7 Step Guide

to Risk &
Compliance
Safeguard the future of your
organization and make risk and
compliance a top priority
Executive
Summary
In today’s volatile business landscape, one manage risk is also to be expected. In conjunc- now applicable to all market sectors. Take as an quences and potentially an even broader scope
thing that remains a constant is the need for tion with managing internal risks as well as the example the fines being levied for noncompli- than noncompliance.
robust and proactive risk and compliance recent trend in digital disruptors, new techno- ance related to data protection and the use of
management. Whereas in the past, compliance logies and increased global competition, the personal data. In order to meet and address these challenges,
may have been viewed as an unfortunate extra need for organizations to implement strong organizations need to find a better way. Not just
cost, it has become a crucial investment for all risk and compliance frameworks has never been However not all risk is based on regulatory to deal with discrete regulations and to control
organizations to meet the demands created so crucial. Risk management and compliance stipulations; many of the risks faced by organi- risk, but to also to manage the interdepencies
by the pace of global regulatory change, by new have always been important, and are now a criti- zations go far beyond these requirements. In between them. Managing risk and compliance
market entrants, and consumers themselves. cal part of operational and strategic decision a highly competitive marketplace, safeguard- is not simply about managing the regulations and
making, a worthy investment at times of strict ing against reputational risk is an essential risks themselves, but also ensuring that all em-
Over a third of organizations spend at least budget planning and a trend that will only element of success. And every organization is ployees are operating in accordance with your
an entire day per week tracking and analyzing increase with time. faced with operational risks such as appro- risk framework, and that work is being comple-
regulatory change and two thirds of organi- priate staffing and resource distribution. Not ted in a compliant way. Achieving this means en-
zations expect regulators to publish even more Organizations spend considerable time and to mention financial risks, which include any suring employees have access to accurate, up-
regulatory information in the coming year, effort attempting to stay on top of the tracking number of issues from not processing orders to-date procedural information. The translation
according to Thomson Reuters. Therefore, an and reporting required to achieve regulatory correctly to delays in invoicing to employee of regulations into work practices has another
increase in the amount of resources for pro- compliance. Traditionally focused on financial reimbursements. Operational, financial, and major organizational benefit – it provides the
cessing compliance policies and procedures to service and utility companies, regulations are reputational risks will have far reaching conse- audit and documentation trail needed to
demonstrate compliance with regulations.
Introducing
6 7
5
the 7 Steps
Define & Identify & Design & Deploy &
Communicate Document Educate Test

3 4
2
1
Remediate & Monitor & Manage &
Refine Mitigate Improve

The pace, complexity, and impact of

The following 7 step model suggests ways in tion from potential reputational damage and change is affecting every vertical
which organizations can maximize their other unwanted risks, harnessing the potential and company, especially when it
business returns from investing in compliance, and capacity of your whole team is imperative
comes to new regulatory require-
and about the ways in which technology can to success. The following steps will guide you
empower compliance professionals with the in these efforts. We recommend that for each
ments. Incorporating these new
Dr. Gero Decker, regulations directly into your pro-
correct tools to assess impacts of regulations step you consider the suggested outcomes, re-
on the business and operating model, and to view the suggested actions, and then ask what
Co-Founder cesses will safeguard the future of
communicate information effectively. mechanisms you already have which could be & CEO
your organization and make risk
repurposed or reinvigorated to undertake this.
and compliance a top priority.
To ensure that compliance becomes a company-
wide endeavour, safeguarding your organiza-
 Define &

