the business case for - convercent · 2018-10-17 · event an organization finds itself under legal...

The importance of integrating policies with the rest of your compliance program

THE BUSINESS CASE FOR EFFECTIVE POLICY MANAGEMENT

©2014 Convercent. All rights reserved.

2 www.convercent.com©2014 Convercent. All rights reserved.

THE NEED: A GREAT POLICY FOUNDATION

https://twitter.com/convercent

http://www.linkedin.com/company/convercent

https://www.facebook.com/Convercent

https://plus.google.com/b/110055367440263435396/

THE NEED: A GREAT POLICY FOUNDATION This section takes a look at the need for a strong policy management system in organizations of all sizes. Sometimes undervalued, this portion of a complete compliance management system provides a critical framework for productivity and success.


POLICY MANAGEMENT: THE BUSINESS CASE





Do organizations really need to be so worried about defining and monitoring policies and procedures—or is this just an overblown reaction to government regulations and enforcement trends? Don’t systems of document management at the department level do a reasonable job of delivering and monitoring the critical elements of organizational operations? Aren’t they only really useful in the event an organization finds itself under legal or regulatory scrutiny?

Through proven experience from successful organizations of all sizes, a strong program of policy and procedure management is much more than a necessary evil to have in place in case something goes wrong. Individual policy and procedure documents are the critical framework upon which an organization’s compliance effectiveness and operational success are built.

An organization’s policies provide the basic rules, direction and definitions that not only protect a company, but also provide formulas for profitability and productivity. If an organization’s policies and critical procedures aren’t managed properly, time is wasted, money is lost and risk exposure is elevated.







As the legal and regulatory environment has grown increasingly complex, organizations have reacted by rolling out more policies than ever before. At the same time, technology advancements have provided organizations with a wider array of options for managing these documents, including collaboration software, file share systems and company intranets. The result? The mismanagement of policies has skyrocketed. Organizations end up with policies scattered across dozens of locations with little guidance on what policies exist, where they live, how they are managed and how they are to be communicated or enforced.

These ad hoc approaches end up with policies being poorly written, out of date (and less relevant as a result) and outside of any realm of control and coordination. Related issues and policy exceptions are not recorded and there is no evidence that critical policies have been delivered, understood, put in to practice or enforced. This lack of a strong policy and procedure management system is a recipe for disaster with significant costs to the organization.

Additional, but no less important, considerations in crafting a policy strategy are the regulatory requirements for effective compliance policies. The Federal Sentencing Guidelines, Sarbanes-Oxley, FCPA Resource, Dodd-Frank Wall Street Reform and Consumer Protection Act, the Federal Acquisition Regulation and others outline requirements for written standards and reinforce the crucial role they play in a truly effective compliance program.

Now, more than ever before, proper and effective policy management programs are not just the brick and mortar, but the concrete and rebar for effective and productive organizations. If an organization overlooks or minimizes their policy and procedure management program, they effectively allow cracks to grow and expand in their foundation.







6

A company’s sales rep recently submitted a proposal in a foreign country. Soon thereafter, this rep gave a government official from that country tickets to bring his family to the U.S. with airline, hotel and entertainment costs covered. The sales rep put everything on his corporate card without executive approval. Now imagine this exact scenario occurs in two different companies: Company A and Company B.

SCENARIO

www.convercent.com©2014 Convercent. All rights reserved.






COMPANY A Company A’s gifts and entertainment policy was distributed via email to the sales team, and then filed in the HR department. No system of attestation or acknowledgment was put in place.

COMPANY B Company B relied on an effective policy management solution for its policy initiatives. The gifts and entertainment policy was developed, approved and regularly updated in the platform. The policy was distributed via emails that were recorded in the system and each employee’s receipt and acknowledgment of the specific policy version was tracked. A report of these attestations was sent to sales and executive management to review and follow up with employees that had yet to attest to the policy.


