Are you in compliance?

Don't miss out! Sign up today for our weekly newsletters and stay abreast of important GRC-related information and news.

Three big reasons for automating regulatory change management

French Caldwell | July 28, 2016

Keeping on top of regulatory change can be a costly and time-consuming exercise. Many enterprises in financial services, life sciences, healthcare, and other heavily regulated industries must monitor multiple information sources to get news of changes that may impact them. When relevant changes are identified, impact assessments must be carried out to determine required action; then resulting policy, process, control, and system changes must be implemented and post-implementation audits conducted to assure compliance.

Such changes don’t happen infrequently, either. Neither are they confined to isolated parts of the business. There are both industry-specific laws like banking reform or pharmaceutical clinical trials, and cross-industry rules like anti-bribery laws, privacy rules, and employment laws.

New rules and regulations are promulgated almost daily in all industries; hence, regulatory change management (RCM) is a must-do activity. Not only is there a potential for fines and penalties, with heightened public expectations for industry behavior, effective and efficient RCM is essential to protect and preserve the company’s brand and reputation. By improving and automating RCM, changes can be implemented with less invasiveness and fewer resources, meaning businesses can perform better in their day-to-day operations. Not only that, but if it’s done well, RCM can be elevated from a pure cost center by providing timely regulatory intelligence to support decision-making.

Reliance on manual processes
A survey of 123 compliance professionals conducted by MetricStream Research last year found that nearly half (48 percent) still use office productivity software like spreadsheets to track regulatory changes. The respondents also said that implementing change resulting from regulation can be slow with almost half admitting it takes over a month.

The resourcing impact of this manual process for managing regulatory change is significant. Enterprises of all sizes it would seem, are throwing people at the activity. Over 30 percent of large businesses surveyed revealed they devote 21 or more employees full-time, while over a one-third of mid-sized businesses assign between three and ten employees and over 45 percent of small businesses, one to two.

It’s a significant burden. Small and medium-sized businesses in particular don’t have the capacity to tie up so many people on regulatory activity.

Over 50 percent of respondents with RCM responsibilities reported that monitoring sources of regulatory intelligence for a new regulation, or changes to existing regulations, is part of their role. The top three information sources used are regulatory agency filings and releases, industry and trade associations and trade industry publications.

It’s a lot to keep track of manually. The number of people that businesses are having to assign to do it, and the amount of time they’re spending implementing change, demonstrate that there is significant scope for process improvement.

Intelligent automation
RCM, including monitoring for new rules and changes to existing rules, conducting the impact assessment, changing policies, procedures, processes and controls, and auditing the changes needs to be comprehensive; it needs to be integral to business operations and, as far as is possible, automated.

With an RCM application, an organization can track regulatory updates from multiple sources, trigger alerts, automate impact assessments, and set tasks to take action on process and policy updates and/or staff training. Flexible workflows can route regulatory changes for review, analysis, and action, and tests carried out post-implementation can confirm that the correct action was taken. Dashboards that monitor and track regulatory changes and impacts can serve to identify risk patterns and trends that can be used in business planning to enhance the organization’s performance; for instance, in assessing the regulatory impact of new products or deploying.

With regulation comes responsibility and transparency. Companies can invest significant resource in not only doing the right thing, but also in showing that they’re doing the right thing. The same automatic reporting and dashboard generation that demonstrates compliance with regulations can also be used to track public interest issues and demonstrate the achievement of sustainability goals.

Yet despite the benefits of a technology-led approach, RCM software on a governance, risk, and compliance (GRC) platform and niche RCM software were each reported in use by only 8.1 percent of our survey’s respondents.

From cost center to value-add
Just keeping on top of the day-to-day demands of regulatory change is stretching for organizations. And if a lot of firefighting is going on, there won’t be much room left to concentrate on getting ahead of the game. Yet, having the wherewithal to anticipate what’s on the regulatory horizon, and being ready with an assessment of its likely impact on the business, confers a competitive advantage on companies.

This kind of GRC intelligence can turn the activities of RCM from cost drain into value-add. Looking ahead, gaining an understanding of the changes taking place in national and international markets and having clear insight into the rules and regulations affecting markets of interest can help businesses make more confident decisions; for example, when launching a new product and entering new markets.

Regulations are far-reaching and complex, and continued reliance on manual tools and over-resourcing isn’t providing the required level of efficiency, visibility and productivity that companies need to perform well at RCM.

Current methods of tackling RCM are costing time, money and resource, and, as businesses struggle to respond to the demands of tracking and managing regulatory change, are unsustainable in the long run. Being constantly reactive businesses, are unable to generate value-add information on the regulatory landscape that would put them ahead of their competition, enable them to take action sooner and to be prepared when taking the next step in business, such as market expansion.

Automating and streamlining RCM processes enables businesses to track regulatory changes more efficiently, to automatically notify affected business units of change, simplify impact analysis and implement updates through collaborative workflows and effective task management.

Such a solution not only improves day to day operations, by making RCM more efficient and productive and cutting the cost of compliance, but gives businesses the confidence and intelligence they need to make better decisions. Businesses that integrate RCM into the fabric of their organization and automate activities as part of a larger GRC framework will be best placed to protect against regulatory non-compliance, perform well, and enjoy a competitive advantage.