2014 GRC Technology Innovation Award: ngCompliance’s Sherlock Makes Regulatory Change and Policy Management ‘Elementary and Deductive’
The 2014 GRC Technology Innovation Awards was filled with competition. Nominations increased to 62 over last year’s awards, and fifteen winners were selected. GRC 20/20 looked through all of the submissions, asked for clarification where needed, and selected 15 recipients that demonstrated outside the box thinking in taking GRC in new directions to receive this year’s award.
ngCompliance’s Sherlock Makes Regulatory Change and Policy Management ‘Elementary and Deductive’
ngCompliance’s innovation is the ability to automate the analysis of regulatory changes against the organizations policies and procedures. The solution is called Sherlock and it makes regulatory change management and mapping elementary and deductive. Sherlock has a rule-mapping module that allows the organization to create a mapping between applicable laws and regulations on one hand, with the organizations policies, processes and procedures on the other hand. This mapping can be used to demonstrate whether the organization operates in line with regulatory requirements and it can disclose gaps. Whenever there is a regulatory change, it can be used to quickly identify the impact on business areas, policies and procedures and initiate a change management process to timely realign. Amazingly, the system does so cross lingual that allows the organizations to map and analyze policies written in other languages, for example Chinese against regulations written in English.
This automates what has historically been a manual process of cross-referencing policies to regulations within GRC solutions or within documents and spreadsheets to prove to regulators that all policies and procedures are in line with rules and regulations. ngCompliance’s innovation significantly reduces the manual work as initial mapping is generated by their Sherlock system. The mapping should be reviewed by subject matter experts, but it significantly reduces the work of building mappings manually.
Organizations that adopt this innovation, no longer need to allocate this task to a big workforce. This allows for reduced cost and time spent in administrative activities of compliance, regulatory change, and policy maintenance. Once Sherlock creates a mapping, it allows the user to evaluate the mapping and confirm correctness or make adjustments. Any time there is a regulatory change, the system submits to the user an impact analysis on which policies or steps in procedures are impacted. Because the user sees both the policy text as the related legislation or regulation changes, the user can immediately give the appropriate advice on the required changes and start necessary change management workflows.
As the regulatory mapping functionality can also be used to verify norms against contracts, the system can also be used to identify the most high risk contracts and pull those up, in combination with analytics analyzing the risk in third party relationships, it will alert on high risk third parties that need review and facilitate mitigating controls on the relationship (e.g. change management on the contract).
The system reads the regulation and analyzes the text. Based on text-analytics, definitions based on financial and legal terms are extracted from the article and converted into a tree representation. The same is done on paragraphs of policies and steps of procedures. Because they are converted back to a definitions structure it takes into account synonyms and differences in languages. A mapping engine compares the definition trees and builds appropriate connections between legislation/regulation text and policy/procedure text. When employees look at policies they are able to also see the related regulations. The context that is built during analysis of texts is used to make sure the connections match the contexts, e.g. articles applicable to organizations with a banking license are only shown once the process is within the organization of a bank.
Sherlock keeps track of all history that can be used to look back in time and verify alignment of organizational procedures with applicable legislation and regulation. In this way it is easy to demonstrate the level of compliance of the organization at any given moment in the past. Sherlock comes with a unique feature that can create the initial mapping from rules to internal policies and procedures, regardless of the number of jurisdictions it has to take into account or the number of languages it has to deal with. This way Sherlock contributes to a significant decrease of the organizations administrative burden.
The Sherlock solution allows for adding web locations that are used by regulators or other organizations that publish regulatory information, in addition to your normal regulatory feeds. The synchronization functionality ensures that the regulatory information stored in the database is always accurate without the need to maintain this manually. In addition, a historical trail on the regulatory developments is maintained. Any information that is found on the web and seems to be of relevance for Compliance can be included in the legal framework, either by means of the synchronization functionality or the quick-browse-and-add feature of Sherlock. When any regulatory change enters the legal framework in Sherlock, or when the legal framework detects a change from a regulator’s site it is monitoring, the solution will notify this to the user according to specified needs on the dashboard, in the task inbox, by email or compliance wiki. The solution can filter and sort on relevance, and can even distribute to different users based on jurisdiction, language, topic or expertise.
To learn more about the GRC 20/20 2014 GRC Innovation Awards and other recipients, please visit this post: GRC 20/20 Announces 2014 GRC Innovation Award Recipients