How to build a sustainable compliance effort

While there are many exciting ways a sustainable compliance strategy can open up business processes and data, experts caution that we're still in uncharted waters.

"Public companies have to do something they never did before," says Lee Dittmar, principal with Deloitte Consulting. "They now have to document, assess and test their internal control programs. Companies had internal controls, but not necessarily an internal control program. The reality is that we're all on a journey we have not taken before."

One thing is certain: A compliance audit requires unprecedented levels of business process documentation and data from across the enterprise. The knee-jerk reaction has been to pull in accountants to pore over these documents to double-check their accuracy. This is an onerous job that has to be repeated quarter after quarter—forever.

Why not put a well-managed effort in place that addresses data quality and integration efforts on an ongoing basis, building confidence in the data being produced from the enterprise? A comprehensive enterprise data warehouse allows organizations to store a mix of data for easier, faster and more accurate regulatory reporting.

"The kind of scrutiny that's been applied to the reporting end has not been applied to the frontend," Rajeev Rawat, president of BI Results, points out. "If you have clean data coming in and it's measured and appropriately processed, then you won't need armies of accountants to do the work at the backend."

While each law or regulation has its own set of requirements, an agile sustainable compliance program can "bake" enterprise data quality, accessibility and visibility initiatives into corporate processes.

This not only helps meet future mandates but also increases opportunities for the business to cut costs and increase customer satisfaction and market share.

"What companies have done so far (for Sarbanes-Oxley) is not the end of the journey," Dittmar observes. "Completing the first year project is an important milestone, but that's not sufficient. In order to sustain compliance, companies are going to have to put a program in place that encompasses the organization, people, process and technology issues."

Leading enterprise data warehouse (EDW) and compliance experts urge companies to look beyond meeting compliance mandates. They believe in establishing and building a sustainable compliance program that will continue to adapt and meet requirements while offering enhanced business value.

The objective of such a program is to simplify, centralize and standardize across corporate systems the processes embedded in those systems and the data associated with the processes.

Compliance and industry experts identify five key steps that organizations can take as part of a comprehensive sustainable compliance effort.

1. Plan and develop a strategic vision
A sustainable compliance program provides organizations the opportunity to move beyond financial reporting to build an agile infrastructure that keeps all parts of an organization focused on strategic goals.

Though the benefits of sustainable compliance are far-reaching, many organizations have not adequately prepared themselves to leverage compliance efforts to this extent.

"Many companies are saying 'Just fix the reporting part so what goes out is clean,'" says Rawat. "Unfortunately, as a result, companies are only reporting what they feel they can stand behind and (what) feels solid. It does nothing to improve the agility of the organization, provide competitive advantage or improve customer experience."

As a stand-alone activity, compliance has been hitting companies hard in the pocketbook. According to AMR Research, companies are spending an average of $500,000 each per year on compliance activities, totaling more than $15 billion this year alone.

Since money is already being spent on projects, industry experts urge IT and data management executives to explore ways to not only manage these expenditures but also deliver value to the business. As a result, data integration proposals that faced organizational headwinds may now start getting more support.

"A lot of regulatory requirements have been the 'fly in the ointment' for people who have up until now dug in their heels about integrating data," says Jill Dyché, partner with Baseline Consulting.

"Compliance issues have propelled integrated data from luxury to business mandate."

Compliance and competitive advantage are two goals that are achievable through a well-planned sustainable compliance effort. Rawat urges executives to collect data from across the enterprise that helps to establish measurable targets that the company seeks to reach over the next five years. This strategic vision consists of a statement of prioritized key performance indicators (KPIs), including financial and performance targets, competitive criteria measurements and customer satisfaction measurement variables.

2. Establish a program management office, or compliance center of excellence
A sustainable compliance program offers organizations the opportunity to leverage resources and information from across the enterprise into a common effort. However, there needs to be a specific individual or team of individuals responsible for pulling this effort together, selling the benefits and marshalling the necessary resources to make sustainable compliance a success.

