Compliance


Hide Menu

Compliance is either a state of being in accordance with established guidelines, specifications, or legislation or the process of becoming so. It is, in general, conformity to a rule, policy, standard or law that has been clearly defined. In most countries, generally means compliance with laws and regulations and these laws can have criminal or civil penalties when not observed properly.

What are the benefits of compliance?

It also makes it easier for an organization to pinpoint flaws in its system or improve existing standards that fail to meet the company or business’ goals. In a corporate setting, more and more companies are using “key performance indicators” for years to track data that can help measure progress toward whatever goals a company has. Which compliance indicators are relevant to the organization are dependent on the organization’s goals.

Best Practices in IT Security


Implementation of best practices in IT security helps evaluate the rank of the organization on the list of successful enterprises. IT security is meant for healthcare facilities, banks and other business institutions.  Compliance with best practices in IT security differs from company-to-company based on the company’s management and leverage on security awareness and employee training. There are some recommended practices to ensure effective IT Security:

Best Practice One

Quarterly Training on Security and Compliance: This business practice reduces the rate of failure by 77%. Human error due to lack of training has great negative impact on business processes and controls. It is recommended that CEOs implement automation processes to compensate lack of training.

Best Practice Two

Encrypt Cloud Transactions And Cloud Data: Compliance with this business practice reduces failure rate to 64%. Most managers are unaware of the fact that most cloud software applications don’t encrypt by default. Therefore, it is recommended to install third-party technologies that have the capacity to encrypt cloud data. This is important in order to ensure security and maintain privacy of data.

Best Practice Three

Make Use Of Encryption Technology Throughout The Business Enterprise: Compliance with this recommended practice will reduce failure rate to 10%. Failure to implement encryption throughout the company will lead to the risk of exposing keys and certificates meant for controlled access to secure data. Therefore, managers must ensure management of encryption assets throughout the enterprise.

Best Practice Four

Install Management Processes: Compliance with this reduces the rate of failure to 55%. This practice is important in order to ensure continuity of the business even if Certificate Authority is compromised. Digital certificates are the most the important piece of security technology, because they are ever-present. However, they can be breached easily, and managers must have immediate replacement certificates with generated encryption keys for immediate backup.

Best Practice Five

Rotate SSH Keys Annually: Employee turnover rate is one of the few unpredictable risks that managers have to take over a period of two years. Through compliance with this best practice, failure rate reduces by 82%. The SSH Key provides the administrators with access to critical data and systems. If the keys are not rotated more frequently, there is a risk of getting compromised by unauthorized access. Malicious and former employees pose a direct threat to security of sensitive data. Therefore, managers can install technology that automates key rotation and simplifies the process.

Organizations that succeeded in compliance with all five of these best practices have significant operational risk management. It is important to mention that when IT security is breached, the reputation of the company is at stake. It costs a lot to recover from security breach when it comes to IT systems. This is why there have been new laws to control breaches through proactive and stringent security measures.

Internet Security Best Practices


Implementing best practices to ensure internet security is not an easy task. An ‘Information Officer’ is the key player that ensures that there is compliance with the internet security requirements. An accomplished Information Officer must have the ability to take further duties that come with this full-time job.

Need for internet security arises when there is obvious threat to confidential and sensitive company data. Failure in compliance with data management best practices often compromises the company. Consequences of this impact the reputation of the business. Moreover, it leads to financial losses and distrust in customers. Best practices required to ensure proper internet security include:

Use of End User Guidelines: The biggest problem IT dependent businesses face is misuse of computers by employees. Employees must be instructed on things they can and cannot do with company property. Downloading games and using tools for internet messaging must have limitations.

Regular Software Updates and Use of Patches: Information Officers must keep constant check on whether regular software updates and patches are used appropriately. Software applications that have not been updated or that don’t have operational patches are open to threats. There have to be personal rules on these activities to ensure that information security is functioning correctly.

Vendor Management: When third parties are involved as web hosting and internet services there is the threat of security downfall. If the provider gets compromised, so do its clients. The bottom-line is that lack of vendor management guidelines is a direct threat to customer’s privacy. Therefore make sure that vendor management best practices are dependable.

Physical Security: In every business enterprise, softcopies of sensitive data are stored for backup and future reference. Entry to unauthorized personnel to the server room must be monitored and restricted. Physical security must be deployed to minimize the risk of violation of data security. Files and documents not to be used must be destroyed immediately.

