Fewer Sleepless Nights for Compliance Executives

Improved compliance programs, sufficient resources and board access have meant fewer concerns about personal liability for compliance executives, according to a study by DLA Piper.

In its 2017 Global Compliance & Risk Report, DLA Piper found that 67% of chief compliance officers surveyed said they were at least somewhat concerned about their personal liability and that of their CEOs, which was down from 81% in 2016. And 71% said they made changes to their compliance programs based on recent regulatory events, up from just 21% a year earlier. The study found that globally the compliance function is becoming more independent and prominent in large organizations.

There still remains room for improvement, however, most notably in compliance’s relationship with boards of directors. Directors, surveyed for the first time, were more uneasy, with 82% expressing at least some concern about personal liability. “This is likely related to other findings that show lingering kinks in communications channels and a persistent lack of training for directors. Together, these findings indicate that the relationship between the compliance function and boards needs work—despite efforts taken by organizations to upgrade their compliance program,” DLA Piper said.

In 2016, 77% of compliance executives said they had sufficient resources, clout and board access to support their ability to effectively perform their jobs. This year the number rose to 84% who said they felt that way. The improvement is possibly a reflection of the increased percentage of respondents who had the resources to make changes to their compliance program, compared to 2016, according to the survey.

While more respondents said they are increasingly able to affect change, obtain the resources they need and access senior leadership, however, a larger number said their budget was not high enough to accomplish their goals, from 28% in 2016 to 38%.

Boards had a different view, with 53% of directors agreeing strongly that their compliance group had sufficient resources, clout and board access. This was compared to just 29% of CCOs, which could indicate that CCOs are not effectively communicating their needs, the company said.

Of concern was that many directors appear to be receiving inadequate reporting and training on compliance matters. About a quarter of both CCOs and board members said the compliance function at their organization reports to the board less than once per quarter.

Of training, the report said that in light of a perceived heightened liability exposure for directors, it is puzzling that 44% of director respondents said they hadn’t received any training on compliance issues. Given evolving compliance standards and regulations—such as new Securities and Exchange Commission guidance on conflict minerals and updated DOJ guidance on corporate fraud—it’s arguable that training is more important than ever. Failure to engage in training could amount to a breach of fiduciary duty.

Almost half of respondents, 46%, identified monitoring as the weakest part of their compliance program. Monitoring, however, is particularly important in managing third-party risk, as regulators remain focused on violations related to third parties and as companies struggle to manage sprawling global organizations, DLA Piper said.

Top tools companies use to rate their compliance program:

North Korea Now Suspected in Ransomware Attack

The massive cyberattack that has struck businesses, government agencies and citizens in more than 150 countries may be tied to hackers affiliated with North Korea. Called WannaCry, the ransomware encrypts the victim’s hard drive and demands a ransom of about $300 in the virtual currency bitcoin.

According to the Washington Post:

Several security researchers studying “WannaCry” on Monday found evidence of possible connections to, for instance, the crippling hack on Sony Pictures Entertainment in 2014 attributed by the U.S. government to North Korea. That hack occurred in the weeks before Sony released a satiric movie about a plot to kill North Korean leader Kim Jong Un.

The New York Times reported that the malicious software, based on a vulnerability included in the National Security Agency tools published by the Shadow Brokers hacker group, was distributed via email. The ransomware takes advantage of vulnerabilities in Microsoft Windows systems, generating the largest ransomware attack to date. Although the flaw was patched by the company months ago, the wide spread of the attack illustrates how many users fail to update their software. Institutions and government agencies affected included the Russian Interior Ministry, FedEx in the United States and Britain’s National Health Service.

Organizations are advised to save their data and take other measures to avoid being hacked. Kroll said that while the particular ransomware variation involved in hundreds of thousands of incidents has now been rendered largely harmless, its cyber security and investigations team “strongly recommends that organizations recognize that a small change in the malware code could reactivate it. So action should be taken in conjunction with your technology unit to reduce your risk and prepare for inevitable future similar attacks. If the malware has entered your network, it has the ability to spread—and spread rapidly.”

According to Kroll:

  • Obsolete versions of Microsoft Windows are particularly vulnerable. We understand that there may be very specific circumstances that require you to use versions that are no longer supported, but now is the time to revisit the topic. See if there is any way you could use a supported operating system running a virtual version of the operating system you need.
  • Microsoft has been working to roll out updates that can fix the underlying security weakness that this malware exploits. You should make sure that both your personal and business machines running Windows are updated. We know that many people don’t want to take the time to close out all their files and restart their computers to allow updates to occur, but this is an important defense against the WannaCry ransomware. As an indicator of how serious the threat is, note that Microsoft has even released a security patch for the old Windows XP system. Please take steps to assure that all relevant machines running the Windows operating system are updated.
  • Organizations that don’t have well-thought-out backup and recovery plans are also very vulnerable. Management should be asking if there is a plan to assure that all important files are backed up in a way that will prevent a ransomware infection from attacking both the primary files and the backups.

President Trump ordered homeland security adviser Thomas P. Bossert to coordinate a government response to the spread of malware and find out who was responsible. According to the Times:

“The source of the attack is a delicate issue for the United States because the vulnerability on which the malicious software is based was published by a group called the Shadow Brokers, which last summer began publishing cybertools developed by the National Security Agency.”

