Category: Blogs

Spreadsheets are the most prevalent GRC tool used by organizations. Their use, particularly in reporting, leads to the inevitability of failure. 

Consider one organization that was spending 200 hours building a report for the board on risk events that have happened. All the information was trapped in spreadsheets that they had to aggregate, tabulate, and build this report from. Every year 200 hours (it now takes them a minute). The last year they did it this way, they found out they had risk issues that started eleven months back. That is not managing risk; that is reacting to it well after the fact. 

Another example is a . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE ANSARADA BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]

Below is Michael Rasmussen’s article in The IRM Global Risk Trends 2023 report , published by the Institute of Risk Management (The IRM).

The complexity of business combined with the intricacy and interconnectedness of risk and objectives necessitates that the organization implements a strategic approach to business and operational risk and resiliencein 2023.

Gone are the years of simplicity in business operations. Exponential growth and change in risks, regulations,globalization, distributed operations, competitive velocity, technology, and business data encumber organizations ofall sizes.

Keeping changes to business strategy, operations, and processes in sync is a significant challenge forboards and executives, as well as management professionals throughout all levels of the business in 2023 andbeyond.

The interconnectedness of objectives, risks, resilience, and integrity require 360° contextual awareness of risk and resiliency. Organizations need to see the intricate relationships and impacts of objectives, risks,processes, and controls. It requires holistic visibility and intelligence into risk and resiliency.

The ecosystem of business objectives, uncertainty/risk, and integrity is complex, interconnected, and requires a holistic contextual awareness of the organization – rather than adissociated collection of risk management processes anddepartments.

Change in one area has cascading effects that impacts theentire ecosystem.

This interconnectedness of business is driving demand for360° contextual awareness in the organization’s risk management processes in 2023 to reliably achieve objectives, address uncertainty, and act with integrity.

Organizations need to see the intricate intersection of objectives, risks, and boundaries across the business.

Organizations in 2023 are Focusing on the Following Five Areas in Their GRC Management Strategies:

1. Agility. The last few years global uncertainties, geo-political tensions with a war in Ukraine, and the impact on business operations and supply chains. Organizations are now turning their attention to being agile in risk in 2023. To see what is coming at the organization in the next six months, years, or two years and go through scenarios and prepare the organization for uncertainty to take the best path forward. Risk agility is lookingahead and preparing the organization.
2. Resilience. This is where many organizations have been focused, but still working on improving. Agility allows us tonavigate our environment and see what is coming at us. Resilience is the ability to recover from a risk event and minimize the impact on the organisation. Risk agility and risk resilience are very symbiotic and play off each other, both have become essential to risk management programs in 2023.
3. Integrity. With a global focus on ESG risk management programs will shift from laying the groundwork for ESG inorganization structures and reporting to operationalizing ESG within the organisation. At the end of the day, ESG is about the integrity of the business. What the organization communicates are its values, ethics, and commitments . . . is this being done? Risk management plays a critical role in navigating uncertainty to ensurethe integrity of the organization in the era of ESG in 2023.
4. Accountability. There is a growing focus on board and executive-level accountability in 2022 that will extend and grow in 2023.Accountability regimes have expanded around the world – UK, Ireland, Australia, Hong Kong, Singapore, and nowSouth Africa. There is a growing focus in the USA with the Department of Justice and SEC on greater accountability for risk and compliance. There are US state-level accountability focus on New York and California.Most recently, Uber’s former CISO was held personally accountable for a security breach.
5. Engagement. Risk is not taken and managed in the back-office of risk management. Risk happens throughout the business at alllevels of the organization. This requires that organizations in 2023 focus on risk culture, risk awareness, and proper risk management skills from the front-line up through operational management to executives and the board. Good risk management engages all levels of the organization. It is time for organizations to take another read through the IRM Risk Culture: Resources for Practitioners as they enter 2023.

What is clear, organizations need complete 360° situational awareness and visibility into risks in 2023. Business operates in a world of chaos, and even a small event can cascade, develop, and influence what ends up being a significant issue. Dissociated siloed approaches to risk management that do not span processes and systems can leave the organization with fragments of truth that fail to see the big picture across the enterprise, as well as how it impacts their strategy and objectives.

