A GRC program needs "the right culture -- the right tone at the top" to succeed, according to Bob Tizio, governance, risk, and compliance officer for SAP Americas. Once that is in place, it is easier to get the necessary funding, people, and technology.