The document outlines the critical role of HR in developing a Governance, Risk, and Compliance (GRC) culture within organizations. It details HR's responsibilities in managing human capital, policy implementation, training, risk mitigation, and supporting leadership accountability, emphasizing the importance of an aligned organizational culture for long-term success. Additionally, it discusses the challenges faced in integrating GRC into HR practices and offers strategies to overcome them, highlighting HR's essential function in ensuring organizational integrity and compliance.

1. HR Roles in
Developing GRC
Culture:
A Strategic Approach to
Organizational Integrity
Seta A. Wicaksana
www.humanikaconsulting.com

2. Lead Consultant
SETA A. Wicaksana
Direktur Utama Humanika Institute
Business & Professional:
• Pendiri dan Direktur Humanika Consulting dan hipotest.com
• Dosen Tetap & Peneliti di Fakultas Psikologi UP
• Business Psychologist
• Wakil Ketua Asosiasi Psikologi Forensik Indonesia wilayah DKI Jakarta
• Anggota Komite Nominasi dan Remunerasi Dewan Komisaris ASKRINDO
Professional Certification:
• Certified of Assessor Talent Management
• Certified of Human Resources as Business Partner
• Certified of Risk Professional
• Certified of HR Audit
Pendidikan:
• Ilmu Ekonomi dan Management (MSDM) S3 Universitas Pancasila
• Fakultas Psikologi S1 & S2 Universitas Indonesia
• Sekolah Ikatan Dinas Akademi Sandi Negara

3. 10 Reasons for HR Plays A
Crucial Role in GRC
1. Human Capital Management
• People are the Core of GRC: Governance, Risk Management, and Compliance are
fundamentally about how people behave and adhere to rules and policies within an
organization. HR manages the workforce and is thus directly involved in shaping
and guiding employee behavior.
2. Policy Development and Implementation
• Creating and Enforcing Policies: HR is responsible for developing, implementing,
and enforcing policies that align with the organization's governance structure. This
includes codes of conduct, ethical guidelines, and other policies that ensure
compliance with legal and regulatory requirements.
3. Training and Awareness
• Educating Employees: HR plays a pivotal role in educating employees about the
importance of GRC through regular training programs. This ensures that all
employees are aware of the company’s governance policies, the risks they might
encounter, and the compliance standards they must follow.

4. 10 Reasons for HR Plays A
Crucial Role in GRC
4. Risk Mitigation
• Identifying and Managing HR-Related Risks: HR is in a unique position to identify
risks related to people, such as employee turnover, skill gaps, or workplace safety
issues. By managing these risks, HR contributes to the overall risk management
strategy of the organization.
5. Fostering a Culture of Integrity
• Shaping Organizational Culture: HR influences the organization's culture, which is
critical in promoting a GRC-oriented mindset. By fostering a culture of integrity,
transparency, and accountability, HR ensures that employees understand the
importance of following governance structures and compliance regulations.
6. Monitoring and Reporting
• Tracking Compliance and Governance: HR is often involved in monitoring
adherence to governance policies and compliance requirements. This includes
conducting audits, managing investigations, and reporting on compliance issues,
which are essential for maintaining organizational integrity.

5. 10 Reasons for HR Plays A
Crucial Role in GRC
7. Leadership and Accountability
• Supporting Leadership in GRC: HR supports leadership by
ensuring that executives and managers are aware of their
roles in GRC. This includes succession planning, leadership
development, and ensuring that those in power are
accountable for upholding the organization’s GRC framework.
8. Handling Disciplinary Actions
• Managing Non-Compliance: When employees breach
governance policies or compliance standards, HR is
responsible for managing disciplinary actions. This ensures
that there are consequences for non-compliance, reinforcing
the importance of GRC within the organization.

6. 10 Reasons for HR Plays A
Crucial Role in GRC
9. Collaborative Role
• Cross-Functional Collaboration: HR often works closely with other
departments like legal, finance, and IT to ensure that GRC practices
are integrated across the organization. This collaboration ensures a
holistic approach to GRC, covering all aspects of the business.
10. Enhancing Organizational Reputation
• Building Trust with Stakeholders: A strong GRC culture, supported
by HR, enhances the organization's reputation with customers,
investors, and regulators. It demonstrates the organization’s
commitment to ethical practices, risk management, and legal
compliance, which are critical for long-term success.

