Analysis of the Implementation of Governance, Risk, and Compliance (GRC) in Supporting Information Technology Governance at Bank Pembangunan Daerah Kalimantan Barat

Abstract

This study analyzes how Governance, Risk, and Compliance (GRC) is implemented in supporting information technology (IT) governance at Bank Pembangunan Daerah Kalimantan Barat (Bank Kalbar), and how IT utilization supports the implementation of IT GRC. A qualitative approach with a descriptive method was used. Primary data were obtained through in-depth interviews with the Head of the Information Technology Division and an IT GRC staff member, selected through purposive sampling, and were complemented by the Bank's 2025 Annual Report and Governance Report and relevant regulations of the Financial Services Authority (OJK). Data were analyzed through data reduction, data display, and conclusion drawing and verification. The findings show that GRC is implemented through IT policies and procedures, risk identification, assessment, prioritization, control, and monitoring, compliance with regulator requirements and internal SOPs, and IT audits with follow-up. IT in turn supports IT GRC through access control, change management, backup and recovery, security monitoring, IT general and application controls tested through TDE and TOE, and the Digital Resilience Center. Constraints include limited IT development budgets, numerous unit requests, third-party delays, and the time required for audit follow-up. The findings indicate that IT GRC is a continuous process that requires priority setting, vendor monitoring, and follow-up tracking.