The organization needs visibility into risk. Complexity of business and intricacy, as well as the interconnectedness of risk data, requires that the organization implement an enterprise view of risk monitoring, automation, andenforcement.

Successful risk management in 2023 requires the organization to provide an integrated strategy, process,information, and technology architecture. The goal is comprehensive straight forward insight into risk andresilience management to identify, analyze, manage, and monitor risk in context of operations, processes, and services.

It requires the ability to continuously monitor changing contexts and capture changes in the organization’s risk profile from internal and external events as they occur that can impact objectives.

---

Michael Rasmussen is a Global Ambassador of Risk Management and Honorary Life Member of the IRM and an internationally recognized pundit on governance, risk management and compliance

The Organization: an Interconnected Web of Relationships

No man is an island, entire of itself; Every man is a piece of the continent, a part of the main.

English Poet John Donne’s Devotions Upon Emergent Conditions (1624) found in the section Meditation XVII.

Substitute ‘man’ with ‘organization’ and seventeenth-century English poet John Donne could be describing the post-modern twenty-first century organization: no organization is an island unto itself, every organization is a piece of the broader whole.

The structure and reality of business today has changed. Traditional brick-and-mortar business is a thing of the past; physical buildings and conventional employees no longer define the organization. Instead, the modern organization is an interconnected web of relationships, interactions, and transactions that extend far beyond traditional business boundaries and nest themselves in layers of relationship complexity. Even the smallest organization can have dozens of relationships that they depend on for goods, services, processes, and transactions. In large organizations, this can expand to tens of thousands of third-party relationships with suppliers, vendors, partners, and service providers.

With businesses increasingly relying on a complex network of third-party relationships to thrive, the governance, risk management, and compliance (GRC) of third-party relationships is critical. Without effective governance of the extended enterprise, organizations will fail to manage uncertainty, avoid disruptions, act with integrity, and achieve business objectives. 

In a dynamic risk environment, resiliency requires agility and the ability to navigate uncertainty in business relationships. Effectively mitigating the exposure of potentially disruptive events requires real-time and comprehensive risk intelligence across risk domains with insights to both assess the current and future risk landscape and drive sagacious action. 

The Inevitability of Failure: Fragmented Views of Third-Party Risk

Too often, organizations struggle to adequately govern their third-party relationships because of their reliance on outdated practices with limited to know risk intelligence. Recent technological advances in automation, natural language processing, machine learning, and data science enable organizations to be more effective and do more with fewer resources. Unfortunately, too many organizations have failed to seize the opportunity to evolve beyond expensive and inefficient legacy solutions.    

Failure in third-party risk management comes about when organizations rely on outdated risk practices with limited to no risk intelligence, including: 

