Why Compliance Matters in Both Good and Bad Times

INTRODUCTION

When you’re swimming out at sea, and the waves get rough, you know it’s time to head back to the shore. But even when the water is calm, there could be a fatal riptide or hungry predator lurking beneath the surface. That’s why it’s so important for swimmers to be vigilant all the time. 

Compliance, too, is about continuous vigilance – staying alert to risks, and regulatory changes, and control effectiveness in both good and bad times. For example, during the COVID-19 crisis, businesses had to be aware that even as they rolled out new work-from-home policies to reduce employees’ exposure to the virus, they also had to proactively address the compliance risks of remote work – be it data breaches, fraud, or cyberattacks. 

Is this kind of vigilance necessary in good times too? Yes, because when business is flourishing, it’s easy to get complacent about compliance monitoring and oversight. That, as history has shown us, can be disastrous. For instance, back in the mid-2000s, when the US real estate sector was booming, banks began to take riskier gambles and lend more recklessly than ever before. Without proper checks and balances to curb their behavior, it was only a matter of time before the bubble burst, hurling the world into a major economic recession.

Although we now have regulatory reforms in place to prevent such a crisis, we still need to remain vigilant. The health and success of our businesses depend on us being proactive about assessing compliance, updating policies, evaluating controls, and remediating any issues that arise – at all times. 

This eBook delves further into why we need compliance in both good and bad times, and how to build a culture of continuous compliance in ten steps.

Compliance: More Than a Checkbox Exercise

The world around us is changing faster than ever. We might have weathered a pandemic, but now find ourselves facing rising inflation, geopolitical instability, a climate emergency, and a banking crisis. Cybercriminals are attacking with greater force and impunity. Third-party networks are becoming more complex. And new regulations are constantly emerging.

In times like these, effective compliance management becomes more important, not less. A robust compliance program can help us:

• Prepare for both the expected and unexpected 
• Understand the connections between changing risks and regulations 
• Make data-driven, risk-informed decisions that keep our businesses safe 
• Anticipate upside risks that can be turned into opportunities 
• Strengthen resilience and agility in the face of change

Many companies work hard on compliance only before an audit or regulatory inspection. But the truly resilient organizations recognize that compliance isn’t a one-off exercise; nor is it the sole responsibility of the compliance team. Instead, it’s an ongoing and proactive effort that involves everyone across the enterprise. From frontline workers to the management and board, all of us have a role to play in minimizing compliance risks and protecting our businesses.

As we manage existing compliance risks, we also need to stay alert to new risks – be it climate change, greenwashing, or cyberattacks. Regulations also keep changing and can swing to extremes when times are either really good or really bad.

Even corporate compliance issues tend to escalate in good and bad times. For example, during COVID-19, more than 1 in 4 people experienced an increase in gender-based harassment. Meanwhile, when business is flourishing, bad actors often feel emboldened to engage in non-compliant behaviors like fraud, insider trading, and money laundering. 

All of this goes to say that compliance has to be front of mind always. In good times, it’s a proactive effort, but in bad times it helps ensure resilience and fast recovery. When you demonstrate steadfast compliance with regulations, ethics, policies, and best practices, you signal to customers that you operate with integrity and can be trusted.

10 Steps to Build an Always-On Approach to Compliance

Having a well-defined, measurable, and repeatable compliance program is important for many reasons. Not only does it help you avoid costly compliance violations, litigations, and fines – it also fosters better working environments, enhances public goodwill, and helps you realize your business mission faster. 

Ideally, compliance should be continuous. Controls and risks should be regularly monitored to ensure that you’re always meeting regulatory demands. 

Here are some signs that your business is operating in an always-on state of compliance:

• You’re up-to-date on the latest regulations and guidelines 
• Your compliance processes are streamlined for optimal efficiency 
• Control testing is automated, so your teams no longer have to spend hours gathering evidence for audit
• Instead of waiting for audit results, you know how effective a control is in real time 
• Your compliance risks are proactively identified and mitigated

So, how do you build this always-on, continuous approach to compliance in your business? We’ve put together 10 steps.

