White Paper: Enterprise Compliance Management

Transcription

1 White Paper: Enterprise Compliance Management Sunken costs or real value a case for leveraging your investment in compliance Enron Tyco WorldCom Whose name will be next on this list? The confidence of stakeholders has been shaken by a series of corporate scandals; top executives have been found guilty of improprieties such as illegal accounting methods and records fraud. As a result, state and federal agencies have been developing new standards to govern the way organizations manage their businesses and the records they generate. Standards like Sarbanes-Oxley (SOX), Health Insurance Portability and Accouting Act (HIPAA), SEC 17a4 and Gramm-Leach-Bliley address a wide range of business activities, including financial reporting, records access, privacy and legal discovery. These standards are designed to make organizations more accountable for the operational information they report, as well as demographic information they maintain on employees and customers. The real value of your compliance framework should extend beyond passing your annual audit to include lower costs and improved efficiency enterprise-wide. Failing to comply with these standards can have significant consequences, with the possibility of fines, penalties, jail time for executives or major market capitalization hits. Moreover, there is the risk of the organization s image being crippled, leading to lost credibility, market share and customer loyalty. It is impossible to understate the importance of protecting brand integrity and maintaining the trust of stakeholders. No one wants to be center stage in another public relations nightmare. FUJITSU CONSULTING As a result, organizations are spending millions of dollars each year on compliance. However, recent surveys have indicated that many CIOs have become frustrated because, despite the high costs involved in implementing their compliance frameworks, they are seeing little value beyond being able to pass their annual audits. Executives are asking themselves: Is an investment in compliance truly a sunk cost or are there ways to leverage this spending to bring about a real return on the investment?

2 Compliance efforts that focus on short-term goals and rely on manual processes typically result in high, recurring auditing and operational costs costs that can spiral upward as new regulations are enforced. Reliance on manual processes also impacts worker productivity as employees spend an inordinate amount of time engaged in compliance-related activities rather than performing their core, value-added tasks. Manual processes can also increase the risk of non-compliance and typically require a greater investment in training. A less obvious but possibly more harmful outcome of adopting a short-term, manually-oriented approach to compliance is that the resulting framework becomes reactive, lacking the ability to proactively identify compliance issues and limiting the organization s ability to continuously evolve their compliance capabilities as required by law. A Strategic Approach To Compliance By taking a strategic rather than short-term approach, an investment in compliance should not only result in a significant reduction in operational and financial risk but also enterprise-wide cost reductions and efficiency enhancements. A proactive, sustainable compliance capability that results in bottom line benefits to the organization can be realized through the following steps: Develop and enforce suitable policies and embed them into the organization s business processes; Integrate compliance with records to ensure that the necessary information is properly captured, stored, retrieved and, when appropriate, destroyed; Create a governance structure that assigns accountability for compliance and enables continuous improvement; Automate key compliance and records activities to ensure consistency, transparency, and sustainability. With all four of these components in place, the resulting compliance framework can proactively assess and reduce compliance risk, while reducing costs and enhancing efficiency enterprise-wide. The following sections further examine each component. Embedded Policies When adopting a strategic approach to compliance, organizations should embed their compliance policies and procedures into the business processes they are intended to support and not implement them as standalone, manual activities. This may necessitate some business process redesign or the leveraging of additional technologies; however, the benefits will typically far outweigh the costs. For example, instead of saving all messages for an indeterminate period of time (which can significantly increase discovery and storage costs) or relying on employees to determine which s to save, an off-the-shelf tool can be used to automatically categorize s and store them according to pre-defined rules. This ensures the consistent treatment of , minimizes user intervention and improves both the responsiveness and quality of e-discovery. Integration of Compliance with Records Management In order to be compliant, organizations must maintain records in a manner that is legally defensible. That is, records must be complete and accurate and they must show that their integrity has been maintained throughout their lifecycles. The inability to produce records or the production of spoiled (tampered with) records has resulted in serious fines and penalties, reduced market capitalization and, in some cases, the total collapse of a business. Consequently, the ability of a compliance framework to store a key piece of information as a record, maintain it for a specified time period and then dispose of it in the appropriate manner is critical. As the organization s ability to capture and store electronic records and to automate compliance activities improves, the benefits accrued by strategically integrating and automating records activities can be immense.

