Value of a Purpose-Built Third-Party Compliance Solution

Transcription

1 Value of a Purpose-Built Third-Party Compliance Solution

2 Introduction Multinational corporations routinely engage third parties such as sales agents, consultants, brokers, distributors, resellers, suppliers, and joint-venture partners. It is important to recognize that all third parties pose potential and varied compliance risks. To minimize third-party risk and maintain compliance with international Anti-Bribery and Anti- Corruption (ABAC) regulations, multinationals must create and deploy a software solution for the onboarding, management, monitoring, and auditing of their entire third-party population. The Benefits of a Third-Party Compliance Solution Companies must take a systematic and automated approach to create a credible and defensible third-party compliance program that can withstand regulatory scrutiny. Such an approach allows companies to automate many aspects of their compliance effort by using high-integrity defined, efficient, and effective processes that produce the desired intelligence. Because defined processes promote consistency and a complete understanding of third-party risk, they remove subjectivity from the compliance process. As a result, companies reduce their exposure to violating ABAC regulations. If companies that take a systematic approach to compliance do come under regulatory scrutiny, they can defend their intention to meet the spirit and letter of regulatory laws by pointing to their third-party compliance solution program. Investing in a robust third-party compliance solution can pay off in another way. It can help trim overhead costs because staff can be reduced or reallocated to other tasks. A systematic approach to third-party compliance has other benefits. The approach: Creates an audit trail of actions relating to each third party, including: - The reason the company accepted or rejected them. - The efforts taken to ensure ongoing compliance, such as the administration of recurring due diligence questionnaires. - The resolution of any red flags uncovered during the period the company engages the third party. Provides analytics to manage and measure the compliance process. Allows companies to develop a range of key performance indicators for C-level executives and the Board of Directors. Provides business units with transparency and predictability regarding the third-party compliance process. 2 The Value of a Purpose-Built Third-Party Compliance Solution

3 Why a Purpose-Built Solution Makes a Difference A purpose-built compliance solution s sole objective is to help companies manage third-party compliance risk. Deploying such a solution allows companies to engage third parties with confidence. The solution is highly efficient because it focuses exclusively on third-party compliance with no redundant or duplicative elements. Implementing the solution is easy since the workflows embedded in the software align with the third-party compliance process. A purpose-built solution also lessens the burden on companies to implement a robust compliance program since everything within the platform is critical to the process. A Purpose-Built Solution vs. Software with Multiple Purposes The goal of a purpose-built compliance solution is to ensure third-party compliance. Therefore, it is potentially easier to defend the use of such an approach because it shows the company s intent and focus is on third-party compliance. The solution meets the needs of both compliance professionals and regulators. It delivers a systematic, intentional, and auditable approach based on compliance-focused workflows and can produce insightful analytics. By comparison, think of a company that uses a general software. Now imagine that software evolving with add-ons for different missions. The technology in such a software, particularly the compliance component, often lacks clarity of purpose. The result is that the compliance process becomes unnecessarily complicated. Because it is an add-on, the software is attempting to solve a problem that the software company often does not fully understand. As a result, customers incur additional costs associated with customization and delays in implementation that can last months. The software developed using such an approach routinely contains inherent flaws and inefficiencies that remain unresolved because fixing the coding in the compliance portion of the software would affect other functions the software performs that are unrelated to third-party compliance. WHY EXCEL AND SHAREPOINT CANNOT SUPPORT THIRD-PARTY COMPLIANCE Some organizations turn to spreadsheets, or document retention platforms to meet their compliance needs. Software such as Excel and SharePoint cannot adequately address the elements of third-party compliance that companies must have in place to comply with ABAC regulations. Invariably, spreadsheets and data repositories often struggle to produce analytics that most regulators view as run-of-the-mill. In fact, if an organization employs readily available, yet unsuitable software, regulators may conclude that the company lacks a detailed understanding of the third-party population and their inherent risk. This includes compliance-driven audit trails, data privacy provisions, and business continuity measures to generate reliable backups. 3