• Focus on CultureCompliance is everyone’s job. Ensure that your employees are aware of all relevant compliance requirements through clear and succinct policies and procedures, as well as regular training and education programs. Customize training to the specific compliance risks in your business, so that employees know exactly what’s expected of them. You could also tie compliant behaviors to rewards and promotions – perhaps even recognize a compliance champion every month. Employees will feel more motivated to follow compliance policies if they know there’s something to be gained. 
• Get Commitment from the TopCompliance is most successful when the leadership team sets the tone and steers the course. Through their words and actions, they provide the strongest example of what compliant behavior should look like. And by practicing what they preach, they signal to the rest of the organization that the rules and regulations apply to everyone.      
  
  So, what can leadership do to strengthen compliance? One way is to regularly communicate to employees not just the ‘what’ or ‘how’ of compliance, but also the ‘why’. Two, ensure that leaders can be accessed easily whenever there’s a compliance issue. And three, empower employees to respectfully call leaders out when they notice behaviors that aren’t aligned with codes of conduct. 
• Position Compliance as an Enabler of Business Objectives Help your employees understand that compliance isn’t about red tape and restrictions – instead, it’s about making the business more efficient and credible, building a competitive advantage, and saving money through fewer violations – all of which align with corporate goals. Elevate your compliance officers to the role of trusted business partners and advisers – and integrate their performance indicators with your corporate objectives. Also, ensure that boards and executive teams see compliance as a strategic tool that can ensure long-term value creation even at the expense of short-term profits.
• Establish Strong GovernanceA compliance program is only as effective as the mechanisms and frameworks that govern it. Start by articulating clear roles and responsibilities for compliance. Perhaps your leadership team will be responsible for developing and enforcing compliance programs, while your board may be accountable for overseeing them.      
  
  Once their duties are outlined, simplify compliance communication and reporting by standardizing taxonomies. Everyone should be talking about regulations, risks, and controls in the same language.      
  
  You also want to establish structure in your compliance program by streamlining processes – from policy and procedure management to compliance risk assessments and control monitoring. The better organized and governed your compliance program is the better the outcomes.
• Adopt a Risk-Based Approach to Compliance A risk-based compliance program enables organizations to capture, consolidate, and centralize risk management based on standards, controls, and measures. This involves identifying, scoring, and surfacing high-priority compliance risks within the organization. With this approach, compliance professionals can showcase best practices in spotlighting the most severe compliance risks from across the business and demonstrate actions to actively reduce issues, violations, investigations, and fines. The risk rating also helps your organization to effectively plan control testing, protect your organization from compliance risks, and ensure program defensibility.
• Empower Your Frontline to Report Compliance RisksFrontline employees are often the first to spot a potential compliance risk or ethical violation. Reporting it in time can help you contain the impact of the incident, maybe even prevent it. For instance, mandating cyber risk certifications for employees can help prevent some of the most common and pervasive cyber risks today. But for that, there have to be easy-to-use reporting/ flagging mechanisms and strong whistleblowing policies in place that encourage people to expose compliance violations without fear of retaliation.;      
  
