This blog is published by

Mahendra Patukuri

The global business climate is always on a churn owing to various reasons. Sometimes it is technology, sometimes its politics at other times it geo-strategy. Whatever the reason be, laws and rules keep changing.  Regulation has become the order of the day.

Every geographical region, Industry and business line has a different set of IT regulations…if we look at the US regulations, only Sarbanes–Oxley, HIPAA, and now Dodd Frank.  Even in Dodd Frank there are sets of regulations getting ratified by the Congress over different periods of time.  When we move to Europe, SEPA (Single Euro payment Area) compliance is an issue being faced by banking industry.  The recent exit of the United Kingdom (UK) from the Eurozone might just necessitate a change in SEPA as well which we will have to see.  The crux of the matter is that the regulatory landscape is getting increasingly complicated which makes it almost impossible to gauge and manage.  The only way to ensure compliance today is to monitor and adhere continuously, so as to meet the regulations and the deadlines for their compliance.

Businesses need to comply with all of these. Compliance is often made possible by employing several teams working in silos.  One team usually doesn’t know what the other is doing. Duplication of effort is rampant and an exercise that is already expensive is rendered even more costly.

In an environment that is already facing cost pressures, cost rationalization is the need of the hour.  If there is a way in which comprehensive compliance can be assured, a lot of cost savings can be realized.  The Unified Compliance framework is one such resource that allows organizations to establish the best practices for managing and maintaining compliance.

The Unified Compliance Framework (UCF) attempts to find the commonalities between different compliance mandates, distinguish the overlaps and to construct the compliance for a company based on what’s already there.  This usually simplifies the scoping, defining and ensuring compliance.  Unified Compliance Framework has identified the 19 core elements of Governance and Compliance.  These 19 define the common language and content of all compliance and governance controls, which are connected in a top down hierarchy.  UCF finds overlapping compliance requirements across regulations.  UCF helps organizations with all the Four key compliance areas of Scope, Define, Maintain and gather evidence.  In other words it is right from having a database which integrates the legal and technical data for SMEs, lawyers and compliance officers to the capability of tracking changes required by new updated laws.  It also allows gathering evidence from security solutions and helps continuous monitoring, reporting and audit data collection.  UCF covers Payment Card Industry Data Security Standard (PCI DSS), The Sarbanes-Oxley Act, those promoted by the National Institute of Standards and Technology and many more national, state and global regulations.

The Unified Compliance Framework (UCF) essentially helps in reducing redundant Governance, Risk and Compliance (GRC processes).  When UCF is combined with software and Apps that allow the execution, documentation, reporting and follow up of the compliance obligations of a company the whole system is called Unified Compliance Management system (UCMs).  UCMs automate IT compliance management.

The key functions carried out by UCMs include –

• Standardization – gathering of all data, documentation and reports for all units and operations in a single place
• Providing a structure – Accessibility and user friendliness, single data entry and multiple copying as needed, re-use of requirement specification, documentation, interpretations, experiences and guidelines
• Simplification – Allows better control on reporting and KPIs. It enables the compliance teams to resolve conflicts which are commonly created by overlapping documentation. It allows the compliance teams to perform a common audit across multiple regulations, standards and guidelines
• Reduction of costs and non-compliance risks
• Time savings
• Limited legal liability
• Improving the IT governance – Provide the customers a clear view of their IT governance programs and helps shift the program focus on the right areas for better risk management and compliance monitoring.

With the help of UCMs the organizations can map internal policies, standards, & controls to UCF Controls, along with mapping Internal Risk assessments to authority documents and citations

Regulatory compliance is a monster exercise and it does have the potential to boil into a mess of legalities.  If not done properly or not monitored and updated properly, the costs could be immense, which is unavoidable.  Unified Compliance management does offer hope in terms of the Unified Compliance Framework.  If adhered and implemented properly it could ameliorate a lot of pain and hardships associated with compliance.

Read complete blog