Demystifying Compliance for IT

We all know the propensity of organisations to jam things into the compliance/mandatory bucket, and security/compliance projects for IT are no exceptions. While this is a vendor (rather unfortunate name I would have said) driven white paper, its refreshingly pragmatic and tells it how it is in terms of what can be required and what areas to see when the IT folks walk in asking for funding or sponsorship. Similarly, if we want to setup something which is good and relevant for our applications and security, some guidance needs to be given to the IT folks. This paper can assist COO's, auditors, PMO's, service delivery and change management folks who frequently have to deal with this from an up or downstream perspective. I quote the top piece :

Top Five Compliance Myths
Myth #1: Compliance equals regulations with speci!c actions
The reality: Most regulations have fuzzy or no detail about IT
implementation. And many compliance demands arise from
internal assessments of risk of business disruption or litigation. You
need to engineer for compliance just as you engineer for availability.

Myth #2: Compliance is an IT security issue.
The reality: Sure, a lot of compliance mandates have a security
dimension because they are trying to control the risk of things like
information leakage and sabotage. But just as many mandates are
concerned with the integrity and availability of mission-critical
applications, and so preventing, detecting and responding to
ordinary failures matters just as much. And beyond that, there are a
lot of mandates that govern business issues such as use of insider
information, which are really outside the realm of IT although IT
systems play a role in recording the evidence.
Myth #3: I have to store my original logs for 7 years.
The reality: Where does it say that? Almost no mandates, and
certainly not the most common ones concerning IT departments,
specify log retention times. Log retention times are driven by
assessments of what it will take to service other requirements such
as the need to investigate incidents, detect long term patterns, and
prosecute intruders. You may want to keep 7 years available, but you
may choose different strategies for more recent vs archived data.
Myth #4: A speci!c set of reports will make me compliant.
The reality: See Myth #1. The regulations almost never list a specific
report. There are reports that can clearly assist with particular
requirements, such as the need to review failed logins, but they
require a lot of fine-tuning for each unique environment. At best, a
set of standard reports is a starting place. The dirty secret: most
compliance report packs are developed by product managers
reading the regulations and taking a guess at what kinds of reports
might be helpful.
Myth #5: I need to buy a commercial solution to be compliant.
The reality: Your decision to buy a log management system rather
than roll your own logging infrastructure should be based on ROI. A
well designed system should save you on initial development and
integration as well as make ongoing log reporting, ad-hoc analysis
and alerting more efficient. But the regulations don’t say you have to
buy a commercial system, and the vendors of these systems don’t
have any special insight into what it takes to make you compliant.
So if these are myths, what’s the truth?

Say What?

This is so familiar to anybody who has worked with Compliance folks! :)

 

"There has been a change in the policy on policies, and therefore
all the policies have had to be rewritten in order to be in compliance
with the new policies policy".
- A compliance officer at a large investment bank, during a compulsory compliance training seminar this week.

 

Technorati Tags: Humour , Compliance , Financial Institutions

SOXA is no joke

I have spoken before about the fact that the American Legal system needs to work out some issues, primarily relating to the dreaded Sarbannes Oxley Act which imposes many onerous requirements on firms. But besides that, as the CFO Europe magazine reports sourcing data from Lehman Brothers, 214 CEO's & Presidents, 53 CFO's, 23 Lawyers and 129 Vice Presidents were convicted.

In my experience, prior to me joining my current firm, I found that SOXA was not taken seriously, well, not seriously enough on this side of the pond, primarily because the chances of any European being locked up or convicted for a SOXA blow-up being rather small. And nothing that I have read, heard, discussed and debated so far has made me change my opinion. This leads me to believe that it is only a matter of time before this is tested.

And, in my opinion, this is a false assumption.. The Americans can and will go after anybody who has broken American laws (see how the Natwest 4 are currently cooling their heels in the USA). Also remember that their justice system is much more susceptible to political and public pressures compared to ours. Given the strange antipathy that Europeans feel towards America
due to political differences, you can just imagine a screaming headline, "European Firm commits fraud on Mrs. Pensioner, Poughkeepsie, questions raised in Congress, Department of Justice to launch investigation and US Attorney to bring charges against CFO and COO of ABC Europe GMBH"

So if you have any American operations, and you are a CIO, CFO, VP or CEO, who has SOX exposure (your EXTERNAL auditor will be able to advise you about that), spend 1-2 hours getting briefed on the current exposure by your EXTERNAL auditor every quarter. It is time well spent and definitely not wasted. But if there is a control issue, then you have a bigger problem than SOXA, just what the heck are you and your management team doing allowing such huge control holes to exist in the first place?