Retention and Data Classification: Breach of security is bad enough. It is even worse to have breach of data that shouldn’t have been retained in the first place. Therefore, it is a recommended best practice that data must be classified. For example, classify them into economic and financial. This makes data management efficient and effective.

Passwords Guidelines and Requirements: The complicated requirements for passwords get, the higher the chances are that employees will write the password down. Written-down passwords increase the risk of breach. To ensure security, use simple requirements for passwords. Additionally enlighten employees about guidelines to follow regarding password security.

Wireless Networking: Implementation of wireless network has become a recommended best practice because it saves time and money. Encryption of data ensures compliance with data management standards.

Employee Training: Compliance with internet security requires that employees are trained on use of software applications. Employees must abide by instructions and policies about software applications to maintain internet security.

These best practices are the key to successful internet security in every business enterprise. This includes banks as well. Mobile banking and internet banking require strict internet security measures.

IT Data Security: ISO 17799


Data security requires specific guidelines to ensure that large business enterprises can protect sensitive information. Sensitive data usually refers to credit card details and passwords used over the network. Breach of security can lead to legal action by angry customers for violating their privacy. Therefore, there are many best practices that have been introduced into organizations to ensure optimal data security. However, very few have succeeded.

The main problem that leads to breach of data security is lack of compliance with specific guidelines. This is why the ISO 17799 was established. It was later renamed to ISO 27002 when new updates were included into the guidelines.

ISO 17799/27002

This is a comprehensive and in depth guide on data security. It provides specific guidelines for managers and Information Officers to be able to implement Compliance. The approach is supposed to be methodical and calculated. Additionally, employees must be committed to making sure that data security is not breached in any case. They will have to learn to make use of appropriate tools and software applications. Employees must be aware that there will consequences for failure. This is the only way to make sure best practices are adopted effectively.

ISO 17799 is a set of instructions or guidelines that were established by the International Organization for Standardization. They are meant to ensure that sensitive data about customers and clients are secure. These guidelines ensure compliance with the following security management controls and objectives:

  • Security of data and assets
  • Security of workers and their property
  • Prevent stealing and theft at the office
  • Ensure smooth services for customers
  • Ensure that all best practices are implemented effectively

Credit Card Standard with ISO 17799/27002

In compliance with the guidelines governing data security, there are standards that must be followed by companies dealing with PCI credit cards. The current set of ISO 27002 guidelines comprises of a six step approach to best practices:

  • Network Security
  • Data Safety Measures
  • Updated Security System
  • Strong Passwords and Restrictions
  • Monitor Network Failure and Invasion
  • Backup Plans

Companies that have so far succeeded with implementation of compliance are those that followed these standards. Having best practices for data security is very important. Especially for those businesses that deal with private and sensitive customer data. Therefore, it is mandatory that managers and Information Officers acquaint themselves with current ISO 17799 or 27002 guidelines.

Recommended Best Practices in HR Department


HR Department (or Human Resources Department) is plays a very important role in the success of best practices. Employees need to be managed with effective communication and engagement best practices. Almost every business enterprise has a HR department to ensure that there is compliance with various processes. Ten most important best practices HR department personnel are supposed to maintain compliance with include:

Transparent Management System

Participative management is an essential best practice. It means that sharing information about clients and various business processes encourages employees to work with the management.

Appropriate Work Environment

HR ensures that the work environment is safe, happy and healthy. Employees need a good mind frame in order to perform well.

Accurate Performance Management System

The HR department must ensure best practices in accurate performance management. There must be proper communication and feedback between employees and administration. This helps determine the status of performance and profitability.

Performance Bonuses

When an employee achieves high results from his/her performance giving bonuses is a best practice. It serves as an incentive to continue with the good job. Moreover, it serves as an encouragement to other employees.

Fair Evaluation System

The HR personnel must ensure that when employees are evaluated it is done with fairness. This is a sensitive best practice that needs caution and sense of justice. There must be no bias, discrimination or prejudice during evaluation.

Information Sharing

It is an important best practice that the company must share important information with employees. There must be processes strategically placed to ensure adequate available information. However, sensitive information must not be made available without security. Compliance with this best practice improves employee output through compliance with apt feedback.

