Tag Archives: regulatory risk

Immediate Vault Immediate Access

4 Steps to Help Organizations Embrace Risk from Emerging Technology

Posted on by

As companies continue to navigate the changing work environment brought on by the pandemic, it has become clear that business leaders will need to get comfortable revising and adapting their strategies to deal with disruption brought on from new technologies and new regulation. As risk management professionals, these rapid changes have made our job more important than ever to our organizations.

online pharmacy sildalis with best prices today in the USA

Yet the majority of our organizations—particularly in C-suites—remain far from giving risk management experts the seat at the table they need to effectively safeguard against enterprise threats, digital or otherwise.

Data from PwC’s Global Risk Survey 2022 shows that executives are starting to recognize these risks: 79% of executives report that they view the breakneck speed of digital transformation as a significant risk management challenge. Moreover, this renewed focus is translating into increased funding, as 65% of organizations are increasing their spending on risk management technology and 56% said they planned to invest in risk culture and behavioral risk in 2022.

online pharmacy mobic with best prices today in the USA

Unfortunately, the survey also found that too many organizations are treating the risk function as an add-on or incorporating risk leaders into strategic conversations too late. Only 39% of business leaders reported adding risk professionals to decision-making processes early, which should be an essential step for executives seeking to minimize risk from the outset. On a broader scale, executives seemed to lack confidence in risk managers, with only 47% of respondents saying they feel “very confident” in their risk function’s ability to build a more risk-aware culture, a key element of any successful risk-focused company.

Particularly as companies invest in emerging technologies, business leaders need to listen more to their risk and compliance functions and integrate them into conversations about how those technologies will be implemented. Artificial intelligence is a great example: when companies rush to implement systems to accelerate efficiency and analyze trends, they risk creating disproportionate bias and violating personal privacy through data sourcing. Risk professionals need to be at the table from beginning to end to make sure that an evolving regulatory environment and other pitfalls are fully accounted for in the organization’s implementation process.

While investment in risk management technology is helpful, it is insufficient without making structural changes to the organization to prioritize the risk function company-wide. Particularly as companies consider adopting emerging technologies, the following steps should be considered not just by risk management professionals, but across the C-suite:

  1. Identify, categorize, and prioritize technology risks across the company. This should be done on a regular basis by a dedicated risk management team, married with the best tools available, with findings routinely reported back to senior leaders. Companies are on the right track here: 65% plan to increase their technology spend this year across data analytics and process automation to support detection and monitoring of risks. This initial step will lay the framework for the establishment of cyber threat intelligence, systems monitoring, and incident response protocols.
  2. Adapt IT governance to the emerging technologies being adopted. Risk professionals should work with IT teams and company leadership to create governance structures that integrate seamlessly with corporate strategy, allowing for alignment of day-to-day operations, effective decision-making, a framework for best practices, and promotion of investments that enhance business objectives.
  3. Update leadership often on the emerging tech regulatory landscape. Whether across data privacy rules, cyber reporting requirements, or other complex technology challenges, a robust compliance program should keep leaders across the company updated as new technologies are implemented. Otherwise, companies risk run-ins with legal authorities and the erosion of trust from their clients and customers.
    online pharmacy cymbalta with best prices today in the USA

  4. Set expectations with leadership that not all risks are one and the same. Understanding the context around each piece of technology will become imperative to understanding its specific risks and the appropriate response strategy, including the maturity and complexity of the business processes to determine true risk to the company. Inherent in this case-by-case evaluation is an understanding of the company’s risk appetite and criteria for acceptable level of risk.

When adopted purposefully, emerging technologies can make companies more efficient, more profitable, and better stewards for their employees, clients and communities. Risk is often unavoidable for early adopters of emerging technologies, but it can be mitigated if C-suites equip their risk functions with a holistic strategy and a voice in key business decisions. As C-suites and organizations seek to adapt to a changing world, their success will hinge on the extent to which risk management is incorporated into their strategies.

Court Overturns Prop 22, California’s Gig Worker Classification Law

Posted on by

On August 25, the Alameda County Superior Court in California declared that Proposition 22 (better known as Prop 22) violated the state’s constitution, overturning it and potentially putting a portion of the state’s gig work industry in peril. The controversial California ballot measure designated app-based gig workers like rideshare and food delivery drivers as independent contractors, meaning that the companies they ostensibly work for would not have to provide a minimum wage, health insurance, unemployment, sick leave or other benefits. Because the initiative was a ballot measure, the court found the law restricted the state legislature’s ability to regulate compensation rules, and said the measure also illegally prevented workers from collective bargaining and unionization. However, this ruling does not mean that gig workers will automatically be considered employees, as no previous law mandated that classification.

