A World of Difference
Ted Frank and Brett Curran
The history of risk management and compliance in the financial services industry offers examples of companies that responded to certain risks in purely tactical ways. In many of these cases, the results were difficult for everyone - consumers were hurt, investors incurred losses, corporations lost brand equity and employees lost opportunities - and sometimes their jobs. Yet history tends to repeat itself and companies continue to respond tactically to compliance mandates and key risks. Why do so many companies lack a comprehensive, proactive strategy and operating plan for managing risk and compliance? While there are undoubtedly dozens of reasons, three seem to consistently rise above the rest. Analyzing and coming to terms with these three reasons can help transform an organization's efforts into much more sustainable and defensible risk/compliance programs.
Reason #1: "My area of risk is unique and warrants different treatment than all others."
One could easily argue that privacy is unique in the world of risk management. There are few areas of risk where the threats are changing as quickly. Whether it's the rapid advancement of technology attacks or the astounding increase in the sophistication of social engineering, it's hard to imagine many areas of risk with the same dynamic pace of continual change. Information is essential in the information economy and an inescapable component of corporate value. As a result, effective collection, protection and utilization of information are key components of business strategy.
Sounds like a case for stating privacy is unique, doesn't it? The answer is both yes and no. It's unique in that privacy is subject to one of the most rapid rates of change. It's unique in that it surrounds a broad corporate asset which is increasing in value at a breakneck pace. But these unique characteristics don't have much to do with underlying risk management principles or processes. If anything, these factors only increase the importance of building a defensible process and resisting a tactical response to individual circumstances. There are consistencies in the underlying process. Is there really that much difference among the processes for effectively managing financial reporting risk and the processes for managing privacy risk?
Take money laundering for example. When it comes to regulatory enforcement actions and building effective legal defenses, the U.S. government clearly takes the view that one process can be applied to different areas of risk/compliance across a matrix organization with central oversight. These entities use an enforcement standard - an Effective Compliance Program - developed and published by The United States Sentencing Commission. This standard is used, in combination with a degree of self-reporting, to determine penalties, jail time and fines. But the benefits of a strong, consistent and defensible process extend far beyond legal/regulatory defense into better operating efficiencies and a more agile, effective privacy risk management program.
Reason #2: "It's tough to get the budget necessary to address compliance proactively. It's much easier after things go wrong."
Developing a compelling business case has long been one of the biggest challenges facing those managing enterprise-wide risk or specific areas, such as privacy. The challenge is that many compliance specialists have yet to develop a compelling proactive business case. To achieve success, a clear and comprehensive strategy is required that incorporates quick wins to address the most pressing concern, privacy in this case, and begins to establish the fundamental processes and supporting technology that can be repeated across a variety of compliance requirements. Formulating a business case is tough for a number of reasons. First, few organizations have a handle on the actual direct cost of privacy compliance and all of its associated processes. Other hurdles include a grasp on the indirect costs associated with lost marketing opportunities, reputational damage and fear of being too aggressive in the marketplace.
The second business case challenge has more to do with context and demonstrating value. Privacy professionals are often challenged to simply get through the basic administrative components of their programs. As a result, they lack the time to work with other executives and determine how their programs can improve business and present new opportunities. Building a consistent, defensible process that, at a minimum, covers the downside is a first step toward creating the necessary time to focus on extending the process to address other risk areas.
Finally, a successful business case in most areas of risk management requires a plan that has simple, incremental steps toward a more comprehensive vision. Too few executives have experience with proactive risk/compliance projects, but they are looking for ways to say yes - which typically means incremental investment with measurable milestones.
Reason #3: "There are so many areas that need attention; it's often difficult to determine where to start."