4 A Best in Class Compliance Solution vs. Software Undergoing Development A fully evolved solution expressly crafted for third-party management delivers a mature technology that companies and regulators alike will view as credible. It also reflects a deep understanding of the global third-party compliance landscape. Feedback from users leads to enhancements that drive efficiencies and improve a company s already high degree of compliance. Alternatively, solutions that evolve from one purpose to another require development and consequently expose companies to sub-optimal processes during the development phase. This, in turn, breeds inefficiencies and elevates third-party compliance risk. By necessity, customers of such solutions end up providing feedback to help develop the technology in order to meet their most basic compliance needs. In essence, the customer becomes an unpaid developer and, during the process, they still pay a system access fee for that privilege. Involvement in the development of a sub-optimal solution is time-consuming and detracts from a compliance department s primary role. It also transfers the cost to the customer. With a substandard system in place, the company s exposure to compliance risk may also increase. MADE-TO-MEASURE VS. IN-HOUSE SOLUTIONS A made-to-measure solution meets the customer s needs, as it is a fully developed, mature technology with a range of capabilities designed explicitly to foster and support third-party compliance. Its use does not require the company to hire programming support as the software provider maintains those resources within its organization. An in-house compliance tool often burdens a company with considerable costs and a platform that never fully meets its compliance needs. Developing software requires considerable time and expertise that a company s employees may possess. However, similar to software developed by accounting and consulting firms the ability to create a solution that satisfies a range of regulations, and incorporates the latest changes in the regulatory environment places considerable strain on a company s resources. Often, those involved in creating the software do so in addition to their primary responsibility, such as maintaining and managing existing third-party software or ensuring network security. A Bridge Too Far: Compliance Software Developed by Accounting and Consulting Firms Based on their ability to provide accounting and auditing services, companies sometimes turn to their accounting or consulting firm to deliver compliance software. Despite the fact that most accounting or consulting firms do not have the expertise to develop software to ensure ABAC compliance, they are often tempted to redesign an existing enterprise platform to include such functionality. On the other hand, they may create a new platform from scratch. 4 The Value of a Purpose-Built Third-Party Compliance Solution

5 Creating a sideline business results in incremental revenue for the accounting or consulting firm. However, since it is a non-core offering, over time, changes in personnel and shifting business priorities often affect the level of support the software receives. As the software s capabilities deteriorate through neglect, lack of support, and inability to reflect the latest developments in ABAC regulations, compliance risk increases exponentially. Built by Compliance Professionals vs. Coded by Software Developers Creating a purpose-built solution involves a partnership with compliance professionals and a development process that keeps their needs in mind at all times. Because of that partnership, the resulting solution includes customizable compliance workflows, solutions to common hurdles such as renewals, and the ability to minimize data privacy risk among other needs-based functionalities. Alternatively, having achieved success in another area, software providers often attempt to broaden an existing solution s capabilities to address third-party compliance. Unfortunately, many do so in a risky vacuum without securing input from seasoned compliance professionals during the development process. Not surprisingly, with a limited understanding of the functionality needed to ensure third-party compliance, the final product fails to meet a company s basic needs. By design, a custom-made solution streamlines the onboarding and renewal process, integrates data from other platforms, and delivers a multilingual interface that reflects cultural nuances. As a result, third parties readily embrace the process and the level of participation and compliance increases accordingly. Purpose-Built Solutions Evolve with the Compliance Landscape Given the changes in the global compliance environment, which includes an increase in the number of regulations designed to combat bribery and corruption, and a rise in multijurisdictional government investigations, a high-performing third-party compliance solution must evolve over time to mitigate relevant risks. An effective third-party compliance solution must be iterative, flexible, and scalable. Without those attributes, even custom-made solutions can fail to deliver the systematic approach to compliance that companies need. A NOTE ABOUT DATA PRIVACY If a company minimizes its exposure to third-party compliance risk, it may inadvertently violate one or more data security or privacy laws. A purpose-built third-party compliance solution limits data access to those with a defined business purpose and facilitates the gathering, storage, and dissemination of the data in compliance with the applicable data privacy regulations. It focuses on the needs of compliance professionals and regulators, and satisfies information security and data privacy regulations, which are often an afterthought that the vast majority of solutions fail to address.. 5

