Building an IT strategy that supports regulatory compliance

Why technology governance is now the responsibility of leadership, not just IT.

As your business grows, your IT, governance and compliance need to grow with it. If they don't, the risk to your business will also grow.

However, most businesses don't build their technology around regulatory compliance from day one. Systems are added as the business grows, new software is introduced, more people join, suppliers are given access to information and cloud platforms become part of everyday operations.

Over time, the business becomes more dependent on technology, while the expectations placed on it also increase:

·      Customers want reassurance that their information is secure

·      Larger organisations ask more questions about cyber security and resilience before working with suppliers

·      Auditors and regulators increasingly expect evidence that risks are being properly managed

Winning new contracts, passing supplier due diligence and maintaining customer confidence all depend on being able to demonstrate good governance. The difficulty is that technology, governance and compliance don't always develop at the same pace as the business.

Where the responsibility actually sits

Technology now supports almost every part of a business:

·      Finance depends on systems holding sensitive financial information

·      HR manages employee data and access to company systems

·      Sales teams rely on CRM platforms and customer information

·      Operations may depend on cloud services, specialist applications, connected equipment and suppliers.

This doesn't mean every business needs a Chief Information Security Officer or a large internal IT department. But it does mean someone needs to understand how technology, business risk and regulatory responsibility fit together. They also need enough visibility to know whether the controls the business believes are in place are actually working.

These are risks that rest with directors, regardless of who manages the technology day-to-day.

The answer looks different for every business. Financial services organisations may need stronger controls around access to information, operational resilience and third-party suppliers. Manufacturers may need to protect intellectual property and production systems while meeting rising cyber security requirements from customers and supply chains. Healthcare organisations carry additional responsibilities around sensitive information and patient data.

Almost every business, meanwhile, holds personal information and has responsibilities under data protection legislation.

The important question isn't simply whether the business is compliant. It's whether it can demonstrate that its technology, controls and processes support the responsibilities and risks it carries today.

Growth quietly outpaces governance

Most businesses don't stand still. They grow, open new locations, introduce new systems, work with more suppliers and allow employees to access information from different places. Some acquire other businesses or expand internationally, while the introduction of artificial intelligence adds another layer of questions around how company information is accessed, processed and protected.

Every change can introduce additional risk, and IT governance and compliance processes don't always keep up. A policy may say employees should only have access to the information required for their role, but is that actually happening?

We often help business leaders compare what they believe is happening across their technology with what is actually happening. Closing that gap is normally where the biggest improvements in resilience, governance and compliance are made.

On the whole, good compliance starts with getting the foundations right:

·      Systems that are supported and regularly updated

·      Access to important information that’s properly controlled

·      Critical data that’s protected and recoverable

·      Security monitoring capable of flagging unusual activity

·      Employees who understand their responsibilities when handling company and customer information

None of these are difficult to understand. The challenge is applying them consistently, checking them regularly and improving them as the business changes.

Could you prove your controls are working?

It's relatively easy to say that systems are secure, backups are being taken and access is properly controlled. It's harder to demonstrate it. A few questions tend to separate good intentions from a genuinely mature approach:

• When were critical systems last updated, and who has access to sensitive information?
• Is administrator activity recorded, and could unusual activity be identified and investigated?
• When were backups last successfully restored?
• When was the incident response plan last tested?

Good technology management should create much of this evidence as part of normal operations. Logging, monitoring, access reviews, vulnerability management, recovery testing and documented procedures help businesses understand whether their controls are working, and make audits, customer assessments and regulatory reviews considerably easier. Trying to collect this information for the first time when an auditor, customer or regulator asks for it is rarely a good position to be in.

The same principle applies to preparing for incidents. No business can remove every risk. Technology fails, employees make mistakes, suppliers experience outages and cyber attacks continue to happen. Therefore, the business needs to understand what happens next: who makes decisions, how operations continue, who communicates with customers and regulators, and how critical systems are recovered. These decisions are much easier to make before an incident occurs. A written incident response plan is useful, but one that has been tested and understood by the people expected to use it is considerably more valuable.

Compliance should develop with the business

The technology, controls and processes that worked for a smaller business may not provide the governance, security and resilience required by a larger or more complex one. The same is true when businesses enter regulated markets, acquire companies, expand internationally or begin working with larger customers.

The strongest compliance strategies aren't built around passing the next audit. They're built around understanding risk, maintaining visibility and making better decisions as the business changes. That doesn't necessarily mean replacing existing technology or changing IT providers. Sometimes an independent review can help identify gaps, challenge assumptions and give senior management a clearer picture of where improvements should be made.

We believe IT strategy should support where a business is going, not simply where it is today. The question for business leaders isn't whether they're compliant right now. It's whether the technology and controls supporting the business are developing at the same pace as the business itself.