• Silos of third-party oversight. Silos of oversight occur when an organization allows different business functions to conduct third-party oversight without coordination, collaboration, and an agile information and intelligence architecture. The risk posed by a third party for one business function may seem immaterial but is significant when factored into multiple risk exposures across all the business functions monitoring other risks of the same third-party. Without a single pane of risk intelligence visibility into the risk in their third-party relationships, silos leave the organization blind to risk exposures that are material when aggregated introducing more risk.
• Limited resources to handle growing risk and regulatory concerns. Organizations are facing a barrage of increasing regulatory requirements and an ever-expanding risk landscape. While risk functions are operating with limited budgets and human teams, they need to do more with less. Truly effective continuous risk intelligence monitoring of today’s dynamic and ever-expanding risk landscape is beyond human capabilities alone and requires Cognitive GRC technologies that leverage artificial intelligence such as natural language processing, machine learning, predictive analytics, and robotic process automation. 
• Overreliance on manual processes. When organizations govern third-party relationships in a maze of documents, spreadsheets, emails, and file shares, it is easy for risks to be missed amidst the extensive volume of data and lack of integrated risk intelligence content. In addition, when things go wrong, these manual processes neither support agility nor a robust feedback loop to improve processes going forward.
• Limited view of risk vectors. Organizations often rely solely on third-party financial and cyber risk management and suffer from risk exposure in domains such as compliance, operations, ESG, location and Nth party risk exposure. To fully understand the complete risk picture, an organization needs to have full-spectrum risk coverage of risk intelligence content.
• Scattered third-party risk solutions. When different parts of the organization use different third-party risk solutions, silos of risk data and intelligence are created that are difficult to assimilate, thus making it difficult to maintain, aggregate and provide comprehensive, accurate, and current third-party analysis. The resulting redundancies and inefficiencies make organizations less agile and impact the effectiveness of third-party risk programs. 
• Overreliance on Periodic Assessments. For many organizations, third-party risk analysis occurs primarily during the onboarding process at the onset of the business relationship with only periodic re-assessment of risk over the length of the engagement. This approach fails to keep organizations informed in a timely manner when the risk exposure changes between assessments. Without a continuous source of real-time risk intelligence feeds, the organization lacks the ongoing situational awareness necessary for proactive risk mitigation.  
• Silos of risk intelligence services overwhelm risk teams. Risk intelligence has the potential to overwhelm organizations. Information feeds from various sources such as legal, regulatory updates, newsletters, websites, emails, journals, blogs, tweets, and content aggregators can drown the risk team as they struggle to monitor a growing array of regulations, legislation, corporate ratings, geopolitical risk, and enforcement actions. Risk intelligence that requires weeding through an exorbitant volume of notifications that includes noise and false positives to identify relevant risks only compounds the problem. One needs an intelligent system that can deliver accurate and actionable insights and remove the noise.

When the organization approaches third party risk management in scattered silos that do not collaborate with each other, there is no possibility to be intelligent about third party performance, risk management, compliance, and impact on the organization and ESG. Without a coordinated third-party risk intelligence strategy, the organization and its various departments never see the big picture. 

The bottom line: The modern business is dependent on third-party relationships and requires real-time and continuous awareness of its current and future risk landscape. A manual and point-in-time approach to third-party risk intelligence compounds the problem and can lead to elevated risk exposure and blind spots. It is time for organizations to step back and move from legacy practices, defined by manual processes, periodic assessments, and silos of risk intelligence content to a third-party risk intelligence solution that includes integrated full-spectrum real-time feeds of situational awareness of the organization’s extended enterprise. 

---

GRC 20/20 has the following upcoming Third-Party Risk Management by Design Workshops in the next few months that dives deep into this topic of a holistic view of third-party risk . . .

Chicago: March 30 @ 12:00 pm – 6:00 pm CDT 

• Third-Party Risk Management by Design Workshop, Chicago

New York: April 25 @ 12:00 pm – 6:00 pm EDT 

• Third-Party Risk Management by Design Workshop, New York

San Francisco: May 2 @ 12:00 pm – 6:00 pm PDT 

• Third-Party Risk Management by Design Workshop, San Francisco

Houston: May 4 @ 12:00 pm – 6:00 pm CDT 

• Third-Party Risk Management by Design Workshop, Houston

Tsunami of Change Overwhelms Compliance

Managing and keeping up with change is one of the greatest challenges for financial services organizations in the context of compliance management. The dynamic and interconnected nature of regulatory change and how it impacts the organization are driving strategies to mature and improve regulatory change and compliance management as a defined process. The goal is to make regulatory change management more efficient, effective, and agile as part of an integrated compliance management strategy within the organization.

The challenge is the compounding effect of change. Organizations have change bearing down on them from all directions. It is continuous, dynamic, and disruptive. Consider the scope of change financial services organizations have to keep in sync:

• External risk environments. External risks – such as market, geopolitical, societal, competitive, industry, and technological forces – are constantly shifting in nature, impact, frequency, scope, and velocity. 
• Internal business environments. The financial services organization must stay on top of changing business environments that introduce a range of operational risks, such as changes in employees, processes, relationships, mergers & acquisitions, strategy, and technology. Any of these changes can take an organization from a state of compliance to non-compliance in its processes, controls, and people.
• Regulatory environments. Regulatory environments governing financial services organizations are a constantly shifting sea of requirements at local, regional, and international levels. The turbulence of thousands of changing laws, regulations, enforcement actions, administrative decisions, rulemakingactivities, and more has organizations struggling to stay afloat. 