POLICY MANAGEMENTPRE-INCIDENT






COMPANY A When Company A discovered the gift, the company disciplined the sales rep and disclosed the wrongdoing to enforcement officials. The U.S. government investigated and levied a six-figure fine against the company when it couldn’t provide records that showed the employee had received and/or read the company’s gifts and entertainment policy. In addition to the settlement costs, the company lost the business and similar future opportunities in the region.

COMPANY B When Company B discovered the gift, they disciplined the rep and disclosed the incident to the government in a similar manner to Company A, only this time the government declined to charge the company because it could handily show records from their policy management solution of the employee’s receipt of—and attestation to—the gifts and entertainment policy. The evidence demonstrated Company B’s continuous, good-faith efforts to comply with domestic and international gift regulations. In turn, Company B maintained its public image and good relationships with domestic and international governments, which enabled the company to continue to thrive in the region.


IMPLICATIONSPOST-INCIDENT







THE PROCESS: AN EFFICIENT AND EFFECTIVE WORKFLOW





THE PROCESS: AN EFFICIENT AND EFFECTIVE WORKFLOW This section demonstrated the business impact of an effective policy management workflow by providing a side-by-side comparison with a workflow that’s inefficient and ineffective—and indefensible as a result.







Organizations are defined and directed by thousands, ten of thousands and even hundreds of thousands of documents that prescribe policies and procedures for things as simple as routine hand washing and as complex as international legal commitments. These documents are found throughout the organization. How is it possible to manage, distribute and update these critical documents—found throughout the organization—in an efficient and effective manner?

Policies and procedures that are out of date and/or hard to find are often key factors in quality and profitability problems, which is why thousands of organizations of all sizes have decided to automate their policy management processes. The ability to do this correctly and efficiently can often mean the difference between compliance and sanctions, profit and loss or success and failure.







Any sound policy management workflow will give you the ability to:

1. Provide access to other system users and administrators.

2. Review and approve policies and assign tasks related to review and approval to other stakeholders.

3. Distribute new policies.

4. Archive and innumerate policy versions.

5. Track distribution and readership of policies.

6. Measure recipients’ attestation to policies, including a notation of which version of the policy was

received and attested to.

7. Track all portions of the workflow.

8. Understand correlations between policies, cases, training, risks, disclosures and other compliance

program initiatives.

9. Respond to elevated or emerging risks with policy re-distribution or revisions.







13

Let’s take a look at two workflow examples that are commonly used in organizations today. One is based on document distribution though an organization’s intranet, and another using a comprehensive, automated policy management solution.

Each includes the key players and committees, but there are significant differences in the ways that the documents are managed.

WORKFLOW








WORKFLOWSIDE-BY-SIDE COMPARISON


INTRANET-BASED INTEGRATED SOLUTION Company policies are made available to employees on the company intranet.

The module is available throughout the organization as an Internet-based (SaaS) system, including on mobile devices.

Policies are distributed by email to all necessary personnel on an ad hoc basis.

Policies are distributed and managed efficiently by the automated system.

As policies are updated, individuals are asked to replace old documents with the newer versions.

All updates are made automatically and outdated versions are archived. Reminders deploy when policies are due for review.

Individual policy campaigns are cumbersome to manage and are conducted as standalone efforts.

Campaigns can be seamlessly scheduled or automatically deployed to individuals or groups based on organizational events.

All versions, new and outdated, are stored on servers, as well as the local hard drives of employees.

All policy versions, new and archived, are stored and protected in a cloud environment.

Employees are instructed to read the policies and implement the directives.

Employees have constant access to centralized policies. Policies are coupled with training and communication for reinforcement.

Validation of readership and compliance are difficult to track since there is no official system to manage it.

The system validates and tracks individual attestations.

Reporting and analysis of the validation and compliance with policies are spotty at best.

Reports of readership and attestation are complete and automatic.

The organization is exposed to legal risks because of uncertainty and lack of verifiable evidence related to policy receipt, acknowledgment and compliance.

