Compliance officers have a lot of work to do, and that workload is not going to recede any time soon. They also have high expectations placed upon them, by the board, regulators, the CEO, and others who depend on the compliance function to do its job well. Let’s explore one approach to technology that addresses both of those unpleasant facts of life: compliance process automation.
What Is Compliance Process Automation?
Compliance process automation is just what the phrase implies: the automation of compliance processes that previously had been done manually, by employees. With automation technology, the software runs the process from start to finish. Compliance teams implement the solutions then supervise and review the results.
You’ll encounter a few other terms when talking about this idea. Robotic process automation (RPA) is the automation of any standard business process—so compliance process automation is one example of RPA, but many other examples have little to do with compliance. Artificial intelligence (AI) is also the decision-making logic that drives automation forward; the AI gets a piece of information and decides what to do next, based on rules you’ve already articulated. The better the AI is, the more complex processes you can automate.
This is more than, say, a software program tallying up numbers listed on a spreadsheet. That is a one-step process, and technology has been doing one-step processes for years.
Compliance process automation automates multi-step processes: tallying up numbers on a spreadsheet, then comparing them to historical averages, then sending an email alert to a supervisor if this month’s total is above average, and then sending other alerts to specific account executives that high-risk vendors listed in lines 4, 18, and 192 won’t have invoices processed. That’s compliance process automation. (More examples later.)
Why You Need Compliance Process Automation
That’s easy. Compliance officers need process automation because we have lots of work to do, and much of that work is made up of tedious processes that should be automated anyway.
This is a key point about compliance process automation and artificial intelligence generally. Those things are not going to make the compliance officer’s job obsolete. On the contrary, we see examples everywhere of compliance officers become more important to a business because businesses need to foster a strong corporate culture of compliance.
But fostering a strong corporate culture is not the same as executing various compliance processes. In the 2020s, chief compliance officers will need to play more of an advisory role, helping senior executives to articulate ethical principles and making the ethical culture visible for all stakeholders to see. All the processes underneath that larger goal—the due diligence checks, the monitoring, the analysis of complaints data, and more—is what can be automated.
Put those two concepts together, and the value of compliance process automation becomes clear. As automation accelerates the mundane processes of running a compliance program and generates better data about how the program is performing—that frees up more time for the compliance officer to study the company’s ethics and compliance performance. Then you can make sharper, better recommendations about how to keep elevating the company’s culture of compliance.
Examples of Compliance Process Automation
Compliance officers can take advantage of process automation in all sorts of ways. Let’s look at three examples:
Due Diligence and Third-Party Onboarding
This process is perhaps best suited for automation, because onboarding is a repetitive, tedious task—exactly what automation can do more quickly, and more accurately, than people.
Automation would allow business executives working with third parties to enter each party as, say, a new vendor. Then the compliance technology would automatically cross-check that party against various screening databases, and populate the results into a form that generates a risk score based upon the answers. Low-risk parties could be allowed to receive payments for invoices; while high-risk parties are routed to employees for further review or deeper due diligence.
Complaints Analysis
Every large company already has an internal reporting hotline, and most large companies can even route certain complaints to be handled in certain ways. Automation could let compliance officers study the volume of complaints at scale, so you can identify emerging trends in complaints more quickly and decide how to respond.
For example, automation could track complaints by issue, and track each issue as a percentage of all complaints. When an issue hits some critical threshold—say, going from 5 to 10 percent of all complaints, or rising every month for four months straight—that can trigger alerts to compliance officers that the issue has become more pressing. Automation can also lead to better tracking of case closure times, or amount of detail included in a complaint, or so forth.
Controls Testing and Monitoring
Testing controls is another laborious task where compliance personnel need to select a sample number of transactions, gather the data, perform the test, and document the results. Before any of that even begins, you also need to decide how often to test.
Automated compliance processes could address those headaches by, for example, pulling relevant data from multiple systems, rather than employees tracking and logging them manually. Automated processes can also handle more transactions, more often, and send the documented results more quickly. It brings the company much closer to continuous monitoring, rather than regular testing.
Those examples are over-simplified, but they all do capture the basic benefits of process automation:
- More data: automated processes can work with more, and potentially all, the transactions you have—which brings more precision to analysis.
- Reduced failure rates: one of the gravest threats to compliance success is a person typing the wrong thing in an Excel spreadsheet; automation eliminates that risk.
- Better documentation and reporting: automated processes document every step of the process that they run. That creates an audit trail compliance officers can share with regulators, audit firms, or other parties. They can also generate reports automatically, giving you a current, comprehensive view of compliance program performance when you want it.
The Bigger Picture
Despite all the benefits of compliance process automation, the best argument for it might actually be the converse: compliance functions won’t be able to thrive without it.
The plain truth is that corporations will continue to deal with more third parties, execute more transactions, and exist in a more regulated, more transparent world. All of that means more risk for the corporation, which implies a greater need for assurance that the compliance program is working well.
No compliance team will be able to do that with manual processes for much longer. There will be too much work and not enough resources for the compliance function to hire personnel to do it. Plus, you’d still have a higher risk of errors, incomplete information, or insufficient documentation.
Automated compliance processes are the inevitable path forward. Getting there won’t necessarily be quick or easy, but the benefits will be worth the journey.
Matt Kelly is an independent compliance consultant and the founder of Radical Compliance, which offers consulting and commentary on corporate compliance, audit, governance, and risk management. Radical Compliance also hosts Matt’s personal blog, where he discusses compliance and governance issues, and the Compliance Jobs Report, covering industry moves and news. Kelly was formerly the editor of Compliance Week. from 2006 to 2015. He was recognized as a "Rising Star of Corporate Governance" by the Millstein Center in 2008 and was listed among Ethisphere’s "Most Influential in Business Ethics" in 2011 (no. 91) and 2013 (no. 77). He resides in Boston, Mass.