Com­pli­ance is not an option

Com­pli­ance is not an option: the reg­u­lators are now tar­geting dir­ectors and senior man­age­ment with fines or even gaol where they believe that insuf­fi­cient atten­tion or per­ceived obstruc­tion has been given to compliance.

The issues of com­pli­ance have come to a head indir­ectly because of com­puters, and, in par­tic­ular, the Internet. The ability to con­duct busi­ness elec­tron­ic­ally has arrived. We can con­tract via email, our part­ners, sup­pliers and cus­tomers have access to cor­porate resources, and our own staff can dir­ectly access cor­porate facil­ities from any­where in the world. This surge in tech­no­logy does not change the under­lying legal, reg­u­latory and judi­cial require­ments to be met. It just places new chal­lenges on an organ­iz­a­tion. How do we manage all these com­mu­nic­a­tion mech­an­isms? How do we secure the busi­ness records cre­ated elec­tron­ic­ally to provide the level of evid­ence that we had in the paper world?

It may not seem obvious, but the first ques­tion to answer is ‘What are the laws and reg­u­la­tions that I need to comply with?’ In some cir­cum­stances a com­pany need have no phys­ical pres­ence in a country or region yet may still be sub­ject to its laws.

Having estab­lished all the laws and reg­u­la­tions to be met, it is pos­sible to build up the set of required prac­tices, pro­ced­ures and pro­cesses that need to be put in place, and, fun­da­ment­ally, which records have to be main­tained and for how long. The increasing depend­ence on com­puters and elec­tronic data means that in order to sur­vive a reg­u­latory invest­ig­a­tion, com­mer­cial or civil lit­ig­a­tion, a crim­inal invest­ig­a­tion, or even sur­vive a crim­inal attack, organ­iz­a­tions must have a prop­erly imple­mented record cap­ture, storage and retrieval capability.

For fur­ther details please email us.

Demon­strating compliance

Record man­age­ment is the key, because to demon­strate com­pli­ance, an organ­iz­a­tion must keep appro­priate records and be able to present them on demand, in some cases within 24 hours. Even Sarbanes-​Oxley sec­tion 404, which is widely seen as the applic­a­tion of auto­mated Iden­tity Man­age­ment and Access Man­age­ment solu­tions, requires that the logs and audit trails be main­tained to demon­strate that the con­trols were indeed in place.

Many mis­takenly con­cen­trate on the area of records man­age­ment and reten­tion. For example, a product that claims com­pli­ance to SEC reg­u­la­tions by retaining email for two years is missing the point. Reg­u­lators make spe­cific demands on what records they want kept and for how long. The law also makes demands, but these demands often will be more onerous than those of the reg­u­lators. Two years may sat­isfy SEC, but the courts require data to be retained whilst there is the pos­sib­ility of lit­ig­a­tion. Failure to do so can lead to ser­ious consequences.

But there is a fur­ther, far more chal­len­ging issue facing the organ­iz­a­tion. Even after identi­fying all the rel­evant records and retaining them, how do you demon­strate that these records have not been tampered with. How should they be retained in order to sat­isfy the appar­ently com­peting require­ments of data pro­tec­tion, pri­vacy, and evid­en­tial weight? And what other require­ments does the law place on records?

All reg­u­la­tions are sub­ject to the jur­is­dic­tion and require­ments of the courts, and it is these that must be met irre­spective of the require­ments of a spe­cific reg­u­la­tion. This can lead to apparent anom­alies, for example a reg­u­la­tion may seem to pro­hibit dele­tion of a record during the reten­tion period but the courts have the power to order an incor­rect record to be deleted or amended. Typ­ic­ally, reten­tion periods required by the courts are longer than those defined by reg­u­lators as the courts require the record to be avail­able until the need for that record expires under the statute of lim­it­a­tions. Reg­u­lators only define a reten­tion period to cover the period that they have spe­cific interest in the record.