The organization is protected from risk, as it can easily and readily verify compliance at any time and can respond to incident reports or emerging issues by re-sending policies.

The company operates at a sub-par level of efficiency.The organization is operating at a higher level of efficiency and effectiveness.





15

“With Convercent’s policy management software, we’re seeing higher employee attestation rates than previous methods. Convercent clearly reports who has completed current requirements and who still has actions pending. With a single click, we can quickly remind employees of upcoming deadlines. It’s a significant time savings for us and all conveniently recorded in Convercent.”

Courtney Driscoll VP of Human Resources

Boston Capital

SEEN & HEARD



http://www.convercent.com/products/policy-center/

http://www.convercent.com/products/policy-center/






THE MECHANISM: SUPERIOR SYSTEM INTEGRATION





THE MECHANISM: SUPERIOR SYSTEM INTEGRATION Done through a series of questions and answers, this section takes a look at the importance of strong integration in an ethics and compliance system between the various modules.







Why is system integration such an important part of a compliance management solution?

It is important to have all relevant ethics and compliance program components integrated together into one cohesive system. Having different system components managed from a unified back end with effective linkages provides relevant and critical context to your program data (e.g., if you see low attestation rates for two policies, you can prioritize efforts to increase acknowledgment for the policy related to the more critical risk area based on your risk profile or case volume). This allows you to achieve both compliance effectiveness and operational efficiency.

Q



A

How should this integration work?

A proper compliance management solution tracks and reports individual participation, identifies and resolves risks, manages controls for those risks and coordinates organization-wide campaigns to increase awareness around key initiatives. Using a system with little to no integration functionality would be akin to managing a search and rescue effort with no communication between the various teams. The individual rescuers might be very efficient and well trained, but the overall progress of the rescue would be slow and highly ineffective.

QA





Can’t a system be effective even if the individual components work independently, especially if they are strong in their own areas?

While it is important to have strong individual modules as part of a complete ethics and compliance management system—including components for hotline and case management, training and policy management—these modules just can’t be fully effective if they don’t share critical, related data. Data presented without context is harder to understand and act on, and gaps in your program and workflow are created when critical systems and data are disconnected from one another.

Q



A

What are the key functions that need to be considered when deciding upon a compliance management solution?

Key elements that should be included in any compliance management system are:

• Policy management • Hotline and case management• Curriculum development and training management• Risk management• Disclosure management

QA





What is one specific advantage that can come from tightly integrating compliance system modules?

Tying training programs to policy distribution is a good example of the efficiencies of integration. Training can be used to drive home key concepts set forth in policies. Policy attestations can then be stored alongside training certifications and test scores, allowing management to gauge—and later prove—whether the employees understood the policy or required additional follow-up. Seeing this correlation provides more confidence that the concepts will be internalized, and compliant behavior practiced, thus minimizing your organization’s exposure to risk.

Q



A

What type of problems might result when the ethics and compliance system elements are not well integrated?

An organization might have several problems arise from policy management flaws or shortcomings in its integration with other program data, including:

• Less assurance and evidence that employees have read and understood key policies.• Lack of visibility into policies that may need to be rewritten or reinforced.• Inability to respond quickly to an issue that carries legal ramifications.• Recurrence of issues throughout the organization.• Less confidence that compliance risks are effectively mitigated.

QA







How would a good policy management system resolve these challenges?

An integrated compliance management solution can show the interactions between risks, issues, training and policies. This can lead to a proper and definitive review of key issues and build the foundation for any needed rewrites of ineffective policies.

QA





22

“Convercent allows us to quickly identify hotspots where issues are occurring and where additional training or policies may be needed.”

