Ouch!

Few companies have a good handle on the wide range of policies and processes that are intended to manage risk and compliance. That's because they approach the functions separately, tacking them on top of the business rather than embedding them into the business.

The result is a prickly tangle of controls and practices buried inside functional or geographic silos with hundreds-or even thousands-of isolated activities. This approach creates bewildering complexity and duplication, even as it leaves major gaps uncovered and fails to deliver the desired results.

A manager can get requests from compliance one day and from internal auditors, legal counsel, or regulators the next-each seeking essentially the same information in slightly different forms. And if that weren't bad enough...