Compliance Resilience Managing Compliance in Highly Regulated Industries

INTRODUCTION

If there’s one challenge that highly regulated industries like banking and financial services, energy, and healthcare have in common, it’s the growing volume and velocity of regulatory requirements they must adhere to. Regulations are evolving so fast that many compliance departments can’t keep up. 

At the same time, risks are growing more interconnected. Climate and sustainability reporting pressures are increasing. Ethical concerns around new technologies like AI are on the rise. And cybersecurity and third-party related risks continue to escalate. 

Sustaining compliance in the midst of all these shifts requires resilience and agility. When you’re agile in your risk and compliance management approach, you can proactively anticipate and respond to compliance changes that impact your organization. And when you’re resilient, you can rapidly recover from compliance failures or issues. 

This eBook delves deeper into compliance agility and resilience as the essential ingredients of a successful compliance program, and the cornerstones of a strong and trust-worthy business. With inputs from a recent MetricStream webinar on Compliance Resilience: Managing Compliance in Highly Regulated Industries, we take a look at why agility and resilience matter more today than ever before – and how to embed them in your compliance program.

Thriving in Turbulent Times: The Importance of Building Resilience in Compliance Processes

Today’s compliance officers find themselves navigating a tumultuous world with changes unfolding at multiple levels.

• Changes in regulation: Across countries, the regulatory landscape is constantly evolving. New laws are being proposed and introduced, even as existing regulations are altered. As an example, environmental, social, and governance (ESG) regulations alone have increased by 155% over the past decade. As per the Thomson Reuters’ annual Cost of Compliance Report, organizations across 190 countries reported an average of 246 new regulatory alerts each business day. 
• Changes in enforcement: Even if a regulation doesn’t change, its enforcement often does. For example, the US Foreign Corrupt Practices Act (FCPA) saw only a handful of cases filed in the first 2-3 decades of its existence. But in 2009-10, over 50 individuals were charged, and nearly $2 billion was collected in criminal fines. In 2016, the Securities and Exchange Commission (SEC) issued more FCPA enforcement actions than in any previous calendar year. This demonstrates that companies can’t afford to be complacent about compliance. 
• Changes in people: Third parties bring in a host of compliance risks that require regular monitoring. Even employees are constantly entering and leaving the organization. If they aren’t updated on the latest policies or procedures, non-compliance issues could fast arise.
• Changes in business: The modern organization isn’t a static entity. Its processes are continuously evolving, as are its strategies, processes, teams, and technologies. With each of these changes, comes compliance risk. For example, a business acquiring a new company might also unwittingly acquire its cybersecurity issues. Or, it could end up inheriting multiple legacy tools, as well as hundreds of redundant policies, procedures, and controls.
• Changes in the risk landscape: A decade ago, the biggest global risks were economic-related. But today, eight of the top ten risks are either environmental or societal risks. Cyber-attacks also continue to be a top business risk. Compounding the challenge, the scope of each risk has increased. For example, technology risks aren’t just limited to employees bringing their own devices to the workplace. One also has to worry about smart printer security breaches, biases in AI-enabled hiring practices, and more.

To sum up, our world is in a constant state of flux. Even if we have the most qualified compliance team, and know the ins and outs of a regulation, that doesn’t mean we’re compliant. What matters is how we respond to changes or disruptions – how quickly we adapt compliance controls when a process evolves, or how well we train employees on a new policy, or how soon we bounce back from a compliance failure. In other words, what matters is compliance agility and resilience.

From Reactive and Fragmented to Adaptable and Resilient: How Compliance Approaches Are Shifting

Compliance risk and agility are essentially two sides of the same coin. Agility is about pre-empting change – such as an emerging compliance risk or a new regulation – and then proactively implementing controls or policies to manage that change. Resilience is about having pre-defined measures and processes in place to recover rapidly from a compliance issue. Together, both these qualities enable organizations to navigate disruptions smoothly, respond faster to changes, and protect business interests. 

To build compliance resilience and agility, it’s important to move away from siloed compliance programs where data is often scattered across spreadsheets and emails, hampering visibility. Teams spend weeks manually gathering and consolidating compliance risk events, issues, and incidents into reports. As a result, management doesn’t get a complete picture of compliance until much later when the organization’s risks and issues have already changed.

By contrast, a technology-driven compliance program can help companies manage and monitor compliance much quicker and more effectively with capabilities like:

• AI-powered regulatory horizon scanning that proactively detects regulatory changes, and notifies stakeholders 
• Streamlined compliance inventory management that maps compliance requirements to controls, processes and business units in a many-to-many manner, thereby minimizing redundancies in control testing 
• Automated compliance risk management that speeds up the end-to-end process of assessing, monitoring, and mitigating compliance risks

Tools like these make it easier for companies to build compliance agility and resilience in a chaotic, changing business environment.