  Ensure that employees feel safe and comfortable speaking up. Set up conversational interfaces, chatbots, web forms, and other intuitive channels to help employees report their observations with ease. Also, enable them to track and view the status of their observations, so that they know their concerns are being addressed.
• Prioritize Third-Party Compliance Regulators are increasingly holding companies responsible for third- and even fourth-party risks. Therefore, it’s essential that your suppliers, vendors, contractors, and business partners are continuously compliant with all relevant regulations, including SOC, ABAC mandates, FCPA, PCI-DSS, HIPAA, the HITECH Act, Anti-Money Laundering (AML), codes of conduct, information security, social accountability, anti-slavery, and other compliance requirements.
  • Keep a record of all laws and compliance requirements that apply to them 
  • Identify and assess the risks of third-party non-compliance – and communicate these insights to your partners 
  • Establish strong due diligence and compliance monitoring mechanisms to keep third-party risks in check 
  • Most importantly, stay vigilant. Address all non-compliance issues proactively and take strict measures to ensure they aren’t repeated
• Remember that Regulatory and Corporate Compliance Isn’t the SameAt first glance, regulatory and corporate compliance appear interchangeable, but that’s not true. While the two are very similar and do work hand-in-hand, regulatory compliance is about following external laws and regulations, while corporate compliance is about following internal policies and codes of conduct. What’s more, regulatory compliance requirements usually remain the same across a section of companies, but corporate compliance requirements can vary quite a bit from one company to the next.      
  
  The goals of both programs are also often different. At the foundational level, regulatory compliance focuses on avoiding costly sanctions, fines, and reputational risks. It also takes into account several other factors, including the designing of a structured and streamlined approach to manage regulatory examinations to ensure and maintain confidence with regulators. Corporate compliance looks at the business through the lens of integrity. Rules matter in corporate compliance, but ethics matter more. The belief is that if you do the right thing in line with company values, compliance will naturally follow.

• Ensure Regulatory Change Management is a Priority The number of regulatory changes has been increasing year on year. In financial services, according to the 2021 Thomson Reuters’ annual "Cost of Compliance Report", regulatory intelligence saw an average of 246 new regulatory alerts each business day. This amounts to 64,152 regulatory alerts per year. The 2022 report showed that 74% of respondents expected this number to increase—and this is just in one industry! A robust framework for regulatory change is the need of the hour.

  Proactively manage regulatory changes by:

  • Keeping track of global and regional regulatory updates in real time via curated content feeds based on predefined rules and keywords
  • Standardizing the regulatory taxonomy for better categorization, storage, and delivery of regulatory updates 
  • Implementing workflows for the review and approval process and ensuring all stakeholders gain real-time visibility via reports and dashboards
  • Automating regulatory change management processes, including horizon scanning, data entry by extracting information from regulatory documents and rule books, and tracking and managing regulatory changes by identifying patterns, phrasing, and language associated with compliance obligations and surfacing them for prioritization and processing
• Modernize Compliance with Technology Maintaining compliance in both good and bad times can seem hard when you consider the sheer volume of regulations, policies, risks, and controls that have to be managed. But with a robust compliance management solution, you can simplify workflows, reduce costs, and improve efficiency. Here’s how:
  • Automatically filter, curate, and distribute regulatory change feeds as alerts to internal stakeholders
  • Automate control testing and monitoring, saving time 
  • Replace inefficient sample-based testing with a more complete testing approach using robotic process automation (RPA) 
  • Use AI/ ML to quickly classify compliance issues; then, correlate them with other similar issues to surface action plan recommendations 
  • Leverage graphical dashboards and reports to track compliance risks, issues, and trends in real time

How MetricStream Can Help

MetricStream Compliance Management software helps you stay compliant in both good and bad times by making it easier to manage regulations, risks, policies, and controls. With timely insights on compliance readiness at each organizational level, you can proactively avoid violations and penalties. Meanwhile, automated control assessments improve compliance efficiency, while also helping you spot potential risks in time.

With MetricStream, you can:

Conclusion

Everything about compliance is about trust. Customers trust us to keep their data secure and private. Investors trust us to report financial results transparently and without manipulation. Employees trust us to keep them safe, protected, and comfortable at the workplace. 

To preserve that trust, we need to have robust compliance controls and monitoring processes in place. Compliance is essentially our license to operate. Without it, our credibility diminishes, our access to markets narrows, and our financial losses stack up. So, if we want to build a thriving and profitable business that customers are loyal to, then we need to make compliance an ongoing effort through good times and bad.