All this to be taken with a grain of piquant salt!!!

Top 5 Strategic Email Compliance Mistakes

As the badly paraphrased joke goes, any company can make a mistake but it takes a bank to really screw things up. And emails are the electronic equivalent of the footprints on the sand. Once you hit the stratospheric regimes of management, this will come and bite you at least once in your life, guaranteed. If you do not have a good email policy, you will regret it. I know the probability is very low, and you as an MD have most probably let your IT guys and your compliance lawyers thrash out a compromise.

I further guarantee that compromise will not work when push comes to shove and that's the time that the regulators or courts will have you by the short and curlies.This is a classic situation where people miss the wood from the trees by concentrating on satisfying the letter of the law rather than the spirit of the law. These lessons are very hard won and given the propensity of Financial Institutions to make BIG boo boo's, it will help if these suggestions by Anthony Sanchez are used.



If you review many of the recent business scandals in the news this last year, it is clear that something has changed regarding email and business risks. I’m not talking about spam, viruses, or even phishing. Those are annoyances, but they don’t really have the destructive power that can damage businesses as large as Enron, Arthur Andersen and Morgan Stanley. Companies that do not have a good handle on what is in their email system, what is being sent through their email, or how to retrieve historical emails when necessary, have had major financial losses.

The daily headlines show the major force that email has become. Several factors are driving email compliance: The rise of regulations in the last several years; the growth of email volumes; and the lack of email discipline and enforceable polices.

Many companies are making major strategic errors regarding email compliance because they are operating on an outdated model. Here are the Top 5 mistakes that can BREAK a company’s compliance effort:

Mistake # 1: Business Goal
Compliance should not be the business goal of a company. Business goals should be to become a better business; to reduce business risks, to improve business productivity; to improve customer service, and to ensure the company image and reputation is not damaged, etc..

The mistake many companies make is to take the regulations literally and as complete business guidelines. They are not; they are government minimum standards. Do you want to operate your company solely according government minimum standards?

Action: Make sure your business includes goals of achieving high ethical standards, solid operations and processes and an institutionalization of a culture of compliance from the top down. Compliance is an ongoing process that should be the by-product of these goals. If these are your business goals, then meeting compliance mandates will be easy.

Mistake # 2: Retention: Thinking that after the retention period ends, documents must be destroyed
Regulations mandate a minimum period to keep your business documents, not a maximum period. Regulations do not compel a business to destroy their documents. Why should you keep business records longer than the retention period?

Business documents are critical assets of the business, they hold corporate knowledge, customer histories, long term trends, and other information that can be used as a guide to the business long after an email retention period is over.

All the “old” reasons for deleting electronic documents are no longer valid, since storage costs are so low and email retrieval software is so widely available. There are more reasons than ever to keep all email records. The need for email search and retrieval will continue to increase because the quantity of email is increasing, and more information is created and stored only in email.

Very recently, the judge in the Morgan Stanley v. Ronal Perleman case, created a precedent for requiring a company to produce records regardless of the fact that a company has a document retention policy and has already destroyed the emails in question. The net result of this case was that Morgan Stanley lost a $1.4 Billion judgment in part due to the inability to keep and retrieve their emails assets.

With the increase in business and employee lawsuits, harassment cases, and subpoenas for email records, there are strong reasons to not destroy documents as soon as the retention period is complete. Emails can contain “evidence”, but that does not mean the evidence is always harmful to a company. A recent employee lawsuit for wrongful termination found quite a bit of incriminating and compromising material against him after searching through the archive for emails. The company ended up saving themselves the cost of a major lawsuit and settlement by simply having easy access to emails that would not have been marked for retention under compliance or any other business reason.

If a company does feel that the emails in their system may do more harm than good, I think the larger question they need to be asking themselves is ‘what kind of company do we run here?’ If they are the kind of company that produces so many harmful or compromising emails due to their business practices or company culture that they need to “destroy the evidence” as soon as possible, then they have a much larger problem than email retention and destruction. Their company has an institutional problem that will probably result in trouble in some other way first.

Action: Implement a permanent email archiving solution. I would argue that all emails should be kept forever, and I challenge why any email should ever be destroyed if we have the ability to inexpensively store it and easily access it when needed.