Open House Discussions and Feedback System

HR personnel should conduct regular open house meetings to sort internal issues and conflicts. It is the responsibility of the HR to ensure training and skill development of employees.

Draw Attention to High Performers

There are always high performers in every business institution. Highlighting them is a best practice that encourages other employees to follow in their steps. Use them as an example for others to improve their morals. There are different ways of highlighting them. E.g. give them higher bonuses and salaries.

Reward Ceremonies

Simply giving bonuses and highlighting people is sometimes not as good. Broadcast the event with a small reward ceremony to announce the reason for such preferences. This best practice is important to encourage other employees as well.

Delight Employees

Sometimes, there is need to boost the morale of workers. Throw an invitation to some outdoor event or in-house party to let your employees know you appreciate them. Otherwise, share some small gifts once in a while. It is the HR’s duty to ensure the management shows compliance with this best practice.

These recommended HR best practices are highly recommended and prove effective for all business enterprises.

Five Compliance Challenges for Insurers in 2012


Ensuring compliance with best practices to mitigate risk has always been one of the greatest challenges for insurers. Therefore, for insurers, 2012 comes with possible economic and political instability. This makes it top priority to meet challenges head-on.

Challenges for 2012

The main challenges insurers will face include:

  • Social Media: The role of social media is increasing in every part of daily life and business. The same is the case with insurance. Now, social media has direct influence on insurers. Successful insurers have learnt to make the most out of advertising and marketing on social media networks. Therefore, there are potential guidelines for insurers using social media for best practices. These guidelines have been published by the FINRA (Financial Industry Regulatory Authority) and the NAIC (National Association of Insurance Commissioners).
    According to these regulatory bodies, insurers will be responsible for ‘static content’ (content or communication via websites for advertising on social media). The content must be in compliance with existing rules about advertising.
  • Electric Data: Data breach has become too rampant in recent years. This has led to legal actions against numerous companies operating online. Therefore, new laws and standards have been established to regulate data privacy. The SEC issued new guidelines about information that companies must disclose to the public. These are meant to ensure mitigation of data security risk through best practices.
    In 2011, the Obama administration enacted cyber security legislatures for 46 states in the US. In 2012, there will be more states added to the list.
  • U.S. Trade Policies: The OFAC (Office of Foreign Assets Control) prohibits companies in the US from engaging in business with some countries. These are referred to as “Specially Designated Nations.” The list continues to change, but countries like Iran are part of the list.
    In 2011 many insurers and reinsurers were penalized for failure in compliance with this best practice.  Personnel regulating corporate compliance are expected to note that, OFAC has authority over all state insurance regulations. This authority has been derived from the President’s declaration. The Treasury Department will continue to monitor US Trade policies through 2012 to ensure best practices.
  • Accounting Standards: There will be new accounting standards in compliance with best practices of the IASB (International Accounting Standards Boards) and FASB (Financial Accounting Standards Board). The Convergence Project will help to improve and simplify the financial reporting system for insurance contractors. In 2012, IASB and FASB will work together as a team.
  • Surveillance via Insurance Industry: Some automobile industries have started to use GPRS tracking devices to keep track of their employees. Likewise other automobile insurance companies have thought about implementing the use of trackers. There is a possibility that there will be legal consequences for invasion of privacy. Insurers are expected to ensure compliance with new regulations regarding trackers coming up in 2012.

Insures must prepare themselves with best practices to face these challenges in 2012.

Essential Governance Best Practices


There are ten essential governance best practices recommended for banks and financial institutions in the US and other countries. These include:

1. Formalizing Duties and Functions

There is need to formalize and announce the appointment of voted directors on the board. Their duties and roles must be presented in writing to ensure compliance.

2. Reform the Structure of the Board

This will add more value to the effectiveness of the board. The size and level of commitment influences compliance with responsibilities. Moreover, the directors and the chairperson should be independent. This is important because it increases efficiency. Most importantly, the chairperson and CEO must not be the same individual. They must be separate offices, with defined duties. Ideally, the board should also have an established nomination committee.

3. Responsible and Ethical Management

Important best practices must be complied with to manage the organization. This requires agreement with Code of Conduct. There are other necessary practices needed in order to maintain customer confidence in the company. Though responsible and ethical management can be achieved through investigation and reporting. Reporting must be done in compliance with standard formats. Besides, directors, officers and employees must be informed about trading policies and securities involved.