6 Case Study: Supply-Chain Management Software vs. Purpose-Built Solution Background Based on its existing relationship with a supply-chain management software provider, a large multinational company engaged the firm to develop a third-party compliance solution. Implementation Challenges The software company, however, did not have any experience developing or deploying a thirdparty compliance solution. They provided an initial estimate to build the software from scratch at a cost of $150,000 requiring 10 months of development time. This cost estimate did not include the time and expense the multinational would incur as part of the process. During the development phase, the software company requested access to subject-matter experts from the multinational s compliance, legal, and sales teams. After incurring nearly $200,000 in development costs over 13 months, the multinational received access to the software in beta form. The Challenges Begin The software firm s lack of familiarity with third-party compliance showed in the application. Despite extensive support from the multinational s subject-matter experts, the processes embedded within the software did not align with the multinational s existing approach to third-party compliance. Since the software firm did not focus on compliance, when its programmers left the company the firm was unable to fill the vacancies with suitably qualified in-house staff. These staffing issues resulted in numerous delays as the firm conducted external searches for programmers. Triggers to Abandoning Initial Solution After two years of struggling to deploy the software coupled with increased regulatory activity within its industry sector, the multinational decided to abandon the software company. It subsequently selected Securimate to provide a third-party compliance solution. Discovery of a Purpose-Built Solution Within a couple of weeks, Securimate helped the multinational transition to its platform. For a fraction of the total cost of ownership associated with the previous software, Securimate delivered a responsive, flexible, and scalable solution. 6 The Value of a Purpose-Built Third-Party Compliance Solution

7 Benefits of Securimate s Third-Party Management Solution Aligns a variety of workflows with the third-party compliance process. Delivers a systematic, intentional, and auditable approach supported by compliancefocused workflows that meet the needs of compliance professionals and regulators. Reflects a deep understanding of the global third-party compliance landscape. Streamlines the onboarding and renewal process, integrates data from other platforms, and delivers a multilingual solution that reflects cultural nuances. Limits data access to those with a defined business purpose and facilitates the gathering, storage, and dissemination of the data in compliance with the applicable data privacy regulations. Complies with information security and data privacy regulations, which are often an afterthought that the vast majority of solutions fail to address. Evolves over time to mitigate relevant risks iterative, flexible, and scalable. Conclusion Regulators know that third parties often play an instrumental role in bribery schemes. As a result, investigations often include a close look at a company s third-party compliance policies and procedures. A purpose-built solution that evolves with the regulatory landscape helps companies ensure third-party compliance and consequently withstand such scrutiny. Investing in a third-party management solution other than a tailor-made approach generates considerable compliance risk and development costs. Too often, software companies attempt to repurpose or adapt an existing solution to address areas beyond the original scope of the platform. When it comes to ABAC compliance, forcing a round peg into a square hole provides only temporary relief. As regulations evolve and the company s needs change, generalpurpose software becomes increasingly difficult to use and maintain. Eventually, the company ends up with a third-party compliance platform in name only. A purpose-built third-party compliance solution will evolve as the global compliance environment changes. It provides mission-critical compliance functionality that is part of the solution s DNA. It allows a multinational to continually onboard, manage, monitor, and audit its third-party population. It is not an afterthought, or something to be developed when time and resources permit. 7

8 About Securimate Securimate is the leading enterprise third-party management cloud solution that enables multinational companies to systematically onboard, manage, monitor, and audit their sales channel and supply chain participants. Securimate s user interfaces and flexible workflows deliver detailed analytics that help customers ensure regulatory compliance, maximize supply chain efficiency, and comply with data privacy laws and regulations. Visit for more information. CORPORATE OFFICE 7935 E. Prentice Ave, Suite 310W Greenwood Village, CO USA +1 (720) info@securimate.com OFFICES: AUSTIN, DENVER, ST. LOUIS SM