Before Prop 22’s passage in November 2020, California passed AB 5 in May 2019, which instituted a more rigorous test to determine whether workers were employees or independent contractors: if “the person is free from the control and direction of the hiring entity in connection with the performance of the work,” the work was outside the company’s usual business, and if the worker “customarily engaged in an independently established trade, occupation or business of the same nature as that involved in the work performed.”

Rideshare companies like Uber and Lyft essentially ignored AB 5 and poured $224 million into fighting for Prop 22, making it “the most expensive ballot measure in California history,” according to the Los Angeles Times. The measure passed with around 59% of the vote.

In a small concession for workers, Prop 22 did provide for a health insurance stipend, but an August 2021 UC Berkeley Labor Center survey of 500 drivers showed that only around 10% of workers were receiving it, and 40% had not heard about it at all. Since work hours are only defined by the time spent driving with a passenger, others do not work the required 15 hours per week on one app to qualify for the stipend. These and other factors prompted drivers and the Service Employees International Union (SEIU) to sue the state seeking to overturn the law.

For now, the Superior Court ruling will likely not change much for gig workers in California, as Uber and other companies have announced their intention to challenge it in higher courts and may ignore any of its other legal implications, leaving everyone involved with a shaky status quo: an overturned law that is effectively still being followed.

As Risk Management wrote in May, one danger of the continuing ambiguity surrounding gig worker classification is misclassifying workers, which can lead to heavy fines or lawsuits. For example, in January 2020, D.C.-based contractor Power Design Inc. agreed to pay $2.5 million for misclassifying 500 workers as independent contractors rather than employees. In August, food delivery app company Postmates settled with the city of Seattle for nearly $1 million for violating the city’s Gig Worker Paid Sick and Safe Time (PSST) ordinance. The payment will go to cover city fines and compensate more than 1,600 workers for back wages. Additionally, withholding benefits, overtime, and meal and rest breaks (whether a result of misclassification, or in general) can result in workers filing class action lawsuits against the company, potentially resulting in significant costs, impacting productivity and damaging the organization’s reputation.

Another risk for gig work companies is insufficient safety measures for workers. Unlike with formal employees, companies often do not provide gig workers with safety training and may not offer formal ways to report safety concerns. This creates an environment where workers who are often under pressure to complete as many rides or tasks as quickly as possible may get into accidents or leave dangers unreported, creating liabilities for themselves and the company.

online pharmacy reglan with best prices today in the USA

Other states have their own gig work regulations either on the books or in the works and President Joe Biden has expressed support for gig worker classification as employees, but there is currently no national legislation on this issue. However, in March, the House of Representatives passed the Protect the Right to Organize Act (or PRO Act), which would reclassify gig workers as employees, affording them all the benefits included in that status.

online pharmacy spiriva inhaler with best prices today in the USA

The Senate has not yet taken up the measure.

New York City’s New Biometric Information Law Governs Collection and Use of Consumer Health Data

Posted on by

For risk professionals, the COVID-19 pandemic has increased the importance of ensuring customer and employee safety measures are incorporated into operations, processes and future strategies. As many businesses reopen from pandemic shutdowns or return from remote work arrangements, some enterprises are now exploring both the effectiveness and the risks associated with conducting health screenings that collect biometric information and other personal health data.

This month, New York City released the Biometric Information Law, a new measure that goes into effect on July 9 and imposes disclosure requirements on businesses that collect consumer biometric information.

online pharmacy ciprodex with best prices today in the USA

It also sets parameters on what they can do with that information, most importantly, prohibiting the exchange of biometric information for anything of value.

As detailed in recent client notice from the law firm Reed Smith, highlights from the law include:

  • The measure requires a business that “collects, retains, converts, stores or shares biometric identifier information of customers” to place a “clear and conspicuous sign” near all consumer entrances that, in plain language, discloses the collection, retention or sharing of biometric information.
  • It stipulates that it is unlawful to “sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information.”
  • It establishes “an ‘aggrieved’ consumer’s private right of action,” meaning that “[a]ny person who is aggrieved by a violation by this chapter is entitled to commence an action to enforce its protections.”