Mistake # 3: Expensive: Thinking that a company needs an expensive, complex content management system to achieve email compliance.
A lot of companies, especially small to medium sized companies, mistakenly complain that they don’t want to get started on compliance because it will take months or years to implement, and hundreds of thousands of dollars in software and services. When it comes to email compliance, this is far from reality.

Many email compliance and content management vendors have needed to justify the expense of their software solution by making it sound complex, technical and only something that an expert in the field should attempt.

The truth is that it is much easier to have email be in compliance with most of the major regulations by simply archiving everything, keeping it in an easily accessible location, and being able to search by keyword, and produce requested documents in a timely fashion. All of this can be accomplished with a fairly priced email archiving solution, which can be installed in a day.

Related to this same mistake is thinking that a backup tape system is sufficient for compliance requirements. It is not. Compliance is not about collecting data for a disaster recovery solution, it is about timely retrieval of specific data. Back up tapes will be more expensive in the long run, and are simply not a valid compliance solution.

Action: Do the research to find reasonable priced email archiving vendors for small to medium sized companies that can implement their system in a few days. Do not rely on your tape back up system for email compliance.

Mistake # 4: Assets: Not including all email as a compliance asset.
Many companies do not consider email documents as part of their record retention and compliance policies. Some companies mistakenly believe that email is simply a communication medium, like a telephone, and that emails are simply verbal conversations that happen to appear in written form temporarily. Following this logic, emails would not have to be considered a business document any more than a verbal conversation would. And therefore emails can and should be deleted as soon as the conversation ends.

What these companies do not realize is that email is not a fleeting conversation, but it is a business communication record that can have business value, transactional and contractual information, attachments with financial documents, and in many cases the only record of an approval or even a customer agreement. In all of these cases, these are critical compliance assets can show the history of accounting and business decisions.

Action: Emails are business documents, and need to be considered the same way any other hard copy form of communication is for compliance and retention.

Mistake # 5: Kinds of documents: Thinking that categorization of documents is necessary.
Because various regulations require companies to retain certain documents for a specified number of years, many companies take this as the only way to retain documents. For example, in the Sarbanes-Oxley regulation, documents that show how a financial decision was made need to be retained for a certain amount of time.

Some companies interpret this to mean that certain types of documents, spreadsheets, and formal sales projections, need to be identified and marked as needing to be retained for 7 years. Other companies interpret this to mean that all documents and emails from certain people, like the CFO, or during certain time frames should be retained for 7 years. Still others leave the decision up to the individual staff members as to whether a document falls into this retention category and treat it appropriately.

There are several problems with this approach. First, it is not just the formal documents that can contribute to a financial decision. There could be a string of emails between the CEO and his buddy who is on the board of directors at another company discussing their golf tournament next week in Arizona. Yet in that conversation, the CEO asks about a certain financial strategy he is investigating, and the Director cautions him against doing it. In none of the above interpretations would this email be retained for compliance, yet it could have been the most important impact on financial decision for the company. It would not have been considered a formal document, nor did it involve the CFO, nor would the CEO have likely thought to include it himself as a business document meeting compliance regulations.

User error is a major problem with categorization. When users control record categorization, some documents that should be retained as business documents are not, and vice versa. A harmful type of user error is when a user has purposefully not categorized a document for retention because of something that might be self-incriminating, yet would protect the company in a compliance audit, such as some wrong-doing or error in his judgment.

The original reason for categorization was to avoid accumulating too many documents because that would increase physical space requirements and costs of offsite storage. Too many documents would also slow retrieval if the need arose because there would be fewer documents to have to wade through. This is based on an outdated reality. With electronic documents like email, storage space is plentiful and cheap, and with several of the email archiving and retrieval software programs on the market today, it doesn’t matter if there are terabytes of records, the search and retrieval are immediate.

The final reason why categorization is a mistake is because there is no way to know for sure, at the time of creation of the email, that it may or may not be required during a future compliance audit or investigation. This is why it would be ideal to keep every record, instead of trying to have your staff inconsistently make guesses as to which documents should be retained and which should not.

Action: Avoid manual and automatic categorization of documents, archive every document.

Conclusion
There is a multitude of federal, state and industry regulations that affect email, and which have elevated the importance of email for nearly every organization. However, since email has been a technology that has been “under the radar” for so many years, most companies have neglected to address the changing nature of email communications as such a critical asset.

Due to this lack of attention and action, most companies may not even realize the extent to which lack of email awareness, polices, retrieval, and workforce education contributes to the increased risk the company is under. Companies will need to more actively manage how their workforce uses email.

