Compliance Overview

Definition

• Compliance is the process of adhering to standards.
• Standards can be regulations, laws, or agreements with third parties.

Importance of Compliance

• Non-compliance can lead to penalties such as fines, job loss, or incarceration.
• Compliance may be local, national, or international.

Internal and External Compliance

• Internal Compliance:
  • Managed by a central compliance officer (CCO).
  • Responsible for ensuring adherence to all regulatory requirements.
  • Provides compliance status updates.
• External Compliance:
  • Involves meeting third-party requirements.
  • May require regular reporting and documentation.

Regulatory Compliance Examples

• Sarbanes-Oxley Act (SOX): Focuses on public company accounting reform.
• Health Insurance Portability and Accountability Act (HIPAA): Ensures privacy of medical information.
• Graham-Leach-Bliley Act (GLBA): Relates to financial privacy and information sharing.

Penalties for Non-Compliance

• Severe penalties including fines and imprisonment, e.g.,
  • HIPAA violations: Up to $250,000 in fines and 10 years imprisonment.
  • Civil fines may reach up to $225,000 for identical requirement violations.

Reputational Damage

• Disclosure requirements for breaches can impact reputation and stock prices.
• Example: Uber's 2016 data breach led to $148 million in fines and reputational harm.

Compliance and Licensing

• Non-compliance may result in loss of necessary licenses, impacting economic performance.
• Sanctioned companies may face purchasing restrictions from other organizations.

Contractual Compliance

• Agreements between organizations may require maintaining compliance.
• Breach of contract for non-compliance can be resolved privately.

Compliance Monitoring

• Due Diligence vs. Due Care:
  • Due diligence: Activities with third parties.
  • Due care: Internal activities.
• Attestation and Acknowledgement:
  • Executives sign off on compliance status.
• Ongoing Monitoring:
  • Essential for large companies with multiple compliance needs.
  • Automated systems often used for tracking and reporting compliance.

Automation in Compliance

• Varies by company type and compliance requirements.
• Market available for automated compliance monitoring systems.
• Systems collect data from internal and external sources to ensure compliance.