Managing change across risk, business, and regulatory environments is challenging. Each of these vortexes of change is hard to monitor and manage individually, let alone managing how they impact each other. Organizations can devote human and financial capital resources to keeping up with regulatory change, but that does not make them compliant if that change is not consistent and in sync with business and risk change. Change in economic or market risk bears down on the organization as it impacts regulatory oversight and requirements. Internal processes, people, and technology      continuously change and regulatory requirements need to be understood in context of business change. As these internal processes, systems, and employees change, this impacts regulatory compliance and risk posture. 

Change is an intricate machine of chaotic gears and movements. Keeping current and aligned with change is one of the greatest challenges to compliance management strategies within organizations.

Compliance Overwhelming the Organization

Compliance management, and in this context regulatory change management, is overwhelming organizations. Financial services firms are past the point of treading water as they actively drown in regulatory change from the turbulent waves of laws, regulations, enforcement actions, administrative decisions, and more around the world. Regulatory compliance and reporting are a moving target as organizations are bombarded with thousands of new regulations, changes to existing regulations, enforcement actions, and more each year. Regulatory change impacts the organization as it reacts to:

• Frequency of change. In the past five years, the number of regulatory changes has tripled while the typical organization has not increased staff or updated processes to manage regulatory change.
• Regulatory contexts. Regulatory change is not limited to one jurisdiction but is a turbulent sea of change across the country and around the world. Regulations have a global impact on organizations and markets. Inconsistency across regulations from jurisdiction to jurisdiction brings complexity to regulatory compliance. 
• Inconsistency in regulations. Managing compliance and keeping up with regulatory change, exams, and incident/complaint reporting requirements becomes complicated when faced with requirements. Regulatory jurisdictions have varying approaches and requirements. There are often conflicting challenges in regulations and other laws impacting organizations across jurisdictions.
• Expansion into new markets. It has become complex for organizations to remain in different markets as well as enter new markets. The pressure to expand operations and services is significant as the organization seeks to grow revenue and be competitive, but     at the same time they are being constrained by the turbulent sea of changing regulations and requirements.
• Focus on risk assessment. Regulatory compliance is increasingly pushed to integrate with broader enterprise and operational risk strategies with a focus on delivering specific assessment of compliance risks. For example, regulators in the US seek to ensure that compliance officers do compliance risk assessments. This is also a theme picked up on by law enforcement agencies like the U.S. Department of Justice (DoJ) and the Securities and Exchange Commission (SEC). The courts, with the United States Sentencing Commission, also evaluate the culpability of an organization on compliance based on compliance risk.
• Hoard of regulatory information. Organizations are overwhelmed by information from legal alerts, regulatory updates, newsletters, websites, emails, journals, blogs, tweets, and content aggregators. Compliance and legal roles struggle to monitor a growing array of regulations, legislation, regulator findings/rulings, and enforcement actions. The volume and redundancy of information adds to the problem. Managing regulatory change requires weeding through an array of redundant change notifications and getting the right information to the right person to determine the business impact of regulatory change and appropriate response. Organizations must search for the marrow of regulatory details and transform it into actionable intelligence, which can be acted upon in a measurable and consistent manner.
• Defensible compliance. Regulators across industries are requiring that compliance is not just well documented but is operationally effective. This can be seen in the latest DoJ Evaluation of Compliance Program guidance.^[1] Case in point, Morgan Stanley was praised by regulators as a model compliance program and was the first company in 35 years of the Foreign Corrupt Practices Acts (FCPA) history to not be prosecuted despite bribery and corruption in their Asian real estate business. One of the points the Securities and Exchange Commission (SEC) and Department of Justice (DoJ) referenced was Morgan Stanley’s ability to keep compliance current amid regulatory change: “Morgan Stanley’s internal policies . . .were updated regularly to reflect regulatory developments and specific risks.”^[2]

Broken Process and Insufficient Resources to Manage Compliance

The typical financial services organization does not have adequate processes or resources in place to monitor regulatory change and manage compliance in a dynamic environment. Organizations struggle to be intelligent about regulatory developments and fail to prioritize and revise policies and take actionable steps to be proactive. Instead, most financial services organizations end up firefighting, trying to keep the flames of regulatory change controlled. This handicaps the organization that operates in an environment under siege by an ever-changing regulatory and legal landscape. New regulations, pending legislation, changes to existing rules, and even enforcement actions involving other financial services organizations can have a significant impact. 

