Conformance to compliance is no longer driven solely by regulatory fear, as has been the case traditionally. It is rather a matter of business and competitive requirements becoming the prime driving force behind adherence to compliance.

As compliance becomes a business imperative, its becoming increasingly important for CIOs to understand its landscape and impact on the organizations IT infrastructure and strategy.

Fitting in with IT
In todays compliance scenario, information storage, management, and protection have become the most pressing issues which businesses across verticals like telecom, BFSI, BPO/ITeS, healthcare, and even the government have to deal with.

Nowadays, CIOs are more involved in not only functional but also strategic decisions made in the company. So, CIOs need to understand the importance of making an investment on compliance and the benefits of RoI.

Compliance is a broad topic and encompasses factors like ability to retrieve data within the recovery point objectives (RPOs) and recovery time objectives (RTOs), ability to secure data against unauthorized access, the ease of portability of data, in line with the technology changes, and protection against accidental/fraudulent modifications.

Business Imperatives
Compliance has witnessed a transition from just being a buzzword that the whole world was talking about to an imperative survival issue for the corporate world. Fines, penalties, legal hassles, and loss of reputation for non-compliance are driving companies to pay heed to this issue on a serious note.

Compliance rules could originate from various sources including government regulations, corporate governance requirements, and internal company policies, among others.

In India, SEBI has recently initiated adjudication proceedings against twenty companies for non-compliance with Clause 49 (which deals with corporate governance) norms under their listing agreement with stock exchanges. Additionally, there are numerous examples of financial malfeasance due to fraudulent accounting practicesEnron, WorldCom, Tyco Global, and Computer Associates.

The Takers
The main takers of compliance are the companies which deal with the US or European clients. There is a need to have adequate safeguards and policies in place to comply with the regulations and data privacy norms in their clients home countries.

Overall, the industry verticals most affected are: banking and financeneed to comply with BASEL II, GLBA, PCI/DSS, and SOX (if the bank is listed in the US) and rules laid down by the regulator; IT and ITESneed to comply with SOX (if the company is listed in the US) and privacy laws of the countries where they operate; healthcareHIPPA.

Compliance Diary
Almost all Indian companies doing business with Nasdaq-listed companies fall under the purview of SOX (Sarbanes Oxley Act). BPO companies in India are legally obliged to abide by the regulations that their clients followthe Sarbanes Oxley Act, the Gramm Leach Bliley Act, the EU Data Protection Act, and the HIPAA. Specific regulations in India mandate how companies need to manage and store their information assets. These include the IT Act, the Indian Evidence Act, and SEBI Clause 49.

In the banking vertical, one of the most important regulatory compliances is Basel II (the RBI has specified that all banks have to confirm to the Basel II guidelines).

Taking the example of the banking industry, the RBI has indicated a requirement for record retention so that messages required for business and regulatory reasons are safely stored and easily retrievable.

For government departments/agencies coming under the ambit of the RTI, 2005, the concerned organization needs to ...maintain all its records duly catalogued and indexed in a manner that facilitates the right to information under this Act, and ensure all records that are appropriate to be computerized are computerized and connected through a network all over the country on different systems so that access to such records is facilitated.

With increasing reliance on electronic records to support litigation efforts, the need to prove that those records are not tampered with is becoming another requirement.

There are corporate governance norms like Basel II in the banking industry, and SEBIs Clause 49 that, in general, dont mandate specific compliance requirements from a technical perspective, but are nevertheless important guiding factors when organizations look at their internal control policies with regard to data retention, data access, and data security.

In response to IT compliance challenges, organizations are increasingly looking at ways to minimize fragmented initiatives, automate procedures and IT security controls, and apply best practices to reduce risk and to comply with different regulatory compliance.

Shipra Malhotra
shipram@cybermedia.co.in

Page(s)   1