There are key exclusions, however, as “governmental agencies, employers, or agents” are expressly excluded from compliance with any provision.

New York is not the only state to enact a law attempting to govern how organizations can use biometric information. Arkansas, California, Illinois, Texas and Washington have also set guidelines for businesses.

online pharmacy tenormin with best prices today in the USA

Indeed, the recent Risk Management Magazine article “Preparing for Biometric Litigation from COVID-19” addresses the imminent and critical questions businesses must answer when collecting and handling such data.

Sensitivities surrounding the confidentiality of biometric and other health information are not new in certain industries, such as healthcare. Further, even before COVID-19, risk professionals were already grappling with the risks associated with new biometric technologies and the data collected, especially with regard to facial recognition, wearables and even the rise in popularity of telehealth.

Now, with every organization on high alert about infectious diseases and how quickly they can interrupt business, health and safety have become top priorities for every risk professional in every sector.

online pharmacy xtandi with best prices today in the USA

As risk professionals look to new technology for help with these concerns, monitoring the emerging regulation and security risks around health and biometric technology will become increasingly critical in balancing benefit and risk to their organizations.
Online Pharmacy https://galenapharm.com/ no prescription
Data security will continue to remain a significant threat, but New York’s Biometric Information Law should serve as a reminder that what the organization does with that data can also have a lasting impact on the enterprise’s reputation and consumer trust.

For more information to help risk professionals manage new health technology and data, check out these articles from Risk Management Magazine:

Six Considerations Impacting Strategic Regulatory Change Management

Posted on by

Regulatory change management (RCM) is one of the most important risk and compliance related domains in 2021, thanks to two key drivers. First, the shift from Republican deregulation to Democratic control and an expected uptick in regulatory requirements. Second, similar to the 2008 crash, the pandemic-induced economy and focus on Paycheck Protection Program (PPP) loans caused many banks to relax their regulatory exams and requirements, while regulators gave companies extra runway for transitioning processes and policies for remote/work-from-home models.

Sometimes regulatory changes are significant enough to change business strategy. In 2021, chief risk officers must be prepared to quickly adapt and react to a historically volatile risk management environment.

buy advair online dentalhacks.com/wp-content/uploads/2023/10/jpg/advair.html no prescription pharmacy

When thinking about an updated, strategic regulatory change management program, here are six considerations for chief risk officers:

1. Lax compliance during the pandemic in 2020 may have introduced hidden risk for activities that normally would have had deeper oversight. 
Sometimes rule changes can also introduce new risks or eliminate a previous risk that needed to be managed, such as potential new default rates around extensions, forfeiture and other things. For example, historically low interest rates present a vexing risk for banks dealing with less profit but just as many loans to process.

buy xenical online dentalhacks.com/wp-content/uploads/2023/10/jpg/xenical.html no prescription pharmacy

What kind of new risk may be found within those loans?

2. When communicating change across the enterprise, establish responsibility to manage it.
Once you understand which regulations have changed, prioritize those that present the most risk, identify what department’s products and processes are impacted, and determine who is responsible for managing those policies. Having a secure central repository for communicating, storing and managing compliance documentation, versus relying on employees storing information on devices outside corporate servers, is ideal.
buy proscar online dentalhacks.com/wp-content/uploads/2023/10/jpg/proscar.html no prescription pharmacy

 

3. If conducting quarterly testing of compliance requirements, it may be challenging to identify key areas in advance that could slip, such as controls around IT/cybersecurity.
When the risk portfolio changes, the controls to manage those risks must be updated accordingly. Firms that may now be less dependent on management oversight and more dependent on confirmations that processes are being followed should put automated controls in place to verify those activities.

4. Companies should shift to best practice or common checklists that can be standardized and shared across the enterprise. 
Assessment checklists are a great way to ensure that all requirements are being met for a wide variety of business processes. Once checklists have been updated, cloud-based software systems can track who has access and can also notify when changes happen. 

5. Historically done manually in-house by visible teams, monitoring and testing for compliance purposes will be conducted remotely. 
The visibility of those tests presents significant challenges, and it is critical to determine how errors and issues will progress and be communicated to the remote testing teams, management, and the organization at large. 

6. Verifying and certifying online training for remote employees can be daunting. 
Creating courses formalized for online training represents a major compliance and process change, particularly for companies in industries with limited work-from-home models, such as financial services. Training materials will need to be updated for new employees, while previously trained employees will need to be retrained.