Organizations that GRC 20/20 has interviewed in the context of compliance management reference the following challenges to processes and resources:

• Insufficient head count and subject matter expertise. Regulatory change has tripled in the past five years. The effort to identify all the applicable changes related to laws and regulation is time consuming, and organizations are understaffed. Most have not added FTEs or changed their processes despite the continued increase in regulatory change.
• Frequency of change and number of information sources overwhelms. The frequency of updatesfrom the regulators themselves is challenging but then comes the flood of updates from aggregators, experts, law firms, and more. Organizations often subscribe to and utilize multiple sources of regulatory intelligence^[3]. Going through each source to identify what is relevant takes time and effort.       
• Limited workflow and task management. Organizations rely on manual processes that lack accountability and follow-through. It’s not possible to verify who reviewed a change, what actions need to be taken, or if the task was transferred to someone else. This environment produces a lack of visibility into ongoing compliance — the organization has no idea of who is reviewing what and suffers from an inability to track what actions were taken, let alone which items are “closed.” Compliance documentation is scattered across      documents, spreadsheets, and emails in different versions. 
• Lack of an audit trail/system of record. The manual and document-centric approach to regulatory change lacks defensible audit/accountability trails that regulators require. These leads to issues with regulators and auditors when they find there is no accountability and integrity in compliance records interms of who reviewed what change and what action was decided upon. The lack of an audit trail is prone to deception; individuals can fabricate or mislead about their actions to cover a trail, hide their ignorance, or otherwise get themselves out of trouble. 
• Limited reporting. Manual and ad hoc regulatory change processes do not deliver intelligence. Analyzing and reporting across hundreds to thousands of scattered documents takes time and is prone to error. This approach lacks overall information architecture and thus provides no ability to report on the number of changes, who is responsible for reviewing them, the status of business impact analysis, and courses of action. Trying to make sense of data collected in manual processes and thousands of documents and emails is a nightmare.
• Wasted resources and spending. Silos of ad hoc regulatory change monitoring led to wasted resources and hidden costs. Instead of determining how resources can be leveraged to manage regulatory change efficiently and effectively, the different parts of the organization go in different directions with no system of accountability and transparency. The organization ends up with inefficient, ineffective, and unmanageable processes and resources, unable to respond to regulatory change. The added cost and complexity of maintaining multiple processes and systems that are insufficient to produce consistent results wastes time and resources and creates excessive and unnecessary burdens across the organization.
• Misaligned business and regulatory agility. Regulatory change without a common process supported by an information architecture that facilitates collaboration and accountability lacks agility. Change is frequent and coming from all directions. When information is trapped in scattered documents and emails, the organization is crippled. It lacks a full perspective of regulatory change and business intelligence. The organization is spinning so many compliance plates that it struggles with inefficiency. The organization cannot adequately prioritize and tackle the most important and relevant issues to make informed decisions.
• No accountability and structure. Ultimately, this means there is no accountability for regulatory change that is strategically coordinated: the process fails to be agile, effective, and efficient in the use of resources. Accountability is critical in a regulatory change process — organizations need to know who the subject matter experts (SMEs) are, what has changed, who changes are assigned to, what the priorities are, what the risks are, what needs to be done, whether it is overdue, and the results of the change analysis.

The bottom line: Processes for managing compliance and regulatory change often constitute a myriad of subject matter experts that monitor regulatory change on an ad-hoc basis and rely on email to communicate compliance tasks to stakeholders. Manual processes and a lack of accountability result in an inability to adequately monitor regulatory changes and predict the readiness of the organization to meet new requirements. Compliance professionals spend significant time and resources researching the mandates they must follow and struggle to keep up with new requirements and identify how changing regulations impact existing policies. A haphazard, siloed, and document-centric approach to managing regulatory change results in missed requirements, wasted time, and accelerated costs. It is time for organizations to step back and implement a structured process and technology for compliance management. 

