Email Management: A Critical Component of a Compliance Framework

From the Sarbanes-Oxley and USA PATRIOT Acts to US Food and Drug Administration (FDA) approvals and US Environmental Protection Agency (EPA) regulations, government is increasingly legislating how companies run their businesses. Complying with a broad spectrum of mandates can often be an overwhelming task companies simply want to "make it through." Instead, organizations should look beyond merely surviving compliance and use it as a driver to improve company-wide business efficiencies.

While every regulation is unique and involves specific requirements, there are fundamental information technology (IT) capabilities and business processes that can be instituted to not only support each initial compliance initiative, but also generate cost savings and significant business efficiencies well into the future.

Building an Enterprise-wide Compliance Framework
The first step toward driving business efficiency through compliance processes is building an enterprise-wide compliance framework to tackle all relevant mandates. This framework compels organizations to inventory, align, develop and manage compliance content, processes and controls in a consistent and efficient fashion. As a result, companies save money, reduce risk of non-compliance, avoid operations headaches, optimize resources and implement a strong policy regarding ethical business practices.

An effective and comprehensive compliance framework should help an organization achieve the following objectives:
1. Support the overall compliance initiative along with individual or departmental compliance efforts;
2. Manage all compliance information in a centralized, enterprise-wide solution, while eliminating project-level silos of content;
3. Utilize the same business processes and information to support multiple compliance efforts;
4. Reduce risk by automating compliance processes and providing visibility into the results of those processes;
5. Mature its controls environment by automating controls through a business process management infrastructure;
6. Minimize the costs of legal discovery in the event of litigation or a legal investigation;
7. Avoid fines for violating laws and regulations;
8. Proactively manage emerging compliance requirements;
9. Migrate toward an enterprise risk management (ERM) environment; and
10. Ultimately create a competitive advantage and increased value for shareholders, customers and employees.

There are three primary components of a compliance framework that will help companies attain these objectives: people, process and technology. Companies must determine their organizational structures (i.e. which staff members report to what employees), and define their compliance processes for activities such as documentation, testing, remediation and reporting. Organizations should work with their audit or risk-management consulting firms to complete these tasks. And finally, companies must implement a technology architecture to help drive and support sustainable compliance processes.

Compliance From Content Management
After an organization has defined its overall compliance approach and methodology, a technology architecture can then be created.

Regardless of the regulatory requirements a company faces, there are certain fundamental, technology-based activities it will need to perform in order to best optimize compliance processes and business efficiencies. These include:
1. Creating a framework for creating, sharing and distributing various types of compliance- related content, including policies, procedures, e-mail and instant messaging;
2. Automating compliance activities, such as risk assessment, documentation change management, self-assessment, testing and remediation;
3. Keeping audit trails of the changes made to documentation;
4. Establishing a comprehensive approach for document retention and records management;
5. Developing an enterprise-wide security architecture to ensure only authorized individuals access certain compliance content;
6. Optimizing controls so they become part of business processes and are executed predictably and repeatedly;
7. Determining the scope of testing, including what types of control testing must be performed and which results must be tracked;
8. Instituting a process to accommodate the needs of company executives and the compliance team for monitoring compliance and reporting activities or results; and
9. Identifying the potential requirements of new regulations.