Tata Steel, GRC in ServiceNow

The Brief

Tata Steel's IT department was launching a governance, risk and compliance module in ServiceNow. I joined as a business analyst, placed through House of Talents, to work on the part that determines whether a platform like that succeeds or quietly fails: the data underneath it.

A compliance platform is only as good as its inputs. A system built on bad ones is worse than no system, because people act on it.

What I Delivered

The first phase was mapping. I went through the existing data flows across the IT divisions, which meant understanding each division's technical landscape, its constraints, and the risks already sitting in it, then setting that against the target landscape the organisation wanted to reach.

That is less a technical exercise than a conversational one. How data is collected, processed and stored is rarely documented accurately, and the real answer usually lives with the people doing it rather than in a diagram. I worked through it with stakeholders across the divisions, mapped a large number of flows, tested how reliable each was, and identified the gaps that would have to close before compliance could be claimed.

With the flows understood, I restructured them and applied methods that would hold up as the organisation grew rather than working only at the size it happened to be.

The second phase was compliance itself. Working with the compliance team, I assessed where the organisation actually stood, produced a gap analysis, and designed a plan to address what it found. The data collection processes were reworked and a staged route to full compliance was set out.

The third piece was visibility. I built a dashboard giving stakeholders at different levels a live view of compliance progress and operational performance, which meant reducing genuinely complicated data patterns into something a person could look at and act on immediately.

The Approach

The dashboard is the part people remember, and it was the least important. The value was in the mapping, because it established what was true before anyone built reporting on top of it.

Working across divisions also means accepting that each has its own view of the same data and its own reasons for that view. Reconciling those is most of the job. Doing it by imposing a model from outside produces agreement in the meeting and divergence afterwards.

Where It Stands

A six-month engagement through the first half of 2024. The flows were mapped and restructured, the gap analysis and compliance route were delivered, and the dashboard went into use. The department came out of it able to rely on data that was accurate, scalable and usable, which is what the GRC module needed in order to be worth having.