Future Of Compliance- Trends And Developments To Watch

March 20 , 2023

According to recent studies, organizations are shifting their approach to compliance risk management from treating it as a separate vertical to integrating it under operational risk management. This approach allows organizations to assess and measure risk based on residual risk, and focus on the most critical weaknesses. With increasing globalization and complex regulatory compliance requirements, managing compliance risk under the umbrella of operational risk has become essential. This integration also simplifies compliance testing, which can be a challenging task for many organizations.

Digital transformation : Factor-in the current and future trends

All organizations are seeking to get maximum value from their digital transformation. The Covid-19 pandemic has changed the way of business/operations, disrupting and giving opportunity to find new ways to face challenges by adopting to different business models, forcing to move to digitization, which means adoption of digital enablers like Artificial Intelligence (AI)- which includes Machine learning, Big data analytics, Robotic Process Automation (which requires Business Process Mapping to address overlapping process and creating process families), Internet of Things, Cloud/hybrid cloud, operating technology, augmented reality etc.

With a lot more efficiency coming into the system, regulators have also adopted these digital enablers. The above regulatory welcome change makes the corporates to improve and strengthen their compliance function using a more structured approach and digitization to avoid increasing penalties and fines (financial and non-financial) on non-compliance to regulations for their organizations as well as engaged 3rd parties. Although these enablers and technology are used in business growth and compliance, they usher in newer technology related risks, which must be mitigated. For example data/ information security and privacy related risks were not prominent earlier, they have become increasingly prominent in this age of digitization and have necessitated the need for Organizations to change and manage Compliance risk as newer regulations emerge from various regulators.

Data Privacy & security- another factor in the current and future trends

By year-end 2024, Gartner predicts that 75% of the world’s population will have its personal data covered under modern privacy regulations and predicts that large organizations’ average annual budget for privacy will exceed $2.5 million by 2024.

Adopting and implementing some cyber security related audit standards, using standard tools, certifications etc. have become the necessity of the day instead of just adopting these for regulatory purposes.

As an example- let us examine the context of the bank card end-to-end process. The process, if examined in depth, involves not only the Bank, but involves many 3rd party service providers such as card producers, payment gateway facilitators (which may be using cloud), settlement & reconciliation related facilitators etc. As these, 3rd parties may be in one jurisdiction or involve multiple jurisdictions, it becomes necessary to have the regulations driving this universe analyzed, audited under one umbrella- this task is extremely difficult.

Compliance requirements in the current environment moving rapidly to a digitized business environment

The technology operations (involving compliance to many regulations) require tools and audit to mitigate the risks. Organizations use Security Operations Centre (SOC), Privilege Access Management (PAM), Network Access Management (NAM), Firewalls etc. for their IT infra and warrant the engaged technology 3rd parties to have these in place to mitigate risk and regulatory compliance. Further, using ISO framework/ NIST framework etc. strengthen the organizations to strengthen their IT infra with detailed audits for gaps and controls. Certifications of these agencies help the Organization to satisfy the regulator as well as retain their existing customer base. Additionally using tools like VAPT help organizations to assess the vulnerability and penetrations by rogue players against their IT infra defences systems.

Data aggregation, data management, data analytics, data security etc. have assumed significant levels – although primarily one looks at these from an Operational risk perspective (which includes compliance risk), one requires to understand that above mentioned data related aspects accompany a lot of regulatory/global standards compliance requirements.

Some examples to address the above concerns on data/ information are say PCIDSS (on card data) HIPPA (for health records/ data of patients), GDPR (for personal data protections) etc. which are standards used globally.

QRC Services:

QRC Assurance and Solutions as an organization has worked extensively on addressing issues emerging from the current and future compliance requirements. Some of the audits/ tools provided by QRC Assurance and Solutions include:

- PCIDSS (Card Holder Data), HIPPA (ePHI), GDPR (PII) appropriately for Organizations to assess and address the gaps resulting from data security and privacy related at the People, Process and Technology of the organization as well as any engaged 3rd party providers.

- Conduct Audits on prescribed data security/ privacy standards by various regulators such as RBI, NABARD, IRDA, UIDAI, SEBI, SWIFT etc.

- Perform Vulnerability and Penetration Testing Scans using various techniques including Black box, Grey Box, White Box Testing.

- Perform configurations audits to assess the technology and systems related gaps.

QRC Assurance and Solutions offers QRCAssist, a centralized platform that provides effective compliance management System and Self-Assessment tool (SAT) to organizations to help them evaluate/ assess their status of Compliance vis-à-vis various standards/ regulations.