---

^[1]       https://www.justice.gov/criminal-fraud/page/file/937501/download

^[2]       Source of this statement is at: http://www.justice.gov/opa/pr/2012/April/12-crm-534.html

^[3]       Such as legal databases, regulator feeds and news, trade associations, enforcement actions, court rulings, administrative decisions

The modern organization is a complex array of transactions, processes, and relationships.

This is challenging to manage within a single jurisdiction, but becomes even more complex, bridging on the word chaotic, when the organization deals with an interconnected mess of subsidiaries, divisions, relationships, and cross-border transactions.

Even a small organization faces a complex web of transactions that span geographic and jurisdictional boundaries as money is moved, services rendered, and products are produced. Complexity grows as these interconnected transactions and processes nest themselves in intricacy.

In this context, organizations operating . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE IMPERO BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]

GRC 20/20’s Michael Rasmussen will be speaking on the blog below in an ESG context on the webinar: Policy & Training Management: A Foundation of a Successful ESG Program

From time to time, people ask why policies matter. The answer, at its most basic, is that when an organization fails to establish strong policies, the organization quickly becomes something it never intended.

Good policies define the organization’s governance posture, corporate culture, behavioral boundaries, and objectives. 

Without the guidance provided by well-written and effectively managed policies, corporate culture may morph and take the organization down unintended paths. Policies are critical to managing risk; every policy is a risk document that aims to control behavior-related risks.

The longer answer is a bit more complicated . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE EKKO/LEARNING ZONE BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]

GRC 20/20’s Michael Rasmussen will be speaking on the blog below in an ESG context on the webinar: Policy & Training Management: A Foundation of a Successful ESG Program

The scenarios of ethical and compliance exposure across business operations and frontline employees are unlimited. Some involve malicious employees, others could be inadvertent mistakes, while some scenarios involve activity that employees should catch and report. 

The most significant exposures to ethics and compliance issues are not in the bowels of the organization, they are at the front lines. The organization must effectively engage employees and educate them about compliance and policies in the context of their role in the organization. 

Compliance is an (extended enterprise) engagement challenge

The challenge is that organizations need to find a way to get everyone involved and adhering to policies to build integrity across the whole organization and the extended enterprise. 

Compliance communications, attestations, and disclosure matter. However, when you look at the typical organization you would think policies and compliance processes are irrelevant and a nuisance . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE EKKO/LEARNING ZONE BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]

Last week I had an amazing week of GRC interactions, or G[P]RC with the P being performance), in the Middle East. I was the keynote at the G[P]RC Summit in Riyadh and in Dubai. I am also interacting on a few RFP development projects in the Middle East as well. The Middle East is the fastest growing market for GRC related solutions and services.

However, the busiest market is the United Kingdom and Europe. I am busier with interactions in the United Kingdom and Europe than I am in North America. I could rattle off a dozen RFPs in various stages of engagement right now. London and the broader United Kingdom is my busiest region, followed by the DACH region of Europe. After that it is the Nordics and Benelux regions. The next few months has me on a trip to the United Kingdom, then Australia, followed by two separate trips to Germany in March.

The United Kingdom is my busiest city for engagement in the entire world. I have spent more time in London for GRC than any other city. I am now preparing for my next GRC trip to London for the week of February 12th to 19th.

What brings me to London in February? . . . I am glad you asked . . .

It is a whirlwind of a week of engagements. A few are with solution and service providers helping them with their solution and go to market strategy, but most my interactions are with organizations looking for solutions and services to address a range of challenges in risk and compliance they are facing.

The heart of the week is co-hosting a RegTech/FinTech Networking Event with ING as well as working with the Institute of Risk Management in London to build out a strategy of engagement in my role as one of their Global Ambassadors of Risk Management.

It will be a great week of interactions which all feed into my research on the GRC market. I describe what I do as an analyst in the context that I am a researcher. I research what the challenges organizations face in the context of governance, risk management, and compliance and how do organizations solve these challenges through the combination of strategy, process, and technology/services.