Mastering Compliance in Highly-Regulated Industries

Industries like healthcare, energy, and financial services are often entrusted with critical responsibilities such as public health, financial security, and environmental protection. As a result, these industries are also subject to rigorous regulation and oversight which make it all the more important for them to foster compliance agility and resilience.

• Banking and financial services: Financial services organizations are faced with a plethora of regulations, including the United States’ Dodd-Frank Act, Sarbanes-Oxley Act (SOX), California Consumer Privacy Act (CCPA), the EU’s Digital Operational Resilience Act (DORA), and the UK’s Financial Services and Markets Act (FSMA). Regulatory scrutiny is increasing not just in traditional areas such as fraud and financial crime, but also in newer areas such as sustainability and cryptocurrencies. This coupled with industry developments such as the rise of open banking, Payments 4.X, and fintech collaboration, are pushing banks to pivot and adapt their compliance strategies. Instead of merely reacting to regulatory changes, many banks are becoming more proactive about compliance monitoring, Others are using machine learning to identify potential compliance risks before they escalate. Measures like these will become more important in the months to come.
• Healthcare and life sciences: From the United States’ Health Insurance Portability and Accountability Act (HIPAA), to the Health Information Technology for Economic and Clinical Health Act (HITECH), to the EU’s Medical Device Regulation (MDR), compliance requirements in the healthcare and life industries are rapidly evolving. So also are cybersecurity risks – healthcare was one of the top 3 most attacked industries in 2022. Compliance professionals have a significant role to play in mitigating these issues. That means improving how compliance is managed – be it by streamlining the way patient data is collected and reported, or enabling real-time tracking and reporting of patient safety incidents.
• Energy and utilities: The energy crisis in Europe, coupled with extreme climate events worldwide have greatly tested the resilience of the energy and utilities industry. ESG pressures have also increased, as global energy-related emissions touch new highs. Meanwhile, memories of the Colonial Pipeline ransomware attack are still fresh in people’s minds. To top things off, there are multiple compliance requirements – be it the United States’ North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) standards, or the Federal Energy Regulatory Commission (FERC) regulations, or the EU’s Energy Efficiency Directive. Compliance teams have their task cut out for them, as they shore up compliance controls and cybersecurity defenses, while meeting new ESG reporting obligations. Building a resilient and agile compliance program will be essential in protecting and creating value

The Benefits of an Agile and Resilient Compliance Program

6 Steps to Improve Compliance Agility and Resilience

Keeping up with changes in regulations, risks, business operations, and markets can seem like a formidable challenge at first. But with a few practical steps, you can adapt to changes quickly, and boost resilience.

• Create an effective compliance strategy: A compliance strategy gives you a clear roadmap for how to navigate a complex regulatory landscape. Start by defining your compliance goals and priorities. Perhaps you want to minimize compliance penalties. Or, improve customer trust. Or, reduce the costs of regulatory exams by being audit-ready, always. Whatever your goals, make sure they’re aligned with business objectives.    
  
  Next, identify which regulations apply to your business based on your organizational size, industry, geographic locations, customer reach, and business model. Based on these requirements, you can set up control frameworks and policies, as well as risk and compliance assessment mechanisms. At every stage, define clear compliance roles and responsibilities, so that everyone understands exactly what’s expected of them.
• Build a unified view of compliance: A key way to build compliance resilience is to ensure that the right people have access to the right compliance information at the right time. That’s hard to achieve when your data is scattered across silos. But if it’s consolidated on a centralized platform, then stakeholders can easily see what your compliance objectives are, what risks impact those objectives, what controls are in place to mitigate those risks, if any of those controls are failing, what issues and cases remain open, who’s responsible for remediating them, who’s the subject matter expert on a particular risk, and more. 
  
  The same applies to policies. Instead of having your security policies, work-from-home policies, and anti-harassment policies buried in multiple different systems, consolidate them all in a centralized policy portal where they can easily be found and read by the people who need them. Having all your compliance information in one place gives you a deeper understanding of your compliance and risk universe. Then, you can apply controls more accurately, and respond to changes in an agile manner.
• Recognize the interconnections and discrepancies: Compliance risks don’t exist in isolation. A data breach, for example, doesn’t just violate the General Data Protection Regulation (GDPR) – it also impacts reputations, operations, business continuity, and profitability. The faster we understand these relationships and dependencies, the sooner we can mitigate the underlying risks. Consider mapping your compliance and enterprise risks in a single data model. This way, no matter where a risk is coming from, you can spot the interconnections.For instance, you might notice that an emerging third-party issue is also an IT compliance risk. 
  
