Convercent Analytics eBook by Christopher Economakos

Improving Compliance with the Power of Analytics How new GRC platforms make it easier to measure the performance of your compliance program, improve those efforts and report the results to your board.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Introduction Top priorities for anyone involved with compliance include assessing organizational risk and continually improving compliance efforts to reduce that exposure. But like every business process, you have to measure performance in order to improve it—and getting good data about compliance efforts has been a perennial challenge for many organizations. Compliance officers often spend days or weeks creating reports from information housed in separate Excel files, SharePoint libraries and even old-fashioned filing cabinets. Where digital data is available, it often must be extracted and unified from separate systems that handle issue intake, case management, policies and education programs. Anyone who’s struggled with a siloed system like this might assume the only solution is a complicated, expensive product or a custom systems integration. But you don’t have to be stuck between fragmented GRC tools and high-priced analytics platform. A new generation of compliance platforms exists that integrate policies, values, education and case management into a single system that includes built-in analytics. This unified reporting structure helps compliance officers get a snapshot of their organizational risk at any time, while also letting them dive deep into areas of concern and generate custom reports—all from one interface. How big an impact could better analytics have on your compliance program? Here are four examples of how good data and reporting tools make it simpler to achieve critical measurement and reporting goals.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Monitoring risk and compliance performance.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Goal:

You want to quickly review—at any time—important details about your compliance efforts, such as newly-reported issues, the status of ongoing investigations or updates on attestation rates for a new policy campaign.

Tip: Important types of metrics to track include: Number (e.g., incidents, policies, surveys, etc.); Frequency (e.g., how often issues are reported or training delivered); Flagged (e.g., policies requiring review or locations with higher incident levels); Ranking (e.g., severity of incidents); Trends (e.g., training completion rates); and Relationships (e.g., incident trends to training completion rate).

The old way: Without a central system to record all compliance data, you have to track down that information from disparate sources—if it’s available at all. If separate departments or managers don’t follow the same approach to filling out their own spreadsheets, you also have to normalize the data to compare figures company-wide. Assuming you even wanted to go through that process, the information could be out of date by the time you completed your snapshot.

The new way: New GRC platforms with dashboards provide a real-time picture of organizational risk and the health of your compliance program. One login can bring up a screen showing a high-level view of important metrics related to case management, policy management, education initiatives and company values. And because all members of the compliance team use the same system, you can see up-to-date information about aspects of the program that you don’t manage directly.

Look for a system dashboard that provides: • Reports of new issues alongside recent history, so you can track trends. • The status of ongoing investigations. • Attestation rates and the amount of time left to collect employee signatures. • Notifications for policies that need updating or pending campaigns to run. • Training course completion rates.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Analyzing trends and identifying operational needs.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Goal:

You want to step back from recent events to examine trends and identify priorities for your program.

Missed opportunities: Only 28% of compliance executives said they regularly review data analytics to find ways to improve compliance. 66% take an ad-hoc approach to using analytics, or they don’t use analytics at all.1

The old way: You might have to extract information from separate systems, such as a hotline and an HR database, and then create a spreadsheet on which to normalize and synchronize that data. But for some organizations, the process is also a paper chase: If you think an employee named in a recent issue was involved in a similar situation last year, you might have to pull old investigation reports from a filing cabinet. Or, to compare training rates between departments, you might have to manually cross-check employee names from training course sign-up sheets and sort them by department.

The new way: Integrated systems with built-in reporting let you automatically drill down into specific areas of your compliance program and sort data in a number of ways. For example, you could examine the past quarter’s issues by type, location or department. You could also run reports to help you plan next steps, such as examining policy attestation rate trends to identify campaigns you need to schedule.

Look for a system with reporting capability that allows you to: • Identify issues by type and department. • Track policy attestation rates by region, department and office. • Track completion rates for training courses. • Prioritize campaigns for policy distribution and training programs. • Link individuals back to policy attestations, completed training courses and issues/investigations they’ve been named in.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Anticipating problems and preventing issues.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Goal:

You want to take a more proactive approach to your compliance efforts by looking for signs of trouble you can address before they become major problems.