1
Communicate
This first step is about creating a structure to assessing the required impact of a regulation
allow for agile and effective management of on business operations a time consuming
Define framework regulations. Setting your organization up with task. Fortunately, compliance managers are
based on legal/ “good bones” in the form of a well designed no longer forced to rely on manual work-
standardized regulatory system is key. This system must meet flows and untraceable email communication
requirements. the requirements of the particular industry in order to communicate and keep track of
of operation, as well as allow for flexibility, trans- changes. Organizations can work to build single
parency, and scalability to future proof your sources of knowledge within their intranets
organization, and ensure it is able to adapt to that allow tham to update workers about
changing regulatory and audit requirements changes quickly and easily, reducing the risk
as they happen. In other words, your compliance of non-compliant activities.
system must be set up to be and remain com-
pliant itself. Ineffective company cultures are a major source
of risk for organizations . Organizational culture
When designing/defining this type of framework, will affect risk taking behavior, both negatively
it is essential to anticipate and cater for the and positively. It is the ultimate responsibility
audit requirements of the current environment, of the Chief Compliance and Risk Officers to en-
as well as those in the future. Many industries sure the rhetoric from the top filters down to
are required to keep detailed documentation promote desirable behaviour in terms of policy
showing exactly how industry regulations are compliance, risk prevention, whistleblowing
translated into the company’s day-to-day opera- and accountability – and the risk and compliance
tional workings, i.e. the business processes. They structure must support this. This is why inte-
may also be required to demonstrate and prove grating a framework based on legal/standard-
exactly how, and when, communications to ized requirements into a workflow tool is cru-
staff regarding how to work compliantly were cial as a means of keeping everyone involved in
done, and may even require formal acknow- your risk-prone processes up-to-date, and of
ledgement and record of this. The volume and communicating to stakeholders what the neces-
frequency of changes makes the task of sary defence controls are.
 2
Identify &
Document
Risk identification is the foundation of risk the organization’s ability to achieve its strategic
management, as you cannot manage a risk you objectives. On a more specific compliance level,
don’t know about. To ensure this process is it means identifying, prioritizing and assigning
thorough and effective, it is essential to involve accountability for managing compliance in re-
a range of both Subject Matter Experts, and gard to particular laws and regulations. Ensuring
stakeholders – these are the people actually car- the right people are involved, consulted, and
rying out the work. These people hold the keys their feedback factored into the compliance sys-
to both identifying opportunities to improve the tem is essential. Doing this means setting up
business process overall, as well as the ability the basis for communication and collaboration
to offer insights into why work may be completed across the whole system – from meeting the
incorrectly or non-compliantly. For example, if needs of Execs, to those of the employees exe-
certain steps required for compliance conflict cuting on transactional tasks for customers.
with activities related to KPIs and bonuses, you
might find higher instances of non-compliant As both of these broader and more specific risks
behavior. are constantly open to change, it is important Identification, documentation,
that you define a compliance framework that
and prioritization of risks
On a broader level, strategic, operational, is capable of protecting your organization from
financial and reputational risks must also all be risk. This should include not only simply staying
in collaboration with Subject
defined and documented (with clear linkages informed about the latest regulatory updates, Matter Experts and stake-
between strategic, tactical, and operational pro- a huge job in itself, but also incorporating them holders.
cesses and associated risks). This means identi- into business processes and activities, and
fying, prioritizing and assigning accountability training and educating your team accordingly to
for managing any risk significantly impacting ensure a strong compliance culture.
 3
Design &
Educate
Once the initial work to identify, prioritize, and Designing collaboration into your compliance
get input on risks in your organization has system is indispensable. Rules, although neces-
been completed, the next step is to define how sary and important to define, can also in some
the organization will assess and control each cases have the opposite effect of that desired,
risk, and create the supporting process and test by inhibiting independent thought and discus-
structure to accompany this. Again, this step sion, leading many organizations to overlook
should make good use of iterative design of the or misread ambiguous threats. According to
control system, and the deep knowledge your Harvard Business Review, rather than mitigating
people already have regarding the reality of how risk, firms actually incubate risk as they learn
work gets done. This means that the structure to tolerate apparently minor failures and defects
of controls created to manage the risks identi- and treat early warning signals as false alarms
Define and assess fied during the identification stage must be rather than alerts to imminent danger. Creating
controls with supporting tightly bound to the ways in which your real and nurturing a culture of transparency, ques-
employees complete real work. It is also a tioning, and open communication across the
processes, procedures,
rallying cry ensuring collaboration is designed org chart is essential not just for productivity
and test activities.
into the system. and performance, but also compliance and risk
mitigation.
 4
Deploy
& Test
Once the design of exactly how risk and compli- manage risks as well as implementing controls
ance will be measured has been completed, it and test against a variety of scenarios.
is time to automate the actual workings of the
system as much as possible. This has obvious In order to effectively respond to incidents and
benefits, with many areas of the globe enduring to ensure that reported breaches are escalated
a serious shortage of compliance professionals. correctly, an incident model that streamlines