  Or that a health and safety risk like COVID-19 can also disrupt supply chains, increase cybersecurity vulnerabilities, and change consumer behaviors. 
  
  Interconnections don’t exist between risks alone. There’s so much distributed compliance data – complaints, control assessments, policy attestations, training programs, hotline data, cases, issues, and reports – and that’s just within the organization. Outside it, there are regulatory alerts, compliance guidelines, ESG scores, supplier risk ratings, sanctions, watchlists, and more – all of which need to be connected. 
  
  The key is to aggregate and map together these different data points in one framework. So, if for instance, a regulation changes or a compliance issue occurs, you can instantly determine how it will impact the organization, which business units will be affected, which policies and controls need to change, and what actions need to be taken to protect the business.
• Enable continuous monitoring: The era of periodic compliance or risk assessments is over. In a dynamic world, we have to be able to continuously scan the horizon for changes in industry practices, regulations, sanctions, risks, geopolitics, ESG standards, market demands, and technologies – all of which impact compliance. This kind of monitoring can be simplified with regulatory change tracking technologies, or automated feeds from trusted content sources. 
  
  Sometimes, a regulatory change might not initially apply to your business – but monitoring and getting ahead of it can help you be more agile. For example, even if you’re a US-based company that doesn’t do business in California, you might still want to monitor developments with the California Privacy Rights Act (CPRA) because it could set the tone for other privacy regulations across the United States. Proactive regulatory horizon scanning can help you be better prepared for regulations before they arrive. 
  
  We also need to be prepared for the changes that occur within the organization. That means monitoring how strategies, processes, teams, and operations are evolving; how those shifts impact compliance risks; whether policies and training programs need to be updated; and what controls need to be put in place. These continuous assessments can help you strengthen resilience in the face of change.
• Automate and integrate: Compliance demands have become so immense that managing them manually is simply not effective. With automation, you can generate reports in hours, if not minutes. Data on compliance risks and cases can be made available at the click of a button to executives and the board. Issues can be instantly triaged and classified, with automated recommendations indicating the best action plans. 
  
  It also helps to integrate compliance management systems with other enterprise systems. For example, integration with HR tools helps ensure that when a new employee enters the organization, they automatically receive an email on the policies and compliance training programs that are relevant to their role. This way, the compliance team saves time, and also ensures that employees are up-to-date on policies.
• Apply AI to fast-track compliance: AI-enabled technologies can help you simplify compliance even further. Let’s say there’s a new regulation. AI can automatically uncover similarities between that regulation and your existing compliance requirements. It can determine where the two overlap, if the language is similar, and if the same teams and processes are impacted. In addition, AI can recommend updates to policies, training programs, and controls. So, you can roll out changes faster, enhancing agility

How MetricStream Can Help

MetricStream’s Compliance Management product suite with Compliance Management, Regulatory Change Management, and Regulatory Engagement Management help you boost compliance resilience and agility by streamlining and automating your compliance processes. 

With MetricStream, you can integrate and map all your regulations, risks, policies, controls, processes, and other data elements in a single source of truth for optimal visibility. In addition, regulatory changes are automatically captured, stored, and monitored. Compliance issues are intelligently classified and tracked through AI-powered tools. And real-time compliance insights delivered through powerful dashboards and reports help you strengthen agility and resilience.

Use MetricStream to:

Conclusion

As regulatory scrutiny increases, the importance of compliance resilience and agility will only grow. Both qualities are essential in building trust, stability, and credibility, particularly in highly-regulated industries. 

Agility empowers companies to navigate compliance changes with ease and efficiency. It’s the ability to see what’s coming at you, and to be prepared. Resilience enables organizations to absorb compliance failures with minimal damage, ensuring business continuity and stakeholder confidence. 

That said, compliance can only be agile and resilient when it’s integrated into every level of the organization i.e., when every employee knows the regulations that apply to their work and understands their responsibilities for compliance. Senior managers lead the way by expressing their commitment to compliance policies, encouraging honest feedback, and rewarding compliant behavior. Employees, in turn, must feel comfortable raising compliance issues, reporting violations, and acting in line with organizational policies. This culture of compliance lays the groundwork for agility and resilience – both of which create a powerful advantage that helps organizations thrive in the midst of adversity, and reach greater success.