Another benefit of integrated data: Audit trails. You can clearly show audit committees or regulators proof of policy updates, policy distribution, employee attestation and training completion rates, and steps taken in response to incident reports.

The old way: Starting with the same manual data analysis used to identify current trends, you could then cross-check performance in specific areas to look for potential correlations between issues, policy status, training levels or other factors. Or, you can use employee surveys to gauge understanding of policies. But it takes time to field those surveys, analyze results and make plans for new initiatives based on the findings—time that could leave your organization exposed to risk.

The new way: Integrated data lets you easily cross-check among the functions of your compliance program to look for potential correlations between recent issues, policy health or training initiatives. For example, if you notice an increase in issues related to bribery you could immediately analyze where those issues are coming from. If they appear to be concentrated in one office, you can quickly check attestation rates and training history for your policy related to the Foreign Corrupt Practices Act. If either of those figures appears lower than average, you can launch a new training campaign to prevent major violations—or to protect your organization against the actions of a rogue employee, as Morgan Stanley was able to do in 2012 when it proved to the Department of Justice that its compliance program had amply trained an employee charged with FCPA violations.

To enable a more proactive compliance approach, look for a platform that: • Integrates data from all aspects of your program in one interface, allowing you to drill down from a trend report to a specific issue or individual with a few clicks. • Enables you to segment data by region, department, office and individual employees. • Lets you establish milestones and reminders for policy updates or future campaigns. • Provides early-warning alerts for potentially serious trends, such as an increase in issues related to a certain topic or lower-than-average attestation rates at a particular location.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Creating external reports.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Goal:

Whether it’s monthly, quarterly or annually, you periodically must report to the board or executive committee on the state of your compliance program and organizational risk.

Which manual steps in your report development process could be improved? Ask yourself these three questions: 1. Do I have to contact other managers to get updated Excel charts? 2. Do I have to contact IT when preparing a report? 3. Do I have a complex data aggregation process?

The old way: Creating reports starts with the same manual data extraction from separate spreadsheets, platforms or databases. In larger organizations, you might also have to rely on individuals in charge of separate aspects of you compliance program to provide the necessary data. Once you’ve gathered all the data, you must enter it in spreadsheets to create pivot tables summarizing key compliance data, and generate charts you can add to a slide presentation. The data could be days or weeks old by the time you finish the report and present it to the board or executive committee.

The new way: New GRC platforms integrate directly with programs such as Excel and PowerPoint, allowing you to import real-time data from all functions of your compliance program directly into pivot tables and charts. You can transform raw data into a slide presentation with a few clicks. And once you’ve created a chart, you can automatically update it with fresh data each month or each quarter.

Look for reporting tools that: • Make it easy to create custom reports, such as measuring the impact of a new training program on the rate of issues and investigations. • Allow you to easily turn raw compliance data into charts that help executives and board members visualize organizational risk and compliance issues. • Integrate directly with Excel and PowerPoint to automatically update reports with current data.

Ethics through insight. 10

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Conclusion When compliance data is easy to capture and analyze, your reporting is no longer limited to static records of historical performance. Data becomes a tool you can use any time—and in multiple ways—to highlight your program’s current strengths and weaknesses, and point the way forward. Analytics have already proven indispensable in other business functions, such as finance and marketing. Now, new technology is giving compliance officers the same ability to connect the dots within the data to improve their overall results. With better analytics, you can reduce risk, increase your efficiency, and make it easier to demonstrate the value of your organization’s compliance efforts to executives and board members.

Ethics through insight.

IMPROVING COMPLIANCE WITH THE POWER OF ANALYTICS

Convercent is turning compliance on its head. Through the industry’s first intelligent dashboard, we give you multi-dimensional insight into your company’s health. Our integrated compliance and analytics solution builds healthy organizations by continuously assessing and managing company policies, tracking employee education and streamlining case management—all while keeping a solid emphasis on your company values. The cloud-based solution is fast to set up, easy to use and accessible from any device or location. It’s an interactive approach to turning insight into improvement and awareness into alignment. Changing your view of compliance can transform your organization. convercent.com Follow us:

Ethics through insight. 12