The EU General Data Protection Requirement (GDPR) has many companies scrambling to understand just how to meet compliance. In most industries, the notion of complying with regulatory compliance obligation in some sense is not new, but the scope of that landscape continuously changes.
From Financial Services to Life Sciences, executive leadership and their respective boards face the challenge of meeting regulatory expectations while continuing to grow and increase revenue. What heightens attention related to compliance and regulatory obligations is the possibility of non-compliance accompanied with a potential financial consequence. How can organizations manage the changing waves of compliance?
Make It Part of the Culture
An organization builds a compliance process through the mission, values, and goals they distill down to the people through culture. The compliance and regulatory obligations are another opportunity for an organization to demonstrate their commitment to its shareholders, employees, customers, and clients by making security, privacy, and risk responsibilities part of the culture.
It simply boils down to caring for your people. Individuals want to feel safe, watched over, and protected from harm. Laws, regulations, and industry directives provide guidance and oversight as to how companies can create this environment for those who work for them and those they service.
Create Systematic and Repeatable Processes
This is often the most difficult activity to get started because of the high emotion related to the word compliance, audit, and financial consequence. Nobody likes to hear what is going wrong but by establishing repeatable processes an organization can demonstrate due diligence and ongoing commitment to continuous improvement.
Gap assessment, audit feedback, and internal feedback are all beneficial when supporting an organization’s effort to launch the first step. It comes down to identifying the needs and implementing processes in alignment with leadership priorities and their associated risk tolerance levels.
Plan, Do, Check, Act, Repeat
Meeting compliance obligations essentially comes down to establishing a baseline plan, implementing critical functions of the plan, monitoring and reporting on performance, and adjusting the plan for improvement and growth.
Strategy is an activity every organization performs annually and a strategy related to compliance, security, privacy, and risk should be part of the overall strategy.
Make it easy for your organization to evidence their commitment to the cause and adapt easily as laws and regulations change.
Communicate Often
Documentation, training, and internal meetings are just part of the communication process and all are important in building an organizational brand. Oftentimes, the negative news related to a breach goes viral before the real story is clear. However, companies have overcome the potential PR hit in these situations because of their culture, brand, and the confidence the public trust has in the company.
In the end, this trust is what makes or breaks any relationship including the one with your organization. So take control over what you can do to build that trust – both inside and outside of the company.
Managing the regulatory landscape of your organization does not have to be a hindrance. It is simply a matter of making it an expected part of your culture and community.