Government investigators, while not publicly acknowledging that the computer code was developed by American intelligence agencies, say they are still investigating how the code got out. There are many theories, but increasingly it looks as though the initial breach came from an insider, perhaps a government contractor.

In a report, How to Protect Your Networks from Ransomware, the U.S. government recommends that users and administrators take preventative measures, including:

  • Implement an awareness and training program. Because end users are targets, employees and individuals should be aware of the threat of ransomware and how it is delivered.
  • Enable strong spam filters to prevent phishing emails from reaching the end users and authenticate inbound email using technologies like Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) to prevent email spoofing.
  • Scan all incoming and outgoing emails to detect threats and filter executable files from reaching end users.
  • Configure firewalls to block access to known malicious IP addresses.
  • Patch operating systems, software, and firmware on devices. Consider using a centralized patch management system.
  • Set anti-virus and anti-malware programs to conduct regular scans automatically.
  • Manage the use of privileged accounts based on the principle of least privilege: no users should be assigned administrative access unless absolutely needed; and those with a need for administrator accounts should only use them when necessary.

Make Your Hurricane Preparations Now

With the Atlantic hurricane season’s official start on June 1, the time to check your buildings and existing contingency plans—or start a new one—is now, during hurricane preparedness week.

For 2017, Colorado State University’s hurricane research team predicts slightly below-average activity of hurricanes making landfall, with a forecast of 11 named storms, four hurricanes, and two major hurricanes.

The 2016 season is seen as a wakeup call, as 15 named storms and seven hurricanes formed in the Atlantic Basin—the largest number since 2012. Among the hurricanes was Matthew, a Category 4, which devastated Haiti, leaving 546 dead and hundreds of thousands in need of assistance. After being downgraded to a Category 2, Matthew pummeled southeast coastal regions of the U.S., with 43 deaths reported and widespread flooding in several states.

Here are 10 preparedness steps offered by FEMA:

The Insurance Institute for Business & Home Safety (IBHS) warns that small businesses are especially vulnerable. Of businesses closed because of a disaster, at least one in four never reopens.

IBHS offers these steps for preparing a business for hurricane season:

  1. Have your building(s) inspected and complete any maintenance needed to ensure your building can stand up to severe weather.
  2. Designate an employee to monitor weather reports and alert your team to the potential of severe weather.
  3. Review your business continuity plan and update as needed, including employee contact information. If you do not have a business continuity plan, consider IBHS’ free, easy-to-use business continuity plan toolkit for small businesses.
  4. Remind employees of key elements of the plan, including post-event communication procedures and work/payroll procedures. Make sure all employees have a paper copy of the plan. Review emergency shutdown and start-up procedures, such as electrical systems, with appropriate personnel, including alternates.
  5. If backup power such as a diesel generator is to be used, test your system and establish proper contracts with fuel suppliers for emergency fuel deliveries.
  6. Re-inspect and replenish emergency supplies inventory, since emergency supplies are often used during the offseason for non-emergency situations.
  7. Test all life safety equipment.
  8. Conduct training/simulation exercises for both your business continuity and emergency preparedness/response plans.

Interstate Restoration has a day-by-day list of steps for business storm preparation, based on NOAA recommendations. They include research, planning and documenting, gathering emergency supplies, checking insurance coverage and supply chain and finalizing your plan.

Navigating Risk Management Around the Globe

Over the past few years, I’ve had the wonderful opportunity to travel the world and visit factories, distribution centers, ports, warehouses, and several offices for the company where I work. Apart from being a great way to see the world, it has also been an opportunity to learn from the ways different cultures see and manage risk.

Coming from Latin America, it was clear to me that the concept of risk management was something not highly promoted or recognized in the region. Companies that operated locally took the approach of using intermediaries to transfer their risks to insurance companies. Occasionally I would find buyers focused on managing their own risks efficiently. But that was more than a decade ago. During my most recent trips to South America, I had the opportunity to see the implementation of a regional affinity program—a collaboration between a well-known broker and our company’s financial operations. In this case, those involved were highly educated in insurance concepts and their understanding of risk acceptance was completely in line with more developed markets.

Another interesting aspect of dealing with this program was the strong relationship between the broker and our office. It was a very cordial and open communication that transcended the usually formal interaction between these parties—and included text messages flying back and forth to get the deal done. In a way, the warm personality of South Americans permeated the business environment. So when it comes to this colorful part of the world, business is, in fact, personal.

European markets have had the opportunity to evolve over centuries and this is clearly represented in the broadness of coverages available. The highly tailored wordings, both inside and outside of Lloyds, give a global insurance program more complexity when it includes exposures in Europe.

In a way, Europe continues to be an innovation hub but with difficulties in exporting those advancements. There are still great products and coverages in the insurance market that have not found their way to the Americas—and only on a limited basis to Asia. There are reasons behind this, however. While the nature of exposures in Europe continue to be unique in multiple ways, one reason these solutions have not fully taken off is that other markets do not yet fully recognize the need for them.

Asia marked, for me, a huge difference in how I saw the business relationship around insurance and the implementation of risk management. Those markets are inherently independent from the broker relationship and thus are inclined to build direct dealings with insurers. This proves to be difficult when a foreign multinational attempts to combine Asian exposures with a global program. There is reluctance to work with intermediaries and it can take time to transform the carrier-insured liaison, which can only happen after a trusting relationship is built.

Have you recognized patterns in some regions? Do you think that analyzing and exploring this kind of multicultural risk management would be of benefit to organizations?