7. Overview of Human Resources
Management (HRM)
This is the specialist function of management which has prime
responsibility for:
• Formulating, proposing, and gaining acceptance for
personnel policies and strategies of the organization,
• Advising and guiding the organization’s managers on the
implementation of personnel policies and strategies
• Providing personnel services for the organizations to
facilitate the recruitment, motivation, and development of
sufficient and suitable employees at all levels,
• Advising the organization’s managers on the human
resources (HR) consequences of change.

8. Major Components of Human
Resources Management
• Human Resources Planning responsible for job
analysis and designing of organizational structures;
formulation of HR regulatory frameworks and many
more.
• Human resources Development (HRD) responsible
for analysis of knowledge and skills levels;
assessing the credibility of training programs and
institutions and many more,
• HRM services are responsible for implementing HR
regulatory frameworks including counselling.

9. Introduction to GRC
What is GRC?
• Governance: Ensuring organizational alignment with
corporate goals and ethics.
• Risk Management: Identifying, assessing, and mitigating
risks.
• Compliance: Adhering to laws, regulations, and internal
policies.

11. Importance of
GRC Culture
• Enhances organizational
integrity.
• Reduces risk of non-
compliance.
• Improves decision-making and
accountability.
• Protects the organization’s
reputation.

12. Human Resources
Governance
Governance is defined by Institute
of Internal Auditors as “The
combination of processes and
structures implemented by the
board to inform, direct, manage,
and monitor the activities of the
organization toward the
achievement of its objectives“.
In summary this means how the
organization is directed and
controlled to achieve its
objectives.

13. Human Resources
Direction
Services of HR will be directed by:
• HRM laws,
• HRM policies,
• HR Rules, Regulations and Procedures,
• HR Instructions and training,
• HRM plans and targets and many more
others.

14. Human Resources
Management Control
• The control is the implementation of the
provisions in the Direction and the spirit of
correcting divergences from the direction.
• This is done through the structures and
related distribution of authority and power
as defined in the regulatory framework of
the organization.
• Control environment has significant role to
play for the organization to realize its
maximum potential.

15. Control Model
There are several control models,
but the frequently used model is
COSO Control Model. This model
has five levels as follows:
1. Control environment
2. Risk assessment
3. Control activities
4. Information and
communication
5. Monitoring and evaluation

16. Why is Governance
Necessary in HRM?
1. For the Board and management to make strategic and
operational decisions
2. For the Board and management to oversee risk management
and control of the organization,
3. For promoting appropriate ethics and values within the
organization,
4. To ensure effective organizational performance
management and accountability
5. To promote communication of risks and control information
to appropriate areas of the organization,
6. To coordinate the activities of, and communication of
information among the Board, external and internal auditors,
other assurance providers, and management.

17. HR’s Role in
Governance
Developing and enforcing corporate
policies and ethics.
Facilitating communication and
alignment of corporate goals.
Supporting leadership development
and succession planning.
Creating a culture of accountability.

18. Human Resources Risk
Management
Risk
The possibility of an event occurring that will have an impact on the
achievement of objectives. Risk is measured in terms of impact
and likelihood.
Risk Management
A process to identify, assess, manage, and control potential events
or situations to provide reasonable assurance regarding the
achievement of the organization’s objectives.
Risk Appetite
The level of risk that an organization is willing to accept. This
assists in setting up minimum tolerable behaviors above which
disciplinary action can start.

19. Establishment of Any
Control in an Organization
• Well-defined objectives to
be pursued
• Well-assessed risks that
can impact the
achievement of the
defined objectives.
• Design controls that can
mitigate the risks to bring
them down to tolerable
levels.
Objective Setting
Risk
Assessment
Control Activities

20. Control in Organization
Take note that controls are set up to mitigate particular risks. In
this case, controls can never be established from vacuum.
Other factors to note are:
• Risk begins with a strategic and objective setting. This means
that an organization is in business to achieve particular
strategies and objectives and risks represent barriers to
successfully achieve those objectives.
• Risk does not represent a single point of estimate rather it
represents a range of possible outcomes.
• Risks may relate to preventing bad things from happening.
While many risks do present a threat to the organization, failure
to achieve positive outcomes may also a barrier to the
achievement of objectives is also a risk.
• Risks are inherent in all aspects of life.