4. Financial Reporting Protocols

There must be an established audit committee that provides data for reporting. CEO’s and Chairmen should be able to certify that the information is valid. The protocols required for generating these reports must involve reporting best practices.

5. Timely Disclosure of Information

Important matters and information regarding the company must be disclosed ONLY to people concerned. Timely disclosures are important because they ensure conformity with established policies.

6. Respect Rights

Stakeholders have rights that must be respected. They must be encouraged to take an active part in general meetings and other activities. Likewise, external auditors should also attend the meetings to answer questions related to audit reports.

7. Risk Management

There must be a strong system to oversee risk management. This involves identifying risks and implementing compliance with internal controls. Policies about risk management must be reviewed regularly. All these must be put into writing and disclosed to employees, officers and stakeholders.

8. Standards for Performance Evaluation

The organization must have standards for performance evaluation. This involves making established criteria that must be met by individual directors, key executives and the community as a whole.

9. Compensate Responsibly and Fairly

You must compensate employees and customers responsibly. This is one of the toughest practices in every organization. Managers must take account of the employee’s performance. In a standard firm, there must be remuneration policies.

10. Recognize Legitimate Stakeholders’ Interests

There are legal obligations and other requirements that must be fulfilled. Providing information about stakeholders’ interests in the report is recommended. These are important in establishing risks attached with decisions about the business.

Compliance with these essential governance best practices is the basis of a strong business enterprise.

Golden Principles of Effective Corporate Governance


There are five golden principles of effective corporate governance. Compliance with these five rules is the key to embracing best practices in business. When a company adopts these principles, the public image of the firm improves. At the same time, running the company becomes easier.

In every organization, there are ethics and cultures to abide by. This is why it has become a recommended best practice to establish a set of rules. Good employees abide by these rules while bad ones ignore them. However, there are some principles governing the five golden principles. These include:

  • Ethical Approach: This includes recognizing the organization’s culture, society and standards to ensure best practices.
  • Balancing Goals: The interests of all parties involved must be balanced to achieve the objectives of the business institution.
  • Key Players: The roles of each key player must be defined to ensure compliance with laws and controls.
  • Decision-Making Process: Models must be followed to ensure best practices in decision-making.
  • Stakeholder Rights: The rights of stakeholders must be respected and taken seriously. Some stakeholders have higher shares than others. Nonetheless, they must all be handled with equal importance.
  • Transparency and Accountability: Information about investments and returns must be transparent. The firm must ensure accountability through best practices.

Corporate governance is not only about who dominates the market or the worth of shareholders. Besides, it’s not only about profits and social responsibility. It is more about the ethics and culture of the organization. It is important to mention that though goals are set by entrepreneurs who setup the business, they must be accepted by all parties involved. That is because they are best practices in everyone’s interest.

Five Golden Principles

There are five standard principles that must be followed to ensure proper running of the business. These five principles are best practices that guarantee good management.

  1. Respect for Ethics: There must be established ethical standards for the business.
  2. Established Business Goals: Through compliance with decision-making models, goals must be outlined for key personnel.
  3. Strategic Planning: This is an effective best practice that integrates stakeholder value in the company.
  4. Organizational Structure: The structure of the organization must be structured for effective corporate governance.
  5. Reporting Format: The system and format of reporting must ensure accountability and transparency. This best practice is the key to successful financial management and risk management.

Summary

In summary, corporate governance practices are the key to management best practices. They ensure risk management, operational management and compliance with controls. They also make achieving goals easier.

Compliance with these golden principles of effective corporate governance is a recommended best practice. They ensure success with the various aspects of business management.

IT Governance Best Practices


IT governance is an important aspect of corporate governance. It focuses on the IT system of the business organization to improve overall performance. It involves computer audit, information security management and IT risk management.

Recently there has been an increase in interest towards IT governance, due to compliance management initiatives. The implementation of Basel II in Europe and Sarbanes-Oxley Act in USA has also contributed to bringing IT governance into perspective. Moreover, the want for improvements in decision-making and accountability also contributes to the need for better IT systems. This particularly benefits stakeholders in companies.