Organizations must take action and initiate change in order to avoid breaking compliance regulations. They will need to educate employees how to create emails with care in order to avoid email-borne risks that can devastate a company. Email policy enforcement is a critical component to creating a culture of compliance. Without a system to keep management aware of policy breaches, a policy is worthless.

Gain Significant Other Benefits
Only with the latest email archiving systems can email records be produced in seconds instead of days or weeks. This can mean the difference between meeting compliance audit requests or not.

Additionally, when email is archived for longer periods, there are trend analyses, behavioral patterns and profiles of how email is used within a company that can be very useful in such things as reducing storage, eliminating MP3 files, identifying those who abuse email for personal reasons, and changing policies to improve business.

By implementing an email management archive system, companies will be able to better respond to a subpoena, compliance audit or investigation in a quick and efficient manner. This system can have the long term benefits of helping a company educate users, change their behavior and enforce new policies, making businesses run better. This is after all, the underlying goal of regulatory compliance.

All this to be taken with a grain of piquant salt!!!

shining a light on a little known corner of the regulatory world where it intersects with outsourcing

MiFID will most probably impact these following activities (as noted by Clifford Chance)

(a) Provision of regular or constant compliance, internal audit, accounting or risk management
support;
(b) Provision of credit risk control and credit risk analysis;
(c) Portfolio administration or portfolio management by a third party;
(d) Provision of data storage (physical and electronic);
(e) Provision of ongoing, day-to-day systems maintenance/support; and
(f) Provision of ongoing, day-to-day software/systems management (e.g. where third party
carries out day-to-day functionality and/or runs software or processes on its own systems).

ChaseCooper further reports that:

40% do not have an up-to-date exit management plan in place with their service provider 36% do not have their regulatory team review its contracts A third do not have a service level agreement in place with every service provider 32% do not regularly test service provider’s disaster recovery Where a service provider fails to meet regulatory standards, 31% do not have step-in rights or the right to terminate their agreement More than 30% of agreements do not require the service provider to regularly test back up facilities.

Now this is serious stuff, this level of management negligence is definitely worrisome and while the FSA might be going for principles based regulation, until and unless it actually turfs out people and firms from the financial services market for mismanagement and not just mis-selling/fraud, we will keep on seeing this form of mismanagement. So you might well ask, why am I going all anal about an SLA? It is because of the "broken window syndrome".

The what? Well, the idea of the broken window syndrome was adopted by the NY Police and they clamped down on minor crimes such as broken windows, squeege merchants and petty crime. The idea being that if you make sure that minor crimes are avoided, then major crimes are reduced, as it happened in NY. While that is being hotly debated in the USA, it does make sense. When you are faced with basic mismanagement of this nature, such as not looking after outsourcing contracts, it will not hurt immediately, but in case of crashes or market turns, this suddenly becomes a pain. And the tragedy is that the people who get hurt are the people least able to handle that hurt, such as pensioners.

Furthermore, management of outsourcing contracts is a painful task, specially when management think of it as "manage my mess for less" also means "out of sight out of mind". It does not, even if you have outsourced your business processes or technology, you still need to make sure that they are doing what they are supposed to. Till now, there was no regulatory downside, only business downside. But with MiFID, it has now come under the ambit of the regulators. I wonder how many vendor management departments have been involved in the MiFID process? Based upon my limited knowledge, I would say that 2 out of 3 vendor management departments have not been fully involved (ask around your outsourced vendor partner relationship manager about MiFID and the impact, see them gibber and worry!) and if they are worried, you should be too!!!, November 1, 2007, the go live date is not that far away!


All this to be taken with a grain of piquant salt!!!

Anti Money Laundering - a long way to go yet

KPMG, a member of the Big 5 global accounting firms, recently ran a survey of Anti Money Laundering requirements and the challenges that it imposes on banking institutions. The survey addressed the following items

1 The role of senior management in AML issues agency based in the United Kingdom,
2 The costs of AML compliance
3 AML policies and procedures
4 Formal monitoring of AML systems and controls
5 Taking a risk-based approach to ‘Know Your Customer’ activity
6 Politically Exposed Persons
7 Transaction monitoring
8 Training
9 Attitudes towards regulation
10 Sanctions compliance

While senior management were considerably more engaged in AML, the costs of AML compliance are shooting up (with greater investment in transaction monitoring and training), partially because of the fact that AML is being applied globally rather than regionally/country wise. The increased senior management attention is causing greater testing and monitoring but because of hugely increased volumes, a risk based approach is being increased applied to KYC activity. Politically Exposed Persons were even more under the microscope (See here for my previous entry on an example of Politically exposed person, corruption, AML and banking). While there is greater acceptance of the regulations but the sanctions compliance is the biggest challenge for the banks.