3 Consider the example of a hospital that automated its process for reporting incidents involving patients. As a direct result of introducing electronic record-keeping, the hospital experienced a 50% increase in the number of incidents being filed, eliminating their earlier exposure to penalties for under-reporting. In addition, the elapsed time between the incident and the report being filed was reduced by 60%. Since these reports are an Occupational Safety and Health Administration (OSHA) requirement, the hospital has further reduced its exposure to fines and sanctions. The new incident capability has also given the hospital an online view of all incidents, making it easy to identify patterns of behaviour that can now be corrected to eliminate existing and potential problems, again reducing exposure and possibly saving lives. As a result of these and other benefits, the improved incident capability has resulted in the hospital s insurance carrier giving it a more favourable rating, which, in turn, has resulted in lower premiums. Organizational Governance A key requirement for a long-term compliance framework is the creation of a corporate-level compliance and records function with the authority and responsibility to set and enforce policies and procedures. While the size and reporting structure of this new function depends on the size of the organization and the particular industry, it is often beneficial for the combined compliance/records function to report to the legal function. The compliance/records function must be able to interact at the department level with coordinators who are accountable for compliance activities in their respective areas. In turn, these coordinators must be given the authority and responsibility to ensure that departmental policies can enable corporate compliance. Automation Workers have enough to do without spending significant amounts of time on compliance-related activities. Typically, they are interacting with too many control points, handling too many records, and sending and receiving too many s and instant messages to be able to consistently make effective, defensible decisions about compliance events. As a result, automation becomes an important feature of a long-term compliance framework, delivering the technology-enabled capability to fulfill compliance requirements without user intervention. For example, larger organizations have typically implemented a large number of control points; attempts to manage these control points manually often result in excessive operating, audit, reporting and remediation costs. As a result, control point is one of the activities that should be automated to create a consistent, sustainable compliance framework. Indeed, as John Hagarty, an analyst with AMR Research says, People realized you couldn t maintain [adequate] controls over a bunch of spreadsheets and word-processing documents without tying up manpower. There is tremendous value in being able to log in to a portal that lists the compliance tasks to be performed, tracks when they have been completed and then reports on status to key executives. While this can be achieved manually, the cost and risk of deploying scores of workers to carry out these tasks over a period of years is high often far outweighing the costs ($300,000 $500,000) typically associated with a control point tool.

4 Spoliation A missing record can impact the eventual outcome of litigation and redirect liability. It is imperative that enterprises and their counsel take the necessary steps to preserve relevant documents and avoid claims of spoliation. Spoliation is defined as the destruction or significant alteration of evidence, or the failure to preserve property for another s use as evidence in pending or reasonably foreseeable litigation. New Jersey Law Journal, January 17, 2005 The New Jersey Law Journal goes on to state that the most common examples of spoliation are the deletion or destruction of relevant s, files and/or disks. If guilty of spoliation, a business faces adverse evidentiary inference: the jury is told that they may infer that the evidence that has been destroyed or rendered unavailable was unfavorable to the business. Leveraging the Compliance Investment across the Enterprise Organizational governance capabilities and the skills and knowledge acquired when implementing a long-term compliance framework (automating processes, using new tools and deploying new platforms, for example) can be leveraged across the enterprise and the entire content spectrum to realize further benefits from an investment in compliance. Consider the following examples: The business process tool used to design a compliance process that ensures large checks receive three levels of authorization can be leveraged to design an Accounts Receivable process that automatically flags any receivables that are more than 30 days past due. Record retention schedules, newly-acquired business process skills, and an automated record tool can be collectively leveraged to create a process that ensures critical Human Resources records are appropriately authorized and stored. The knowledge and infrastructure acquired to archive records for audit purposes can be used in the supply chain to ensure that receipts are captured and stored for tax reporting and other purposes. These examples suggest just a few of ways that the infrastructure, tools and skills acquired for compliance can be more fully leveraged. Getting help from Fujitsu Consulting With extensive experience in enterprise compliance assessment, planning, implementation and support, Fujitsu offers a continuum of integrated Enterprise Compliance Management services designed to help organizations maximize the performance of their compliance frameworks while fully leveraging clients investments. This continuum of services includes: Assessment Our consultants help you define your compliance strategy and calculate the investment required. We explain the resulting paybacks and determine how to best leverage your investment across the enterprise. Strategy and Migration Plan Our consultants help you develop a high-level plan for implementing key changes to processes, organizational structure and technologies so you can migrate to a new level of compliance. Stabilization Our consultants work with you to implement key policies and procedures at both corporate and department levels. We help you make necessary organizational changes. We help you select and implement appropriate technologies and integrate these technologies with your existing infrastructure.

