‘Tis the season for roasting chestnuts, trimming trees, reflecting on the fading year, and making 2012 business-world predictions. Atlanta-based software firm Compliance 360 has released its forecast of the major trends in corporate governance, risk, audit, and compliance management in the coming year.
The firm offers governance, risk, and compliance (GRC) software and services to clients in the highly regulated health care, insurance, and financial services industries. Steve McGraw, president and CEO of Compliance 360, says the firm based its list on formal and informal client surveys, market trends, and analysis of legislative and regulatory issues at the federal and state levels.
McGraw says that as the attention of regulatory bodies focuses increasingly on GRC, corporations and their directors need to shore up their oversight programs. Key trends to keep in mind in 2012 include:
- Growing threats from whistleblower “bounty hunters.”
- The importance of demonstrating compliance effectiveness.
- An increased focus on the ‘G’ in GRC.
- GRC becoming seen as central strategic components to the CEO and board of directors.
- More reliance on analytics.
The first two are tightly linked, says Scot McLeod, Compliance 360′s VP of marketing. “Needing the ability to demonstrate that you have an effective compliance program is largely driven by the increasing threats noted in the first topic,” says McLeod.
In the post-Dodd-Frank era, regulatory agencies have increased incentives for employees to report wrongdoing, says McGraw. With formal SEC and Consumer Financial Protection Bureau whistleblower bounty provisions in place, compliance officers and directors will need to protect institutional brands by having solid compliance programs.
And whereas historically regulators were more satisfied with the mere implementation of compliance programs, now they are demanding that companies demonstrate that the programs are effective in order to reduce liability. “It’s not good enough just to say you have a compliance program,” says McGraw. “You actually need to take the extra step and demonstrate that your program is in place and is effective.”
Because of the new bounty provisions, companies are doing everything that they can to encourage employees to report suspected wrongdoing internally before going to the government. “One of the keys to that is making sure that the employees have a high degree of confidence in the compliance program within the company,” says McLeod.
Companies can increase employee confidence by demonstrating that their compliance department will follow up in earnest on issues employees have reported. McGraw and McLeod have seen some clients “sanitize” claims (to protect privacy) and post them on in-house blogs as examples of what is being reported.
Corporate boards are also becoming more active players in the GRC equation. In the past, governance was seen as less important than risk and compliance; but, McGraw says, “The ‘G’ is finally achieving parity with the risk and compliance activities.” Across most of corporate America, he sees boards stepping up their focus on risk management and compliance issues that put value back into the organization.
McGraw says boards are also recognizing the value of GRC from a strategic standpoint: “We have a client that has told us that because they have such an effective compliance program in place, when they move to make an acquisition, they use the compliance program as a way to get regulators comfortable with them being the likely acquirer–as opposed to one of their competitors.”
And to deploy GRC in any capacity–strategic or otherwise– a robust program in 2012 will need to have good analytics on hand. Companies will have to be able to successfully manage and analyze applicable laws and regulations, as well as data mined from their own employees.
See also: “In-House Compliance Requires Company-Wide Efforts,” CorpCounsel, December 2011.
