RFP-GRC Vs ERM-FINAL
RFP-GRC Vs ERM-FINAL
This document outlines a topic of interest to The IIARF. Proposals should present the approach you
would take to meet the requirements as stated in this Request for Proposal. Proposals should not exceed
five pages exclusive of the appendices described below, and should contain the following basic elements:
Page | 1
Request for Proposal
TOPIC INFORMATION
Governance Risk and Control (GRC): What is it?
Priority Topic
How is it different than Enterprise Risk Management (ERM)?
Topic Description GRC and ERM are “hot topics” since the enactment of Sarbanes-Oxley in
2002 and the roll-out of the Committee of Sponsoring Organizations of the
Treadway Committee (COSO) ERM framework. But different organizations
(and professional associations) have defined and implemented GRC and
ERM differently.
Product Type The Research Foundation is seeking an applied research report, based on
survey (40-80 pages)
Purpose and The purpose of this study is to assist enterprise oversight function(s) and
Objectives internal auditing in defining and clarifying the state of their GRC and/or
ERM implementation. The common, or “generally accepted,” components of
GRC and ERM need to be identified and put in context relative to each other.
Content Guidelines The research will address the following questions:
The IIA Research 1. What are the common elements of GRC frameworks globally? What are
Foundation (IIARF) the variations? What is internal auditing’s role?
aims to expand
knowledge and the 2. What are the common elements of ERM frameworks globally? What are
practice of internal the variations? What is internal auditing’s role?
auditing by providing
relevant research and
educational products
that help us to
understand, shape,
and advance the
global profession.
Proposals with a
global scope are
encouraged and will
receive preferred
review status. The
participation of
internal audit
practitioner(s) on the
research team will be
a plus.
Target Audience The target audience for this report is chief audit executives, GRC function(s),
ERM function(s), and board-level committee(s).
Page | 2
Request for Proposal
Timeframe Six to nine months. The research will begin immediately upon approval of
contract.
Deliverables [X] The primary deliverable is an applied research report of 40 to 80 pages.
[X] An article suitable for Internal Auditor, other IIA publications, and/or
The IIARF web site.
[ ] An academic article.(researcher discretion)
[X] A PowerPoint presentation summarizing the major findings and
conclusions of the research. May be 10-20 slides for use at meetings,
conferences, etc.
References What GRC Could Mean to Your Organization, Tone at the Top, The Institute
of Internal Auditors, August 2010
Page | 3