Opentech
Delivering True GRC Control to SMEs

Typically, internal controls are the mechanisms, rules, and procedures implemented by a company to ensure the integrity of their financial and accounting information, promote accountability, and prevent fraud. And while these processes were successfully performed using excel spreadsheets in the past, today, internal controls are much broader, nuanced, and complex than their yesteryear counterparts. In fact, the process has become more rigorous than ever, leading internal auditors and others in charge of managing internal controls to rely on tech-driven solutions. From an auditing perspective, what was once focused only on an organisation's internal controls has now become stringent and holistic, with the auditing spectrum expanding to consider external threats such as cyber-attacks and data breaches as well.

At the same time, with Industry 4.0 in full swing, the rising IT complexities within businesses are also causing hindrances in the management of internal controls. As a way to overcome this hurdle, firms started deploying governance, risk, and compliance (GRC) solutions capable of helping businesses manage IT and security risks, reduce costs and meet compliance requirements with better, data-driven decision-making. However, as threats continue to evolve, organisations are forced to deploy multiple expensive GRC solutions to cope with rising risks. But most small and medium-sized enterprises (SME) lack the resources to augment their GRC implementations at pace with the increasing risks. This is, in turn, hindering the efficient management of their internal controls, which in the current era of evolving regulations and cyber threats is a business-critical challenge.

Addressing this challenge with its fully integrated, modular GRC solution suite that helps businesses in efficiently managing their corporate governance and internal control functions is Italy-based Opentech. The company specialises in delivering professional services to its clients, which are backed by Opentech's team of experts that have firsthand experience in managing internal control systems in many leading organisations.

A Modular Approach to Mitigating Complexity

Elaborating on his company's role in the GRC arena, Elvezio Camerata, partner at Opentech, says, "Opentech has always focused its attention and commitment to the GRC space, which enables us to deliver solutions in partnership with universities and leading companies in the realms of technology, consulting, and training." Concurrently, Camerata adds the significance of its strong emphasis on R&D, which is perfectly illustrated with Opentech's decision to invest more than 20 percent of its annual revenue into the development of newer features and capabilities for its portfolio. This innovation-driven culture has enabled Opentech to carve a unique place in several markets, including banking, insurance, public administration, and more.

Opentech's GO GRC suite currently comprises several software solutions, including GO Governance, GO Risk, GO Compliance with AML Tool, GO Audit, GO Organization, GO Data Protection, GO Business Continuity, GO Complaints, GO Litigation, GO Safety, and GO OdV.

Every module within the company's solution is designed based on the open compliance and ethics group's (OCEG) conceptual model and is integrated to enable users to seamlessly activate the modules they need on an ad-hoc basis and build a complete and effective governance and control system. "Unlike conventional GRC offerings that require complex integrations and expensive upgrades to deliver holistic risk management, GO is built to enable users to simply and cost-effectively gain end-to-end control of their governance processes," states Camerata. Apart from the functional completeness it offers, GO gathers data on activities, evidence, and contributions in a common repository, which can be leveraged by internal control function teams and third parties.

Delivering Round-the-Clock Compliance and Security

According to Luca Rossi, head of technical direction at Opentech, GO is designed to be a web-based, multi-device, multi-language solution that can be implemented on-prem or on the cloud, based on user needs. Furthermore, the solution suite has pre-built integrations with Microsoft products like Active Directory, Word, Excel, Outlook, Visio, and more, which makes it easier for users to generate highly customisable reports on internal control functions and risk management tasks. "With GO, clients can gain a better understanding of their user needs, minimise time for maintenance and customisations, and rapidly resolve arising problems, all while abiding to the strictest international standards," explains Rossi.

Other key benefits of leveraging Opentech's suite include the utilisation of the solution's data repository and regularly updated dashboards, which drive enhancement of the decisional, operational, and monitoring processes of a client's internal control functions. On the other hand, Opentech also offers its services through its software development team's ISO27001 standardised and certified approach that guarantees confidentiality, integrity, availability of data, and unparalleled security. Additionally, Opentech relies on Microsoft Azure and IBM computing for its cloud services, which are two solutions that boast the highest levels of security, reliability, and conformity. "Our ISO certified status and usage of cloud environments known for their unmatched security showcases our commitment to delivering highly secure and always compliant solutions," adds Rossi.

A Proven Track Record of Customer Excellence

With respect to the market need that Opentech's GO suite satisfies, Agostino Carta, product manager at Opentech, elaborates how most of his company's clients serve highly regulated markets and need a GRC framework that enables them to smoothly traverse disruptive regulatory or risk-related developments. The company bridges this gap for its clients with its GO suite, which is essentially based on a repository of regulations, processes, policies, risks, controls, reports, documents, and more that can be shared internally throughout an organisation or between partner firms across different users. As a result, the execution of day-to-day activities is simplified owing to enhanced collaboration among conventionally siloed groups. Moreover, GO can also handle a regulatory framework integrated with the main information sources of the latest compliance developments via automated update flows that minimise duplication and human error.

To sum it up, Carta remarks, "Having a unified taxonomy of business processes, risks, and controls with common metrics and unique organisational model streamlines the activities of internal control functions while also opening the doors to leveraging different, emerging methodologies."

Highlighting the impacts of Opentech's GO suite is a success story where the company helped a large digital payments customer, Nexi Group, consolidate the management of their compliance and privacy controls. In this instance, Opentech implemented the fully integrated modules of the GO suite that shared the same information sources from a common repository. This allowed the client to create common execution practices for internal auditing tasks as a way to aid both compliance and privacy personnel. These officers were also provided automatically generated checklists to track the progress of tests performed by their auditor. Once the checklist was completed and validated, GO also evaluated control measures and risks while detecting issues and proposing corrective actions. After reaping the benefits of Opentech's compliance and privacy modules, Nexi Group then demanded the company's communications module, which can generate alerts, track news, send internal regulations to potential stakeholders, and support reporting tasks with regulatory entities. Subsequently, the client seamlessly integrated their trusted information provider with the GO implementation to ensure they are always in lockstep with the latest regulations and sanctions. "The privacy solution we provided to Nexi Group was built to automate their data processing register and allow the recording of data breaches, which supported users in managing their security and privacy by design and build a better, more secure environment," asserts Carta.

Enabling Next-Gen Functionalities

Delving deeper into the technological aspects of GO, Elena Gorgoni, legal and compliance officer at Opentech, notes that GO is built as a repository that allows users to set several automatic rules based on their needs, which enables effective guidance in enhancing internal control functions through minimal human intervention. Similarly, the suite's data model is based on a common vocabulary that allows easy comparison and consolidation of data regardless of the time and source. Lastly, Elena adds GO's ability to optimise the consolidated data, thereby facilitating quick and easy detection of aggregation patterns during data analysis. "The data is also fed into an advanced reporting system that has out-of-the-box reports and dashboards to aid operating and directional users in leveraging modern business intelligence and data analytics tools," states Elena.

Moving forward, Opentech aims to maintain its leadership position in the banking and insurance markets and incorporate more innovative features into its portfolio. More specifically, the company plans to expand its footprint in the SME market and help more businesses establish robust and highly efficient GRC processes. From a solution standpoint, Opentech is currently focused on refining its upcoming GO ESG (environmental, social, and governance) solution, which is built with a vision to ultimately integrate with the company's other offerings to offer a truly holistic GRC system to its clients as they face uncertain future trends.