A World of Difference
Ted Frank and Brett Curran

The history of risk management and compliance in the financial services industry offers examples of companies that responded to certain risks in purely tactical ways. In many of these cases, the results were difficult for everyone - consumers were hurt, investors incurred losses, corporations lost brand equity and employees lost opportunities - and sometimes their jobs. Yet history tends to repeat itself and companies continue to respond tactically to compliance mandates and key risks. Why do so many companies lack a comprehensive, proactive strategy and operating plan for managing risk and compliance? While there are undoubtedly dozens of reasons, three seem to consistently rise above the rest. Analyzing and coming to terms with these three reasons can help transform an organization's efforts into much more sustainable and defensible risk/compliance programs.

Reason #1: "My area of risk is unique and warrants different treatment than all others."
One could easily argue that privacy is unique in the world of risk management. There are few areas of risk where the threats are changing as quickly. Whether it's the rapid advancement of technology attacks or the astounding increase in the sophistication of social engineering, it's hard to imagine many areas of risk with the same dynamic pace of continual change. Information is essential in the information economy and an inescapable component of corporate value. As a result, effective collection, protection and utilization of information are key components of business strategy.

Sounds like a case for stating privacy is unique, doesn't it? The answer is both yes and no. It's unique in that privacy is subject to one of the most rapid rates of change. It's unique in that it surrounds a broad corporate asset which is increasing in value at a breakneck pace. But these unique characteristics don't have much to do with underlying risk management principles or processes. If anything, these factors only increase the importance of building a defensible process and resisting a tactical response to individual circumstances. There are consistencies in the underlying process. Is there really that much difference among the processes for effectively managing financial reporting risk and the processes for managing privacy risk?

Take money laundering for example. When it comes to regulatory enforcement actions and building effective legal defenses, the U.S. government clearly takes the view that one process can be applied to different areas of risk/compliance across a matrix organization with central oversight. These entities use an enforcement standard - an Effective Compliance Program - developed and published by The United States Sentencing Commission. This standard is used, in combination with a degree of self-reporting, to determine penalties, jail time and fines. But the benefits of a strong, consistent and defensible process extend far beyond legal/regulatory defense into better operating efficiencies and a more agile, effective privacy risk management program.

Reason #2: "It's tough to get the budget necessary to address compliance proactively. It's much easier after things go wrong."
Developing a compelling business case has long been one of the biggest challenges facing those managing enterprise-wide risk or specific areas, such as privacy. The challenge is that many compliance specialists have yet to develop a compelling proactive business case. To achieve success, a clear and comprehensive strategy is required that incorporates quick wins to address the most pressing concern, privacy in this case, and begins to establish the fundamental processes and supporting technology that can be repeated across a variety of compliance requirements. Formulating a business case is tough for a number of reasons. First, few organizations have a handle on the actual direct cost of privacy compliance and all of its associated processes. Other hurdles include a grasp on the indirect costs associated with lost marketing opportunities, reputational damage and fear of being too aggressive in the marketplace.

The second business case challenge has more to do with context and demonstrating value. Privacy professionals are often challenged to simply get through the basic administrative components of their programs. As a result, they lack the time to work with other executives and determine how their programs can improve business and present new opportunities. Building a consistent, defensible process that, at a minimum, covers the downside is a first step toward creating the necessary time to focus on extending the process to address other risk areas.

Finally, a successful business case in most areas of risk management requires a plan that has simple, incremental steps toward a more comprehensive vision. Too few executives have experience with proactive risk/compliance projects, but they are looking for ways to say yes - which typically means incremental investment with measurable milestones.

Reason #3: "There are so many areas that need attention; it's often difficult to determine where to start."
If resources were readily available for investment, the question of where to target those resources is easily answered by the U.S. Supreme Court's Seven Elements of an Effective Compliance and Ethics Program. However, given resource realities in most situations, and barring a major direct or industry failure, securing this level of commitment is often difficult and pushes an Effective Compliance Program into more of a vision. Even so, there are many incremental steps that can be undertaken to move the organization forward. Depending on the circumstances and maturity of the program, any of the following make strong starting points and fit neatly into the constructs of an Effective Compliance Program:

  • Privacy Inventory - Given the financial services industry's merger and acquisition activity, and the rapidly growing and exposed data stores from such initiatives as Web-based account management, customer portfolio analytics and increased integration of customer data across a financial services company and its partners, it is becoming increasingly important for organizations to implement specific processes for continuous identification of privacy risks. Through formal assessment processes, organizations can continually keep fresh inventories of what privacy-related information exists, who has access to the information and for what purposes. Only with this information can organizations map the risks and regulations that apply to financial services companies.
  • Privacy Framework - Given the growth of regulations in the U.S. and the world, companies are constantly challenged to keep the multitude of mandates that apply to their organizations straight. In fact, in a February 2007 Gartner Research study, the firm forecasted that worldwide regulations focused on IT operations will double over the next five years. One can only assume that a good portion of this increase will directly relate to privacy. Starting with organizing frameworks such as the Generally Accepted Privacy Principles and Organization for Economic Co-operation and Development are a good way to start organizing your understanding of the privacy risks that apply to your business.
  • Procedure/Control Design Assessment - Assuming an organization has mapped all operational and legal/regulatory risks, most then move to ensure that they have defined an appropriate set of procedures to control one or more risks. Often through a self assessment, organizations can effectively catalogue and evaluate the procedures that currently exist or need to be developed. Without these controls mapped to the organizing framework, it is extremely difficult to continually monitor and assess the performance of a privacy program. To keep the job manageable, many start by addressing specific regulations or groups of regulations such as the Bank Secrecy Act, Gramm-Leach-Bliley Act, Payment Card Industry/Data Security Standard and security breach notification. Once even one of these is implemented, the road map has been laid for easier rollout to others.
  • Communication and Training - One of the most important components of the Effective Compliance Program is establishing effective communication. Clean, consistent and measurable communication through policies, procedures and training to the appropriate employees, brokers, agents and contractors is crucial. In addition, organizations must have an effective and managed mechanism for employees to seek guidance.
  • Performance Assessment - In a recent survey conducted by the Open Compliance and Ethics Group and Axentis, 76 percent of privacy professionals indicated that assessing the performance of their own privacy program is an urgent concern. Given that 65 percent of these same respondents also indicated measurable increases in external privacy program scrutiny, it's no surprise that many organizations are sharply focused on ensuring this part of their program is functioning effectively.
  • Incident Management (Corrective Action) - Most organizations have now recognized that a spreadsheet is no way to manage the response and remediation of issues, breaches and inquiries with respect to their privacy program. Organizations should have a process that is consistent, predictable and measurable. Having inconsistent remediation for similar incidents can create substantial liability, and metrics are critical for identifying systemic design and performance problems.

What all of these "places to start" have in common is that they tie directly to the Effective Compliance Program enforcement standard. Even acting on one of these items can have a significant impact and move the organization toward a defensible process. Tactical fixes such as hardware, perimeter protection and encryption are important, but not enough, given that the threats are multiplying exponentially. The question isn't "will a breach or failure occur," but "when an inevitable breach or failure occurs, will we be able to demonstrate a defensible process." Better to begin the process now. Along the way, the process may even change the posture of privacy from one of cost to one of value.

Ted Frank is the President of Axentis. He can be reached at

This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

Brett Curran is Director of GRC and Privacy Practices at Axentis. He may be reached at

This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

About Axentis:
Axentis delivers an on-demand business performance optimization environment that empowers companies to turn governance, risk and compliance (GRC) initiatives into better business performance and competitive advantage. With its unique, industry only software-as-a-service (SaaS) model, Axentis Enterprise (Ae) Suite delivers a one-world view of the entire organization for better risk management, mitigation and compliance.


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Advertise in IAPP Publications

Find out how to get your message in front the people you want to reach. Download a media kit now.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

New Web Conferences Added!

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Staff

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Close-up

Looking for tools and info on a hot topic? Our close-up pages organize it for you in one easy-to-find place.

Where's Your DPA?

Our interactive DPA locator helps you find data protection authorities and summary of law by country.

IAPP Westin Research Center

See the latest original research from the IAPP Westin fellows.

Looking for Certification Study Resources?

Find out what you need to prepare for your exams

More Resources »

GDPR Comprehensive: Registration Open

New! Intensive two-day GDPR training led by the sharpest minds in the field. It's a can't-miss event.

The Congress Is Cancelled

The IAPP Europe Data Protection Congress 2015 is cancelled. Click through to learn more.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

Exhibit at an Event

Put your brand in front of the largest gatherings of privacy pros in the world. Learn more.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»