Elaine James Human Resources Manager

Choctaw Nation of Oklahoma

SEEN & HEARD



http://www.convercent.com/products/case-manager/

http://www.convercent.com/products/case-manager/






THE MEASUREMENT: POLICY TRACKING AND ATTESTATION





THE MEASUREMENT: POLICY TRACKING AND ATTESTATION In order for a policy management system to be fully effective, it must have a strong component for attestation to verify readership and understanding of key organizational policies and procedures. What is the difference between good and poor validation? What are key performance metrics of policy attestation? And how does a robust attestation process benefit an organization?







The effectiveness of a compliance management system hinges not only on its ability to facilitate policy creation, distribution and training, but also its ability to track and assess policy awareness. Armed with measurable data, company management can then assess the effectiveness of their policies as a key method for combating misconduct and increasing the organization’s productivity, efficiency and competitive disposition as a result of more compliant and transparent business operations.







Key functions in a strong attestation module include the following capabilities:

Receive automatic notifications for policy distribution and attestation.

Manage Q&A forums, surveys, certifications and self-assessments to further verify policy compliance and measure understanding.

Use eSignatures, or electronic sign-offs, at departmental and functional levels that roll up for executive certifications.

Track policy exceptions through integration with case management systems.

Require additional training or policy re-attestation as needed.

Increase employee awareness and accountability by providing easy and centralized access to organizational policies, procedures, regulations, obligations and standards.







Ultimately, any effective policy attestation mechanism will empower your organization to:

Assess and mitigate risks.

Verify organizational compliance to internal policies.

Demonstrate an effective and defensible compliance program.

Recognize gaps in your compliance efforts and management procedures.

Provide auditors with needed tools for program validation.







28

“Convercent automates many of the manual processes related to disseminating, reporting, and monitoring our governance and compliance activities. In addition to being a depository for our teammate information, the technology will allow us to track, measure and report on teammate metrics.”

William Angus Director of HR Services & Staffing

Owens & Minor

SEEN & HEARD



http://www.convercent.com/products/reporting-analytics/

http://www.convercent.com/products/reporting-analytics/






THE PAYOFF: TOTAL SYSTEM ROI





THE PAYOFF: TOTAL SYSTEM ROI This section reviews some of the returns on investment realized by an organization with a complete and effective policy management system.

There are a variety of ways that a robust policy management solution brings real and tangible value to an organization—particularly when integrated as part of a complete ethics and compliance system.









1 | AUTOMATIONHaving a system to streamline and direct all elements of an organization’s document management reduces both time and monetary expenses. This includes the distribution, versioning and archiving of all critical documents—combined costs that could run into five figures annually for even a small company.

2 | DOCUMENT ACCESSHaving key policies and procedures available instantaneously saves countless hours searching for improperly distributed and archived materials. It can cut time locating current policies and procedures as well. This could save tens of thousands of dollars for a mid-sized organization when these policies are available through keyword search or as links from other system modules.







3 | REDUCED RESOURCE USAGEWith an automated system, there are significant reductions or complete removal of charges for printing, copying, manual distribution and physical storage of an organization’s code of conduct, policies and procedures. This can save thousands of dollars annually to even small organizations.

4 | REDUCTION IN INTERNAL CORRECTIVE ACTIONWhen employees fail to read and understand policies and regulations, it often requires additional corrective action, including training sessions to make sure that everyone is in compliance. Even if this training is in-house rather than contracted, it can add up to a significant expense in both training costs and productivity losses. It may also require management to move away from critical work in order to address and correct an issue.







5 | INCREASES IN PRODUCTIVITYOne of the major advantages of a complete policy management system is the gain that comes to an organization’s overall effectiveness and productivity. When everyone is on the same page through understanding and implementing key organizational objectives and standards, the returns can be significant.

6 | REDUCTION OF RISK AND EXPOSUREOne of the greatest sources of potential cost savings comes through the protection that an organization receives against fines, fees and sanctions. The ability to prove compliance with local, federal and international regulations can be the key factor in avoiding financial repurcussions for non-compliance, along with losses of investor and consumer confidence. For large organizations, the cost savings of defensible compliance can tally well into the range of nine figures.