Reg­u­la­tions tend to focus on which records need to be retained and for how long. Some go fur­ther, par­tic­ular in the Fin­an­cial Ser­vices, Phar­ma­ceut­ical and Health Care sec­tors, and address the issues of integ­rity and authen­ti­city of records in elec­tronic form. This leads to the corner­stone of com­pli­ance, be it paper-​based or elec­tronic, which is demon­strating evid­en­tial weight for records. Evid­en­tial weight is a concept that needs to be recog­nized as part of the dis­cus­sion on com­pli­ance; an organ­iz­a­tion needs to be in a pos­i­tion to demon­strate that the records it retains are the actual busi­ness records used and none has been added, changed or deleted.

Com­pli­ance is a cost of doing business

The prin­ciples of record man­age­ment described here for elec­tronic records apply equally well to paper records and it is a common mis­take to con­clude oth­er­wise. What is sig­ni­ficant is that the ability to do busi­ness elec­tron­ic­ally throws up a range of tech­nical issues that need to be addressed in order to give the same level of con­fid­ence, of evid­en­tial weight, to the record in elec­tronic form. Com­pli­ance has always been a require­ment for con­ducting busi­ness, but the advent of the com­puter age and recent high pro­file cor­porate scan­dals have raised the profile.

Com­pli­ance should be seen as a cost of doing busi­ness. How­ever, done prop­erly, com­pli­ance can become a profit centre. (See the paper ‘Com­pli­ance is free’.)

For fur­ther details please email us.

Evid­en­tial weight is the corner­stone of demon­strating compliance

A lot of mar­keting cur­rently equates com­pli­ance with a product’s ability to ‘provide legal admiss­ib­ility’. This turns out to be mis­leading due to the con­fu­sion that exists between the con­cepts of legal admiss­ib­ility and evid­en­tial weight. In most jur­is­dic­tions vir­tu­ally any elec­tronic data can be sub­mitted before a court of law, i.e. is leg­ally admiss­ible. The real ques­tion is that of evid­en­tial weight. Evid­en­tial weight is the extent to which the court can rely upon the elec­tronic information.

Reg­u­la­tions tend to focus on which records need to be retained and for how long. Some go fur­ther, par­tic­ular in the Fin­an­cial Ser­vices, Phar­ma­ceut­ical and Health Care sec­tors, and address the issues of integ­rity and authen­ti­city of records in elec­tronic form. This leads to the corner­stone of com­pli­ance, be it paper-​based or elec­tronic, which is demon­strating evid­en­tial weight for records.

Record integ­rity

Evid­en­tial weight is more than just doc­u­ment reten­tion. Evid­en­tial weight requires that all aspects of data are retained; the exist­ence or occur­rence, the data itself, any access to the data con­tents, any attempt to edit or delete the data, ensuring that the data cre­ated is the data that is stored and demon­strating that no data has been lost or inap­pro­pri­ately deleted. For example, in the email or doc­u­ment archiving arena just storing a backup or snap­shot of a mes­saging system is insuf­fi­cient as is a system that provides a policy for storing inform­a­tion after a period of time has passed or where the choice of whether or not to store the inform­a­tion is placed under the con­trol of each user.

If an organ­iz­a­tion cannot prove that every required record has been retained for the cor­rect period then they have not sat­is­fied the evid­en­tial weight require­ments. After all, if gaps in the record store exist then the sus­pi­cion is either that the store is unre­li­able or that those gaps were cre­ated to hide or des­troy incon­venient inform­a­tion. In fact all organ­iz­a­tions have an oblig­a­tion to main­tain records that could be used in a dis­pute for as long as a dis­pute may arise, as well as a gen­eral oblig­a­tion to main­tain records as the cost of con­ducting busi­ness. Organ­iz­a­tions that operate in highly reg­u­lated indus­tries, how­ever, must meet addi­tional spe­cific require­ments set down by their industry reg­u­lators. Irre­spective of how they arise, the record keeping require­ments are sub­ject to the rules of evid­ence, which are quite sep­arate from the reg­u­latory record keeping require­ments and which apply in addi­tion to those requirements.

Evid­en­tial weight is a key concept

Evid­en­tial weight is the key concept that needs to be recog­nized as part of the dis­cus­sion about com­pli­ance; an organ­iz­a­tion needs to be in a pos­i­tion to demon­strate that the records it retains are the actual busi­ness records used and none has been added, changed or deleted.

For fur­ther details please email us.