Traditionally, executives and business owners make decisions in any firm. However, IT decisions are made by IT professionals, not by executives of the company. Therefore, it is only logical that IT compatibility affects the outcome of decisions taken by top management in any firm. In the long term, stakeholders get negatively affected by poor decisions. Hence, their involvement in business best practices is crucial.

IT governance involves everyone in the company. Involvement of customers, employees, stakeholders, management and directors is equally important for the success of IT governance. Therefore, IT governance provides a module or framework that ensures transparence and accountability. Through proper IT governance, it is possible to trace decisions made. This is because IT governance requires allocation of duties and responsibilities of key players in the firm’s system.

IT Governance Framework

This includes the following best practices:

  • Control: This means practicing control of work done by employees of the firm. It must be in moderation to ensure successful best practices and risk management.
  • Coordination: In every industry there are segments of work /departments, and duties are distributed. IT governance framework ensures coordination of best practices at every segment/department.
  • Evaluate Outcome: It is important for the management to assess and evaluate the outcome from business decisions. IT systems make this easy and quick through compliance with IT best practices. Moreover, this also helps with implementing risk management strategies.
  • Internal Policies and Regulations: This best practice is important to ensure the success of risk management. Through IT systems, controls and standards can easily be implemented on employees and customers.
  • Rationalized Spending: IT governance assists with rationalizing spending. Managers can use data for making decisions accurately.
  • Transparency and Accountability: IT systems ensure proper data management. This increases transparency and accountability at various levels of the firm.
  • Customer Service: Through IT governance, techniques employed for customer management improve. This facilitates good connection of customers with the business. Additionally, handling stakeholders also becomes effective.

Conclusively, IT governance best practices are the key to proper risk management and good management decision-making. It improves business performance at various levels.

Budget Development and Management within Departments


As a compulsory best practice, agencies and departments in any business enterprise must manage their annual appropriation. This is important in order to be able to deliver products and services efficiently, in compliance with government regulations. Therefore, departments must possess a sound budget management and development system. Additionally, there will be need for best practices to integrate internal budgets with business processes.

In addition to this, according to the Audit Act 1994, Section 16AB business enterprises must submit a report of their audit to the parliament. In order to ensure compliance with this, the government sector has two recommended budgeting processes. These include:

  • State Budget Process: This requires the government’s estimate of expenditure and revenue for the entire budget year, combined together. This process is also known as the “External Budget” and offers appropriations to departments to encourage delivery of products and services.
  • Internal Budget Process: This is best described as a “Departmental Budget Setting Process”. It is an important best practice, included in the department’s financial management system. It is important for business planning, performance management and resource allocation.

State Budget Process:

This process is hinged on the submission of budget tenders or bids. These bids are submitted to the government by the budget development department of the organization. This is a two step process:

Step 1: The best practice of updating forward estimates every November in order to input it in budget planning. As part of best practices, the treasury and finance department must seek information to assist with the process.

Step 2: The treasury and finance department must present a brief to the government about its output (products and services). It must also include assets in the reports. This will facilitate the government to consult with special interest groups and broader communities before concluding its stand on the proposed budget.

The final decision is dependent on cabinet approval, which depends on annual state budget and departmental budgets.

Internal Budget Process

When an audit department focuses on internal budgeting, it must focus on the level of training and education of employees. In addition to these business best practices, auditors must focus on the following:

  1. Integrate business planning and internal budgeting process
  2. Develop and manage the internal budget
  3. Monitor and review budget performance

Recommended Best Practices

Here are some recommendations for budget development and Management within departments:

  1. The training and infrastructure department must ensure the following best practices.
  • Align internal budgets with output delivery cost targets.
  • Modify financial management systems and information best practices so that they show budget and actual outcomes against output delivery targets.
  1. The department responsible for training employees must whether budget centers are performing responsibly. This involves the best practice of assessing cost of maintenance and accountability of the budget centers.
  2. The advisor budget management system must meet the requirements outlined by managers.
  3. There must be a benchmark for internal budget to guide development processes. This best practice will enhance efficiency or a wide range of departmental processes.
  4. The infrastructure of the department must review variations between budget estimates and actual results mentioned in the annual budget report.

Conclusively, compliance with these practices involved in budget development and management within departments, is compulsory for a professional business setup.

In this section we will discuss:


Contact Links
Copyright 2009 Best-Practice.com. All Rights Reserved.