There are always never ending discussions on who should have a seat on the board, who should report to who… the CIO should report to the board, now CISO, CDO or CCO should be part of the Excom … There is no definitive answer on that. It depends on the industry the CCO is working in and the maturity of the company in this area. The two are often intertwined. In a highly regulated environment, the CCO should definitely be a member of the Executive Committee, and have a voice about the strategy of the company. In other domains where compliance is less vital, the role will always be important due to its compulsory aspect of compliance. Discussion with business users must be regular, to educate them about compliance and the impact their day-to-day responsibilities on compliance so that they and to implement the necessary controls. The executive team must be regularly updated about this topic.

Risk Management Framework Brings Visibility to Compliance Risks

I strongly feel that treating compliance through the risk management prism is the best angle to take. Compliance risk must be evaluated and monitored in the risk map of the company. But we shouldn’t only evaluate the risks associated with not being compliant. We also need to evaluate how being compliant will reduce other risks in the company. This avoids managing regulatory compliance as merely a “check the box” exercise. Regulations are there to reduce risks. So it is usually in the interest of the company to comply with regulations. Having solid financial practices, managing privacy of its customers, having a strong cyber security, fighting frauds… Doing that properly is by essence good for the Business and should be reflected in the risk mitigation plans of the company.

No silver bullets Technologies for Compliance

There is no technological silver bullet in the area of compliance. It is, before anything, a matter of processes and behavior. Nevertheless, technology can help of course.

The market of GRC tools (Governance, Risk and Compliance) has existed for years but it is still very costly and complex to implement. One of the main wishes would be a tool that, based on the countries your company is operating in, would list all the regulations with which you would have to comply. Then it would produce a template of processes and controls to help roll out, allowing automation of controls, and storage of evidences. But it would always still require manual work and integration. I never trust a technology vendor that claims their solution will allow me to be compliant. I have seen that in the past with SOX, we can see it again with GDPR. Most of the time it can help—in certain conditions—for a specific scope.