The leading topics for my meetings/engagements this week are as follows:

• Germany’s Corporation Supply Chain Due Diligence Act. Yes, I am in London and one of the hottest topics of conversation is Germany’s law and the related EU Directive. I have several interactions in the United Kingdom right now where this is driving a lot of change to ESG and the intersection of third-party risk management programs.
• UK SOX. After several years of speculation and discussion UK SOX is here and a hot topic of engagement. Starring with financial years ending December of this year (2023) organizations in the UK are facing requirements for internal controls over financial reporting and disclosures inline with US Sarbanes Oxley. So a lot of organizations are now scrambling to address this.
• Operational Resilience. The UK FCA/BoE/PRA regulation has the entire financial services industry restructuring their operational risk and continuity programs to address these requirements. Last year, March 2022, saw a lot of this come to maturity but organizations are looking for technology and services to make this sustainable. Related to this is addressing the EU DORA (digital operational resilience act) as they intersect for firms operating in Europe.
• Consumer Duty. This is the trending hot topic in the financial services space in the United Kingdom. Organizations have to set high and clear standards of consumer protection across financial services, and this requires firms to put their customers’ needs first. This is driving a lot of policy and training management and engagement as the foundation and from there a lot of assessment and controls.
• UK SMCR. The United Kingdom’s Senior Managers/Certification Regime also ties into several discussions. Sometimes intersecting with the same conversations/engagements on resilience and consumer duty. But organizations are looking to make UK SMCR more sustainable as many have approached the first few years of compliance with manual processes they now are finding cumbersome.
• ESG. This ties into all the above and more. A lot of interactions on how to manage and report on ESG through all of its complexities and niches. Last April, the UK passed two mandatory ESG disclosure laws: The Companies (Strategic Report) (Climate-related Financial Disclosure) Regulations 2022 and The Limited Liability Partnerships (Climate-related Financial Disclosure) Regulations 2022. UK companies that have more than 500 employees have to do ESG reporting.
• Regulatory Change Management. I have a few interactions with both financial services and life science companies in the United Kingdom to discuss cognitive technologies to keep up with regulatory change management, and with that policies.

Those are the main points of interaction. Tied to some of these include UK Modern Slavery Act, UK Bribery Act, and the UK Data Protection Act as well as EU GDPR.

As you can see it is a fascinating week of engagements across these. The schedule is filling up . . .

Integrity is everything to an organization. If I could rebrand the Chief Ethics and Compliance Officer (CECO) I would call it the Chief Integrity Officer, but we already have a CIO in the Chief Information Officer. Ethics and compliance done correctly is the bastion of corporate integrity and corporate ethical culture. That is what compliance and ethics truly is all about.

Too often compliance is not seen in this perspective. Compliance is approached tactically as a series of checkboxes. If we check the boxes, we want our get out of jail free card. It is a tactical approach and not strategic. Alternatively, compliance is done as an afterthought or is seen as the corporate police that is always getting in the way. This leads to greater compliance exposure as compliance and ethics is not seen as a core part of how we do business and the way we do business. Too often it is approached with smoke and mirrors with a focus on the bare minimum to get by or creating an outright fictitious compliance environment.

When it comes to compliance breaches and incidents, too often organizations fail to grasp the full financial impact of non-compliance. In my research and experience, you can break the cost of a compliance incident/breach into the following three areas (with others that I have not measured) . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE CLAUSEMATCH BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]

In today’s ever-changing economy, mortgage lenders and service providers face a growing number of regulations and risks in compliance. This opens up an opportunity for organizations to rearchitect their compliance processes and leverage automation to remain competitive in this uncertain environment.

—

Mortgage lenders and service providers, as a segment of the financial services industry, face a lot of change. The mortgage space right now is a tough one and interest rates are only going up. Firms are writing fewer loans, whether it’s a new loan or a refinance. The market is shifting and drying up for the foreseeable future of the next year or two. The industry is changing and reacting to uncertainty in the economy. Mortgage companies’ internal processes and employees are . . .

[THE REST OF THIS ARTICLE CAN BE FOUND ON THE ASCENT BLOG WHERE GRC 20/20’S MICHAEL RASMUSSEN IS A GUEST AUTHOR]