Compliance Regulations

IT Governance

2/8/2015

Table of Contents
Regulatory Compliance. Role of IT in Corporate Compliance. 3
Senior Management ignoring compliance mandates. Fines and Penalties 4
References 6

Regulatory Compliance. Role of IT in Corporate Compliance.

Regulatory compliance intent is sometimes, to protect investors and their investments or how an industry-specific company handles private information. Also there regulations designed to provide transparency in the handling of the company´s finances and operations. Regulatory compliance also enforces ethical behavior, accountability, legal responsibilities and also penalties for companies and their senior management.
The Gramm-Leach-Biley Act, or GLBA, also well known as the Financial Modernization Act of 1999 is an example of a federal law to control the way that financial institutions, institutions that exchange people´s financial information and “any institution that works with people´s money” (Chaple), manage private information of their consumers and customers. This act has different provisions relate to customers and consumer´s information: The Financial Privacy Rule and the Pretexting Provision are concern with the collection, access and disclosure of private financial information. The Safeguards Rule dictates that financial institutions must implement security programs to protect private information (In Brief: The Financial Privacy Requirements of the Gramm-Leach-Bliley Act ).
The Sarbanes-Oxley Act, or SOX, is an example of a regulation that only applies to a type of company: publicly traded companies. SOX requires that a public company has to keep an “audit trail of log files and all pertinent documentation for five years”(What is the impact of Sarbanes-Oxley on IT operations), and that this information, electronic or paper must be kept and cannot be destroyed, altered or falsified for a period of time. SOX also establish the information that must be available for share holders for transparency.
The Health Insurance Portability and Accountability Act, HIPAA, is an example of an industry-specific regulation that applies to all companies that “handle” personal health information, PHI. HIPAA has several rules, one of them, the Security Rule, defines the safeguards and security standards that companies must implement when electronically storing and transmitting PHI.
IT departments supporting the compliance regulations have different roles. The primary role is to implement the technical controls to safeguard the CIA triad of information: confidentiality, integrity and availability. I.e. HIPAA requires the safeguard of the privacy of health records to be protected. The other role, that complements the primary one, is to provide and maintain the platforms that support the technical controls: networks, systems to log the trail records and generate the reports and data management and storage. In most companies all these functions are provided by the IT department. Other companies have different departments handling the information systems, i.e. a financial software to ease the implementation of controls and audits that some regulations require with the support of the IT department (Six Practices to Help Ensure Continued Corporate Compliance).
Senior Management ignoring compliance mandates. Fines and Penalties

“Compliance must originate from the top” (Wright, 1994). If senior management does not define the procedures to establish the necessary controls to follow compliance regulations, the viability of the organization will be at stake.

Companies not following compliance regulations are exposed to legal sanctions, both, criminal and civil. Penalties could include fines and even incarceration (Six Practices to Help Ensure Continued Corporate Compliance). That is not the only problem, sometimes an organization´s reputation is severely damaged. Compliance with the different laws and regulations is a very serious matter. Even when the laws and regulations are not very specific in the requirements, the responsibility of following them bare on the companies´ side. The efficiency of the controls and how well they handle the information and the how well they respond to audits, is the only way to avoid sanctions and legal actions.
SOX compliance is the sole responsibility of senior management. If any problem arises with, they could be held responsible and face consequences depending on the discrepancy. The consequences for noncompliance with SOX regulations are (What is the impact of Sarbanes-Oxley on IT operations): fines and up to ten years in prison for no maintaining documentation, fines and up to twenty years in prison for record falsification and fines and up to twenty-five years in prison for defrauding funds.
The consequences for noncompliance with HIPAA regulations vary depending of the infraction. Fines up to $50,000 and/or imprisonment up to one year, if infraction is under “false pretenses”, up to $100,000 and/or imprisonment up to five years and if the infraction is “for disclosing or obtaining PHI with the intent to sell, transfer or use PHI for commercial advantage, personal gain or malicious harm” the fine could be up to $250,000 and/or imprisonment up to 10 years. References

Chaple, M. (s.f.). Gramm-Leach-Bliley and you: Learn whether Gramm-Leach-Bliley applies to you and what you should do about it. . Retrieved from techtarget.com: http://searchfinancialsecurity.techtarget.com/tip/Gramm-Leach-Bliley-and-you
In Brief: The Financial Privacy Requirements of the Gramm-Leach-Bliley Act . (s.f.). Obtenido de ftc.gov: http://www.ftc.gov/tips-advice/business-center/guidance/brief-financial-privacy-requirements-gramm-leach-bliley-act
Six Practices to Help Ensure Continued Corporate Compliance. (s.f.). Retrieved from docfinity.com: http://www.docfinity.com/six-practices-to-help-ensure-continued-corporate-compliance
What is the impact of Sarbanes-Oxley on IT operations. (s.f.). Retrieved from techtarget.com: http://searchcompliance.techtarget.com/feature/FAQ-What-is-the-impact-of-Sarbanes-Oxley-on-IT-operations
Wright, M. (1994). Protecting information: Effective security controls. Review Of Business, 16(2), 4.