If resources were readily available for investment, the question of where to target those resources is easily answered by the U.S. Supreme Court's Seven Elements of an Effective Compliance and Ethics Program. However, given resource realities in most situations, and barring a major direct or industry failure, securing this level of commitment is often difficult and pushes an Effective Compliance Program into more of a vision. Even so, there are many incremental steps that can be undertaken to move the organization forward. Depending on the circumstances and maturity of the program, any of the following make strong starting points and fit neatly into the constructs of an Effective Compliance Program:
- Privacy Inventory - Given the financial services industry's merger and acquisition activity, and the rapidly growing and exposed data stores from such initiatives as Web-based account management, customer portfolio analytics and increased integration of customer data across a financial services company and its partners, it is becoming increasingly important for organizations to implement specific processes for continuous identification of privacy risks. Through formal assessment processes, organizations can continually keep fresh inventories of what privacy-related information exists, who has access to the information and for what purposes. Only with this information can organizations map the risks and regulations that apply to financial services companies.
- Privacy Framework - Given the growth of regulations in the U.S. and the world, companies are constantly challenged to keep the multitude of mandates that apply to their organizations straight. In fact, in a February 2007 Gartner Research study, the firm forecasted that worldwide regulations focused on IT operations will double over the next five years. One can only assume that a good portion of this increase will directly relate to privacy. Starting with organizing frameworks such as the Generally Accepted Privacy Principles and Organization for Economic Co-operation and Development are a good way to start organizing your understanding of the privacy risks that apply to your business.
- Procedure/Control Design Assessment - Assuming an organization has mapped all operational and legal/regulatory risks, most then move to ensure that they have defined an appropriate set of procedures to control one or more risks. Often through a self assessment, organizations can effectively catalogue and evaluate the procedures that currently exist or need to be developed. Without these controls mapped to the organizing framework, it is extremely difficult to continually monitor and assess the performance of a privacy program. To keep the job manageable, many start by addressing specific regulations or groups of regulations such as the Bank Secrecy Act, Gramm-Leach-Bliley Act, Payment Card Industry/Data Security Standard and security breach notification. Once even one of these is implemented, the road map has been laid for easier rollout to others.
- Communication and Training - One of the most important components of the Effective Compliance Program is establishing effective communication. Clean, consistent and measurable communication through policies, procedures and training to the appropriate employees, brokers, agents and contractors is crucial. In addition, organizations must have an effective and managed mechanism for employees to seek guidance.
- Performance Assessment - In a recent survey conducted by the Open Compliance and Ethics Group and Axentis, 76 percent of privacy professionals indicated that assessing the performance of their own privacy program is an urgent concern. Given that 65 percent of these same respondents also indicated measurable increases in external privacy program scrutiny, it's no surprise that many organizations are sharply focused on ensuring this part of their program is functioning effectively.
- Incident Management (Corrective Action) - Most organizations have now recognized that a spreadsheet is no way to manage the response and remediation of issues, breaches and inquiries with respect to their privacy program. Organizations should have a process that is consistent, predictable and measurable. Having inconsistent remediation for similar incidents can create substantial liability, and metrics are critical for identifying systemic design and performance problems.
What all of these "places to start" have in common is that they tie directly to the Effective Compliance Program enforcement standard. Even acting on one of these items can have a significant impact and move the organization toward a defensible process. Tactical fixes such as hardware, perimeter protection and encryption are important, but not enough, given that the threats are multiplying exponentially. The question isn't "will a breach or failure occur," but "when an inevitable breach or failure occurs, will we be able to demonstrate a defensible process." Better to begin the process now. Along the way, the process may even change the posture of privacy from one of cost to one of value.
Ted Frank is the President of Axentis. He can be reached at
tfrank@axentis.com.
Brett Curran is Director of GRC and Privacy Practices at Axentis. He may be reached at
bcurran@axentis.com.
About Axentis:
Axentis delivers an on-demand business performance optimization environment that empowers companies to turn governance, risk and compliance (GRC) initiatives into better business performance and competitive advantage. With its unique, industry only software-as-a-service (SaaS) model, Axentis Enterprise (Ae) Suite delivers a one-world view of the entire organization for better risk management, mitigation and compliance.
Comments
If you want to comment on this post, you need to login.