THE DELIVERY: CONVERCENT POLICY MANAGEMENT SOLUTION





THE DELIVERY: CONVERCENT POLICY MANAGEMENT This final section shows how Convercent meets all of the requirements of a complete and integrated ethics and compliance management solution.







EASY-TO-USE POLICY WORKFLOW Convercent simplifies the workflow of procedure and policy management, distribution and compliance. Compliance managers can easily upload new policies, retire old policies and manage the revision history of policy changes—and even receive alerts about unread policies or policies due for review. Convercent’s policy management solution features an innovative campaign management workflow designed to support rapid distribution of policies and procedures. Convercent also ensures your organization has auditable records of these efforts, down to the date of individual employee attestations of a specific version of a policy.


THE DELIVERY: CONVERCENT POLICY MANAGEMENT







REAL-TIME REPORTING AND MONITORING Convercent gives you a moment-by-moment window into the effectiveness (or lack thereof) of your policies in mitigating and controlling your critical risk areas. Providing at-a-glance dashboards of policy acknowledgment rates and in-depth reports that relate your policies to your company’s risks and incidents, Convercent’s integrated reporting provides actionable insight into polices that need rewriting, redistribution or reinforcement.







INSIGHT THROUGH INTEGRATION Offering native integration of your policy management with other critical program areas—including risk, training, incident reports and disclosures—Convercent enables you to truly understand how effective your policies and other program elements are in mitigating and addressing compliance risk. As a result, you’ll be armed with actionable insight into where new policies may be needed; which existing policies need to be rewritten; or which policies need to be reinforced with additional attestations or training.







MOBILE DELIVERY Today’s workforce is more decentralized and mobile than ever before, while expecting information at their fingertips. Procedures and policies are no exception to this rule. Without the policies to refer to at a moment’s notice, how do you expect employees to be compliant? With many organizations now using mobile devices in day-to-day operations, whether using iPads in meetings, or Android tablets in retail point-of-sale, your policies and procedures must also work on any device, anywhere your employees are.





Easily upload new policies, retire old policies and manage the revision history of policy changes

Leverage integrated campaigns with workflows that distribute policies, provide related training and track employee attestation and/or comprehension

Target individual employees or employee groups or locations with specific policies and procedures

Relate policies to risk areas to understand where risks are being effectively mitigated

Increase understanding of policy effectiveness by seeing key relationships between policies, hotline cases and relationship disclosures

Maintain a centralized policy repository and verifiable attestation records, complete with version history

KEY BENEFITSGoing far beyond a repository and workflow management tool for your code, policies and procedures, Convercent assures you’ll know if and how well your policies are safeguarding your organization from a compliance fallout by relating your policies to your risk and key compliance program initiatives.







41

“Convercent delivers integrated reporting across key compliance functions, including policy management, learning management, hotline and investigations to enable effective compliance risk monitoring and mitigation. This is done through an elegant and intuitive user interface that delivers depth while minimizing technical acumen needed.”

Michael Rasmussen Chief GRC Pundit, GRC 20/20

2014 GRC Technology Innovation Award: Convercent Delivers Agile Compliance Reporting

SEEN & HEARD







Convercent’s solution operationalizes and integrates compliance functions across key compliance risk areas, enabling a cohesive approach to managing, mitigating and monitoring compliance risks. Pairing a refreshingly intuitive user interface with natively integrated reporting and analytics, Convercent’s compliance program management solution ultimately facilitates the efficient, good-faith application of an effective and defensible corporate compliance program that safeguards the financial and reputational health of your company.

Request a demo today!

www.convercent.com

ABOUT CONVERCENT

©2014 Convercent. All rights reserved.

929 BroadwayDenver, CO 80203

[email protected]: 303-526-7600

Toll-free: 1-800-650-7005

http://www.convercent.com/products/view-demo/





the business case for - convercent · 2018-10-17 · event an organization finds itself under legal...

Documents