY—of the documentation in a more highly regulated and complex world.
  • Process Owners (the everyday do-ers) appreciate the collaboration with executives. They sense the tone from the top and the priority becomes clear. The do-ers begin to understand the bigger picture—the risks that the organization faces and the importance of what they’re being asked to do. And they are very curious about what other departments do!

The final problem we aim to address: Breakdown in cross-functional processes.

Frustrations build in an organization when communication and collaboration breaks down or does not exist among certain parties. You can tell this is happening when you or others can easily blame someone for inadequate, inconsistent or untimely inputs into your process—or others who put disruptive demands on you to produce an output with a nearly impossible delivery date and provide inadequate information needed to meet the demand. It is natural for all of us to personalize the process under these circumstances.

The art of establishing collaboration among cross-functional parties can be reduced to four main steps. The following steps serve to “de-personalize” the process and issues, and allow parties to focus on the desired end result.

  1. Meeting: Bring functional representatives together for a collaborative process review mediated by a neutral party.
  2. Current state: Have them describe the standard process; first without the history, exceptions or problems. Then revisit the standard process with issues.
  3. Future state: What does it look like? How is it better?
  4. Transition state: Outline steps to get from where we are today to where we need to be.

Think about what’s happening here. Typically, if anyone ever does dare to address the communication breakdown among parties, what do they typically do? They work to identify the issue(s) and to problem solve against those issues. The process outlined by Mr. Weeast, an expert in operational and change management, takes an opposite approach; helping parties to very quickly begin working together effectively.

Applying these practices outlined by Art Weeast results in an efficient and effective organization that can:


Art Weeast has decades of impressive experience in enterprise-wide leadership, technology & data expertise, Lean Six Sigma methodologies, organizational change management, and in defining and refining operational processes. Art has been a client of policyIQ with three different organizations. When I met Art, I had been involved in the work of streamlining, refining, re-engineering, and automating processes for many years, myself, and—while it was my responsibility and mission to help him in any way that I could to solve his organization’s business problems using our software—I was forever changed by what he taught me!

This post was originally shared following a policyIQ-sponsored webinar in which Mr. Weeast shared his Process Intelligence practices. The policyIQ team continues to share the lessons of his Process Intelligence session year after year. If you’re interested in more information or hands-on support with applying Mr. Weeast’s methodology, reach out to us and we’ll connect you with the appropriate tools, information, and resources!

Support@policyIQ.com, 866.753.1231

A complete solution – presented in a policyIQ CPE event!

As part of our ongoing quarterly CPE event for policyIQ, we are putting together something a bit different – and bigger – than normal!

Join us on Thursday, November 30, 2017 at 12pm Eastern Time for the one hour CPE event presented via the web, showcasing policyIQ’s abilities, features and processes for all of your Policy Management needs.  Hosting this session will be Chris Burd, policyIQ Managing Director, and Travis Whalen, policyIQ Product Manager.  Learn more about policyIQ’s solution possibilities here.

In this Introduction to policyIQ CPE session, participants will be able to (among other milestones):

  • See how to utilize the import utility to centralize previously disparate content
  • Secure documentation with read, write and edit access – and approval processes
  • Apply search and reporting features to quickly gather information that is critical to decision-making

Sign up for this training here, and learn more about how policyIQ can be an effective solution for your organization’s Policy Management needs.

 

Our policies have been created…now what?

Many organizations have used policyIQ for their Policy Management needs, and each client of ours has their own unique needs and for providing transparent and accessible policies to their users, public website, auditors, or other audience type.  However, the process is largely the same, regardless of the unique needs.

In nearly all cases, the policy content is created in policyIQ, reviewed, approved, and then published.  Making that content available is where the differences come in to play.  There are a few options for doing so:

A shared, Read-only account:

Create a Read-only user account in your policyIQ site (which is free, by the way), and apply the Read-only account as a viewer only on all applicable pages in your site.  Be sure to make sure that this account also has view access to the necessary folders, as well.

Then, share the Read-only account credentials with your user base.  Once logged in, the policyIQ view this user will have is a scaled down look – just folders and policy content, in this case.  Because the very nature of the account is Read-only, there is minimal risk in sharing the credentials with a large group of people.

A shared, Read-only account accessed via policyIQ Reader:

A similar process to the one above, but with a different look to the program and no login needs.

After creating the Read-only user profile and applying the user to security where necessary, edit the user profile.  Under the “required” tab of the Edit User window, scroll to the bottom to find a unique link called “policyIQ Reader“.  This hyperlink can be placed anywhere you like: bookmarked in your browser, stored on your desktop, placed in a shared network drive, or even on your intranet.  Once a location is selected, anyone that clicks the link will gain instant, read-only access to your policyIQ site.  No login required, and the “reader” look – a straightforward, no nonsense look at content, which is displayed in the table area to the right instead of a separate window, as seen below.

pIQ_Reader

Individual Read-only accounts:

Create an individual Read-only account per-user, which allows for greater flexibility in terms of seeing policies that are applicable to certain divisions, but not others.  Perhaps your finance and accounting folks have policies and procedures that apply to them, but not to the vast majority of other employees.  Creating separate accounts for everyone ensures the user experience in the product is directly related to their role.

 Individual policies accessed from an outside source:

Some of our clients choose to have their policies accessed from their primary company website.  In this case, the policyIQ pass-through link is ideal: eliminate login needs, access individual policies, and don’t display the main policyIQ site from which the policies were created.  Instead, display only the pages themselves.

Create a primary Read-only user account, and again add it to the view security on all applicable pages.  Now, view a page of your choice that is published.  A the very bottom, the page ID sits, and contains a link.  Click the link to open a small window that contains the policyIQ Passthrough link .  Copy and paste this link to the destination of your choice.  Selecting this link from an outside source will open the policy page only, and not require a login to the system.

Next steps:

Did you know policyIQ also handles Policy Sign-offs, as well?  It’s a simple process at a minimal cost.  Add Standard Users to your site in bulk (50 to over 10,000+) to completely revamp the way your organization automates creating, approving and storing certifications and sign-offs.

Does something here sound like it might be right for you?  If so, let’s talk about it!  Scheduling a half hour with a policyIQ expert on our team is not only free of charge, but will pay dividends moving forward as the management of your processes becomes easier by the day.  Many adjustments to existing sites take minutes to change, and new sites are even simpler!  Contact us at Support@policyIQ.com or 412-263-3330 to begin.

 

ICYMI: Assessments and Scoping in policyIQ

Did you miss our recent training session on completing our SOX Risk Assessments and scoping exercises in policyIQ?  Not to worry – we have you covered!

How Can I Catch Up?

If you want to get into the details, we have the training session and materials available for download!

  • You can access the slides here.
  • You can also view the recording from our policyIQ training page.
    The training page is linked from your policyIQ login page – and available from within the online Help Guide.  If you don’t have access to the training page, please reach out and we’ll send you the link!

Just the Highlights, Please!

This training session aimed to ensure that participants are able to…

rascope1

We discussed common SOX risk assessments at the financial statement line item level, targeting risk factors like…

rascope3

In addition to illustrating how to create the calculation directly in policyIQ, we also acknowledged that some folks love their MS Excel process.  policyIQ can handle that, too, through the import option!

rascope4

Then we took a close look at the relationships between the content that allows for the most effective scoping options.

rascope2

And finally, we walked through the reports that provide the final step in the scoping process.

rascope5

We would love to help YOU get started on your risk assessments in policyIQ, so that we can link into your SOX work for ease of annual scoping.  Contact us today and we’ll meet with you at no cost to help you get on your way!