The shift in regulations away from technical, rules-based standards to more subjective, principle-based approaches create new challenges for organizational compliance. Newer value-based approaches require organizations to not only comply with all applicable rules but also demonstrate to regulators the effectiveness of the compliance program itself. Two ways regulators are assessing compliance program effectiveness are through an evaluation of the existence and proper functioning of organizational regulatory change management programs and satisfactory demonstration of ethical leadership and an enterprise-wide culture of integrity.
These trends not only require knowledge of the technical requirements of rules and regulations but also broader knowledge of regulatory and examiner agendas in order to know how best to interpret and operationalize these more loosely defined guidelines. They also necessitate a renewed consideration of metrics that will satisfy regulators as well as a greater focus on continuous processes versus periodic testing and static reporting.
Few organizations have yet to address these challenges head on. Most are still trying to get their head above water, throwing money, people and other resources to triage and remediate internally and externally-identified deficiencies and enforcement actions resulting in compliance costs mounting to unsustainably high levels.