21. What is Risk Management
Risk Management is the name given to a logical and
systematic method of identifying, analyzing, treating, and
monitoring the risks involved in any activity or process also is
referred to as:
• Good management practice
• Process steps that enable improvement in decision-
making
• A logical and systematic approach
• Identifying opportunities
• Avoiding or minimizing losses
treating and monitoring the risks involved in any activity o

22. Risk Management
process
• Establish the Context. The strategic and organizational context in
which risk management will take place, for example, the nature of your
business, the risks inherent in your business, and your priorities.
• Identify the risks. Defining types of risk, for instance, ‘Strategic’risks to
the goals and objectives of the organization. Identifying the
stakeholders, (i.e., who is involved or affected). Past events, future
developments.
• Analyze the risks. How likely is the risk event to happen? (Probability
and frequency?)What would be the impact, cost or consequences of
that event occurring? (Economic, political, social?)
• Evaluate the risks. Rank the risks according to management priorities,
by risk category, and rated by likelihood and possible cost or
consequence. Determine inherent levels of risk.
• Treat the risks. Develop and implement a plan with specific
countermeasures to address the identified risks.
• Monitor and review. In identifying, prioritizing and treating risks,
organizations make assumptions and decisions based on situations
that are subject to change, (e.g., the business environment, trading
patterns, or government policies).
• Communication & consultation. ‘Risk’ is dynamic and subject to constant
change, so the process requires continuous monitoring & review and
communication & consulting.

23. Treat The Risks
• Priorities (Strategic and operational)
• Resources (human, financial and technical)
• Risk acceptance, (i.e., low risks)
• Document your risk management plan and
describe the reasons behind selecting the risk
and for the treatment chosen.
• Record allocated responsibilities, monitoring or
evaluation processes, and assumptions on
residual risk.

24. HR’s Role in Risk
Management
• Identifying HR-related risks (e.g., talent
retention, labor relations).
• Developing risk mitigation strategies (e.g.,
training, contingency planning).
• Ensuring that employees understand and
comply with risk management policies.
• Monitoring and reporting on risk factors.

25. Compliance
Is defined as adherence to regulatory
framework to which the organization is subject.
Others define compliance as effective control
to achieve organization’s set strategies and
objectives for which the organization is set up
to attain and achieve.
Effective control is about:
• Establishing standards of performance,
• Measuring performance,
• Comparing actual results against standards
• Take corrective actions where required.

26. Effective Control
Comprise
• Directive controls to ensure that there is a
clear direction and drive towards achieving
stated objectives.
• Preventive controls to ensure the systems
work in the first place.
• Detective controls to pick up transactional
errors that have not been prevented.
• Corrective controls to ensure that where
problems are identified, they are properly
dealt with.

27. The Four Control Types
The four control types will assist HR to address four
other questions in performance and the questions are:
• How do we get the right culture and drive to ensure
these risks are appreciated and anticipated?
• How do we install specific measures to prevent the
risks that we now understand?
• How can we find out if despite our best efforts things
are still going wrong?
• How can we plan in advance to address problems
that we detect particularly when they represent
significant risk to our business?

28. Committed HR Manager
Any committed HR manager will not watch
and tolerate any issues of non-compliance
with any provisions of the organization.
It is for this reason that corrective controls
become the only sure way of bringing
situations back to normal or original state,.

29. HR’s Role in
Compliance
1. Ensuring employee adherence to laws and
regulations.
2. Conducting regular compliance training
and awareness programs.
3. Managing compliance audits and
investigations.
4. Implementing disciplinary actions for non-
compliance.

30. Integrating GRC into HR
Practices
1. Embedding GRC principles into
recruitment, onboarding, and
performance management.
2. Aligning HR policies with GRC objectives.
3. Promoting a culture of continuous
learning around GRC.
4. Collaborating with other departments to
ensure holistic GRC management.

31. Case Study
• Company X: How HR contributed to GRC
through employee engagement.
• Company Y: The role of HR in mitigating
compliance risks.

32. Challenges and Solutions
Challenges in Developing GRC Culture
Resistance to change.
Lack of awareness or understanding of GRC.
Integrating GRC into daily operations.
HR Solutions
Conducting regular training and workshops.
Communicating the importance of GRC.
Creating incentives for GRC adherence.

33. Conclusion
• HR is the most critical tool for converting resources into
outputs and outcomes.
• HR’s involvement in GRC is vital because it directly impacts
how governance policies are communicated, how risks are
managed, and how compliance is enforced across the
organization.
• HR’s pivotal role in fostering a strong GRC culture.
• The benefits of a proactive GRC approach.
• The long-term impact of GRC on organizational success.
• By playing a central role in these areas, HR helps to ensure
that the organization operates with integrity, reduces risks,
and adheres to all necessary regulations.

34. Learning and
Giving for
Better
Indonesia