That said, one should expect further challenges. I already talked about how there is a challenge in the private banking side and how no amount of automation will ever stop this. As I mentioned before, insofar as terrorist or crime financing is concerned, the problems arise from the following facts

1. that a terrorist incident requires funding which is generally too low to be trapped. Let me explain. Take the latest Glasgow bombing event. The total cost of the overall operation would be less than £1000. Now that amount of money will be almost impossible to be trapped on almost any measure of AML or KYC identification dimensions. I, obviously cannot go further than this, but this is very difficult to trap for a bank, if not impossible.

2. that it is still ridiculously easy to side step official channels. Even if we wanted to have an illegal source of funds, it will be far too easy to get this via the hawala or the tourist money changer channels (let me put it in this way, the ease of which you can setup a money changer firm in some areas of the world is frighteningly easy). If you are reasonably sophisticated and wanted to go for a larger sum of money, then you wouldn't mess around with these piddly money changer or hawala channels but you will use the grand-daddy of corrupt channels, the over/under invoicing of trade and services globally. And the beauty of that is that the excess money is usually fully whitewashed and clean. And if you are a bit smarter, you can even write off your losses against tax and get some more money from that. And there are an infinite number of variants to this one. Read my previous post to get a flavour of what you can do and get away with.

3. Electronic trails with cut-outs. For those who really want to flush big sums, once you have bounced your cash through several electronic cut-outs, through some rather dubious and not so dubious locations, it is clean. If you can covert cash to capital assets (such as plant, machinery, ships, etc.), then you are in clover because of the huge possibilities of importing and exporting, but this is far too complex for the common terrorist/criminal. This kind of stuff is reserved for the white collar criminal and the big corrupt chaps (very politely termed as Politically exposed people).

The really tough conclusion is that there is unfortunately very little else a financial institution can do. Financial Institutions are already or heading rapidly towards what I call as the Israeli defence. Which, very simply described, means that every transaction is monitored electronically or automatically with various mathematical, statistical, parametric and non-parametric methods. The training of the front office and control staff is given to spot the strange chaps, the curious incidents, the funny transactions, the sweaty submission. So you have concentric rings of security which progressively increase the level of evaluation till the person or the transaction hits the banking system. This is the equivalent of the X-Ray scanners added with the conversation and eyeball on the sweat glands on every passenger on an El Al Flight.

Long way to go, my friend, long way to go.


All this to be taken with a grain of piquant salt!!!

The moans from compliance

Here's another broadside from the compliance side of the business. A survey of audit and compliance professionals in the USA has found that they absolutely hate IT for not taking care of identity and access management. They also expressed frustration that the IT and business groups are not collaborating well with the compliance folks to implement identity and access management.

Well, this is unfortunately far too common and I have seen this at every financial institution that I have worked in or know of. Given a regulatory requirement like implementing identity or access control, compliance usually comes in with a maximalist position, business will come in with a minimalistic or frankly go away and dont bother me position and IT comes in and designs a nuclear powered paper clip. Why? Well, compliance always thinks in terms of binary positions, you are either in compliance or you are not. So they tend to er on the side of caution and ask for the most draconian setup. IT are always suffering from lack of funds and they absolutely love mandatory and compliance projects because the chances of that passing the business case investment committee is much higher! so they go away and design a nuclear power clip. And the long suffering business think that they are again getting hit by red tape, complaince and regulatory pressures. And so the whines start.

It is tough, the business is getting extremely complex and the process chain is more and more complicated. Not to mention long (not only by systems but also by geography). When you have a very long process and automated chain, then changes to even one component has got a huge upstream and downstream impact. All the SOA and middleware helps are simply lipstick on a pig in the greater scheme of things, I am afraid. That is why more often than not, people will go for a manual solution rather than automate it. And once you have few years of this, 3-10 mergers and acquisitions, rapid technology change, and you end up with a cats cradle of systems, processes and databases. If you try to throw in new regulation, it really becomes expensive to implement.

There is no solution, each regulatory change has to be evaluated hard, and existing banks are way too big and bulky to go for structural and strategic changes such as implementing huge SOA or middleware packages. It is just too expensive, I am afraid. But there you go, fun times in financial insitution land.








All this to be taken with a grain of piquant salt!!!