Because of the increasing burden of achieving Information Risk compliance

Digitalisation has led to a growing use of information, and in turn to a growing need to manage and protect that information.

At the same time, Information Risk regulation has increased as the UK government and the EU have sought to set rules for the evolving digital economy.  This has led to a large and complex set of regulation; nearly 60 Information Risk laws and several hundred obligations to comply with. 

The scale, overlap and inconsistency of these obligations make it extremely burdensome to manage Information Risk compliance.

Furthermore, since regulations generally state that an organisation’s supply chain must meet or exceed its own obligations, it becomes important that organisations audit their supply chains in the same way as themselves.  This adds to the compliance burden.

Because of the difficulty of achieving Information Risk compliance

Organisations face significant barriers to achieving compliance:

There is a lot of regulation – With over 60 Acts and regulations and hundreds of obligations, many organisations cannot understand their risk and compliance obligations; they do not know which acts and regulations apply to them, which ones take precedence and how they should be interpreted and applied.

Compliance is complex – Acts and regulations involve complex legal wording rather than simple, natural language that people can understand and interpret correctly.

Compliance can distract from governance – A focus on compliance can lead to box-ticking, when what is required is effective governance that identifies risk, creates a plan and measures progress.  Compliance is the destination, but governance is the journey; people need to start with the journey.

The insight and data required for effective governance are often scattered – Risk, Assets and Operational reality are often measured on separate spreadsheets and systems, at different times, and by different people. There is then no single truth, no effective monitoring and reporting and poor insight to support decision-making.

The organisation’s knowledge is not brought to bear on the task – Compliance is often dealt with as a single, rather than shared responsibility, with the operational parts of the organisation not cohesively engaged with initial discovery or the tracking of plans.

There is no proactive and integrated approach to risk management – In the absence of a central orchestration of insight, assessment and remediation plans, governance is less affective and compliance more challenging.

Compliance is often under-resourced –  This makes it difficult to tackle the governance tasks required, to educate employees and management and to respond to violations effectively promptly.

There is misinformation around compliance – In the absence of a codified discovery of the obligations that apply to an organisation, even experts can make incorrect assumptions, leading to poor decisions.

Because of the serious consequences of compliance breaches

Many organisations have ineffective information governance. Consequently, they can fail to fully identify their risks, the potential consequences and a plan of action to avoid them.

By failing to achieve effective governance, they expose themselves to severe consequences, including:

• Primary, direct risks, such as ceased operations and loss of business;
• Secondary risks such as reputational damage and remediation costs that are much higher than the cost of dealing with the issue in the first place;
• Regulatory risk – breaches can attract regulatory scrutiny, leading to fines. These can be sized according to turnover, with the largest fines reserved for organisations who didn’t know they had a problem and didn’t have a plan to fix it;
• Personal risk – Company offices can face damage to personal reputation and career as well as personal fines and, in extremis, loss of liberty.

Because they need a governance solution to help them achieve compliance

In the face of the burden, the difficulty and the consequences highlighted above, many organisations need a solution to help them implement the effective governance required to achieve compliance.

They need a solution that will:

• Allow them to assign and delegate, across the organisation, the discovery process and the remedial work for their governance – in a clear, manageable and auditable way;
• Show them the acts, regulations and obligations they need to be compliant with, based on the nature of their organisation;
• Show them how compliant they are today, in a simple, clear and complete manner – in one framework that covers all applicable regulation;
• Show them the potential implications and costs from their compliance position;
• Help them to model and explore the impact of remediation choices, thus helping to prioritise remediation work to suit the resources of the business;
• Help them to create a plan for remediation;
• Track the progress of that plan such that it can be demonstrated in the face of regulatory scrutiny;
• Help them turn governance and compliance into a positive culture rather than an after-the-fact chore;
• Help them build governance and compliance into their day-today and end-to-end operations;
• Give them a single-truth view of Governance, Compliance and Information Security Risk across the whole organisation.

Perhaps above all, organisation leaders and compliance officers need a tool and a methodology that can give them professional confidence in their governance and personal peace of mind in their compliance.