Automation allows you to do more with less. the process and reduces risk should be defined.
Incident handling routines and escalation
Being able to respond in a timely way to inci- routing should include defining the sequence of
dents is imperative to mitigating risks and com- steps, the individuals responsible, the precau-
pliance breaches. Ensuring effective, reactive tions to be taken prior to resolving the incident,
action and defining responsibilities, thresholds timescales for resolution, escalation procedures, Implement workflow
and deadlines is crucial to resolving risk issues and evidence preservation.
processes to manage
before they blow up, costing far more money
(and potentially far more reputational dam- Completing this work manually is possible, but
risks and controls and
age) to fix. Potential risk incidents within an consumes a huge amount of resources and time - test against scenarios.
organization are often quite similar, or follow a and with the constant deluge of new regulations
similar structure and response pattern, defining requiring assessment, can be tricky to provide
incident models will ensure a standardized and for. Many organizations are now beginning to
comprehensive response process. To ensure that use workflow solutions to take the heavy lifting
your framework is fire proof, it is recommend- out of risk system deployment and management,
able that you implement workflow processes to leaving those responsible more time to dedicate
to higher value work.
 5
Remediate
Identify compliance
issues across imple- & Refine
mented compliance
framework, processes, Detecting compliance deviations based on your An efficient deviation handling system should
and procedures. previously defined and documented frame- also implement a mechanism to discriminate
work will allow you to compare “as-required” incidents of compliance deviation based on
processes with “as-implemented” processes their relevance and to objectively categorize
more easily. At this point your current state will them. Figuring out whether or not a compli-
still require some testing in order for you to ance deviation will result in damage to your
recognize gaps and see where certain processes company, your product, or your reputation,
are failing to adequately address and mitigate and whether or not it will result in financial or
risks. This is where identifying compliance issues legal repercussions is an important part of the
across your implemented compliance frame- detection process, allowing you to then manage
work, processes and procedures comes in. As and correctly escalate incidents and to ulti-
with the last step, this can be made much mately identify any potential for “process hard-
more efficient with technology which allows ening.” In this case you may want to consider
you to use the data your business systems are adding extra steps to existing processes, making
already generating, in order to alert risk manag- compliance deviation less likely and adding an
ers to breaches and issues before they become extra fire-wall to ensure that end users do not
a huge and expensive issue. accidentally act in a non-compliant way due to
lack of documentation or discrepancies in your
compliance framework.
Monitor &
Mitigate
Once you have set the wheels in motion and
your framework is in place, it is of equal strategic
importance that you continue to monitor and
report on compliance related behaviour, while
mitigating non-compliance and identified risks.
Responding to incidents consistently and in a
timely fashion, whilst implementing & enfor-
cing routing logic should go hand-in-hand with
and processes is that you can collect data over
time to ensure that nothing goes undocu-
mented, and ensure evidence related to any
incident is kept on record. This is not only
often a legal requirement when it comes to
auditing and external checks, but also useful
to ensure that your compliance and risk related
processes are operating at an optimum level
6
Monitor and report
continual compliance,
while mitigating
non-compliance and
identified risks.
the continuous reassessment of risks. and that ultimately, you stay well ahead of the
competition.
The benefit in having your compliance frame-
work mapped out and documented in workflows
7
Manage &
Improve
Within a holistic and ongoing risk and compli- continual task, as the regulatory landscape is
ance management system is a consistent focus constantly in flux.
on seeking and acting upon ideas to improve.
Monitoring and reporting continual compliance As part of this holistic approach, ensuring that
allows you to have an overview of where your HR policies avoid mutual accountability and
organization currently stands in terms of desir- promote open communication, appropriate esca-
able behaviour and what the current state of lation and whistleblowing reporting is a crucial
compliance is, meaning you can start working on foundation. Personal accountability as well as
the gap between your current and future state. the involvement of suppliers, investors, clients
It also allows you to reward and promote com- and regulators in creating and developing action
pliant behaviour and improvements. Mitigating plans will aid in the promotion of a transparent
non-compliance and identified risks is also a compliance culture.

Continuously monitor
and measure per-
formance, identify
and act on areas
for improvement.
 If you want to learn more
about how Signavio can
enhance your organization's
risk and compliance acti-
Conclusion vities, sign up for one of our
free webinars, or come
and chat with us at one of
our events in your area.
These steps are of course not the definitive or If you are ready to take the
final word on how to undertake an organiza- products for a test drive
tional transformation. They are however based and really see what they can
on expert experience and lessons learned over do, register for a free per-
the course of decades of compliance system
sonalized demo at:
design. They are intended to provide you with
the mindset and insights to steer your organi- [Link]
zation through the complex, often messy, but
ultimately rewarding process of transforma-
tion. We encourage you to adapt and augment
the steps to match your organizational context,
while taking note of the underlying themes of
communication, inclusion, collaboration, and
smart monitoring.

Effectively translating strategy into action is

the cornerstone of transformation, we hope
this guide will support you in creating positive
behaviors and mitigating threats you will en-
counter as your organization embarks on this
journey by providing insights from others who
have gone before.

See a personalized
Signavio demo