A structured compliance initiative, either led by an executive or a team, can gather required resources across the enterprise to promote key processes, best practices, data integration standards and the continual leveraging of metadata knowledge across numerous integration projects. Such an office or team can serve as an umbrella organization to address virtually all compliance requirements that come into the organization.

"The project management office puts in place the things that address the different regulations," says Cory Shouse, data architect with McKnight Associates. "It makes sense to have a single strategic compliance program that you (use) across all the laws and regulations to make sure you're satisfying them."

3. Partner with business units, starting with finance
While a sustainable compliance program requires participation and data from across the enterprise, laws such as Sarbanes-Oxley put the onus on financial managers to adequately report on corporate information. "Financial data is the place to start these efforts," says Dyché.

Likewise, Shouse agrees that partnerships need to start with the corporate financial team, which has tended to take ownership of compliance issues.

"A lot of chief financial officers and finance organizations see compliance as a finance issue, not as an IT issue," he notes. "But that's absolutely not the case. Build a partnership with them, and let them know you're going to support them. A lot of the audit trails that are going to be needed for the audit and compliance are IT-driven. The financial people are the data stewards, but tracking and building that data is going to be where the IT expertise comes in."

4. Identify repeatable processes
A sustainable compliance program should consist of a repeatable and predictable process that can be performed on an ongoing basis. In compliance efforts to date, most companies have tended to go for the quick fix, which often meant documenting internal controls and processes with manual tools such as spreadsheets, then relying on accountants to review outgoing reports.

Such a workflow requires automated processes, says Dyché. "The demand for data auditability implies a repeatable process around the data," she explains. "Sarbanes-Oxley and other regulations can be a very effective entry point to build these processes.

"Companies have to understand the lineage of their financial data, and executives recognize they also have to formalize the management and tracking of their customer interactions as well as the on-ramps and off-ramps in their supply chains. For every comparison you make for compliance, there are other areas where data auditability could be really key to the business."

5. Leverage your EDW
The metadata stored within an EDW plays an important role in automating data movement from critical systems and applications throughout the enterprise. Data should be automatically loaded from a variety of enterprise operational systems, including ERP, HR, CRM, financials and transaction processing. This allows businesses to sort through the data to extract business intelligence on the fly.

Rawat emphasizes that this needs to be an automatic process, since a manual process across countless databases and applications would be untenable. "The data that's coming in has to be cleaned and validated and profiled," he says.

Above the metadata, the classic environments associated with business intelligence are important tools in the effort. Business intelligence solutions not only can track changes in data as part of the auditing process but also support key performance indicators that keep both executives and shareholders informed about any material changes to the business. Such a capability requires monitoring systems to trigger automated or manual alarms and alerts.

Empowering data and IT departments for the journey ahead
Initially, especially in the case of Sarbanes-Oxley, compliance regulations were seen as the purview of finance departments, which were compelled to meet the letter of the law. But finance departments can not lead, let alone accomplish, fruitful and sustainable compliance on their own. This is an effort that requires an in-depth understanding and stewardship of organizational information resources. This is the time for data and IT executives to step in.

As a sustainable compliance effort goes forward, it is an opportunity for information technology executives to take a leadership role.

"First you need good information or good data that gives you an accurate picture," says Rawat. "When you have an accurate picture, you need to do appropriate kinds of analyses so you can make the right decisions. When you have the right decisions, then you need the mechanism to leverage that information on a timely basis, sometimes in as little as 48 hours. The only way you're going to do this is by setting compliance rules and competitive advantage rules. Compliance is IT's opportunity to shine and to lead."

Sustainable compliance is a part of doing business, a continuous set of initiatives that needs to be integrated into every business process and information flow. As organizations make sustainable compliance a greater part of their day-to-day operations, they will discover more opportunities to simplify, centralize and standardize systems and data from across their enterprises. T