5 Center of Excellence (CoE) Our consultants can help you create a CoE with the design, run and build capabilities that will allow you to leverage your work in compliance enterprise-wide. Key CoE activities include the standardization of technologies, process harmonization and platform adoption. Optimization Our consultants help you roll out compliance best practices across the enterprise. This rollout is typically managed as a major program multi-phased, multi-year and results-focused that can be simplified by applying our industry-leading Macroscope Benefits Realization Methodology. Operations Support Finally, we offer a broad range of options for operations support. Our consultants can help you improve the overall support and operations of your optimized compliance framework using industrystandard best practices. Alternatively, you may choose to outsource certain compliance and records applications, putting the costs and of these systems in our capable hands and freeing up your resources for more mission-critical work. Service Offerings Enterprise Compliance Management framework Strategic Compliance Discovery / Assessment Compliance Strategy and Migration Plan Stabilization Program Center of Excellence Optimization Program Operations / Support Current state assessment - People - Process - Organization - Technology Trends analysis Program value case Compliance roadmap Strategic program plan Migration strategy Target architecture Organization design and development Process and policy definition Training/ education Compliance automation Records integration COE governance Design, build and run capabilities Enterprise architecture Change Enterprise content integration Phased compliance rollout Process automation/ harmonization Operations support Application value assessment Application IT service ITSM / ITIL Conclusions Many executives feel that they have spent a lot of money on compliance without getting much in return. This is not surprising if they restricted their efforts to short-term goals focused on passing annual audits; in this case, compliance spending is largely consumed by employees performing repetitive, manual tasks. However, if these executives had instead focused on developing a robust, long-term compliance framework, their investments would have lowered the cost of compliance and could have been leveraged enterprise-wide to reduce risk and increase efficiency. Organizations that use the knowledge, skills and technologies acquired through their compliance efforts to create a foundation for improvement in other areas of the enterprise can fully leverage their compliance spending.

6 More Information For more information on the regulatory compliance services offered by Fujitsu, please refer to our solution brief, Fujitsu Enterprise Compliance Management Services. About Fujitsu Consulting A trusted provider of and technology consulting to business and government, Fujitsu Consulting is the North American consulting and services arm of the $43.2-billion Fujitsu group. Fujitsu Consulting integrates the core expertise of the Fujitsu companies and its partners to deliver complete solutions in the areas of enterprise information, packaged application implementation, legacy systems modernization, IT governance, managed services and business process services. Through its full range of IT consulting, implementation and services and its industry-recognized strategic approach, Macroscope, Fujitsu Consulting enables clients to build more value into their IT investments and drive their leadership in the marketplace. Headquarters & United States 343 Thornall Street Suite 630 Edison, NJ United States Tel: Fax: Canada 155 University Avenue Suite 1600 Toronto, Ontario Canada M5H 3B7 Tel: Fax: We work with you to create solutions and produce results that drive your business. Quebec 1000 Sherbrooke Street West Suite 1400 Montreal, Quebec Canada H3A 3R2 Tel: Fax: India A-15, MIDC Technology Park Talwade, Pune Maharashtra, India Tel: Fax: , Fujitsu Consulting, Inc. Macroscope is a registered trademark of Fujitsu Consulting (Canada) Inc. All rights reserved.