Reporting and monitoring constitute the nervous system of compliance programs; they bring potential concerns about misconduct to the compliance officer’s attention. However, reporting and monitoring are also the most challenging parts of a compliance program to develop. This is mainly due to two factors.
Firstly, the imperative of setting up well-functioning training programs and robust policies and codes of conduct that rest on a healthy risk assessment. If compliance modules are born out of an inadequate risk assessment, reporting and monitoring will eventually fail to deliver compliance officers with the right data as the compliance program components were not targeting relevant business risks in the first place.
Secondly, the dynamic of relaying information back and forth is at the heart of the reporting and monitoring systems, thus they must operate with a wide range of individuals, both inside and outside your business. These systems must be ready to encounter internal or external stimuli; translate those incidents into actionable intelligence; and relay that information to a central “brain” – in this case the compliance officer – that can decide how best to respond.
That said, compliance officers should consider the following pointers when developing reporting and monitoring systems.
Developing Compliance Reporting and Tracking: 4 Simple Steps
1. Carefully design reporting systems
Gather a complete picture of the business activities. Siloed data will hinder compliance officers from gaining comprehensive insight into business operations. Missing data, could mean key facts missing from a specific allegation of misconduct, siloed whistleblower reports, loopholes in investigations, etc.
2. Normalize and consolidate data
Normalize information as it flows upwards; consolidate disparate pieces of data into broader trends of compliance activity and send it along the correct executives. This process helps compliance officers ‘know what they want to know’ and react appropriately.
3. Develop escalation systems
The human element is crucial in detecting misconduct. In the same way that employees must know a reportable event when they see it, middle and senior managers (including the chief compliance officer) must know when an event or trend in data should be escalated and to whom. An effective escalation procedure matches an incident to the relevant persons in the enterprise with the right procedure to respond to it.
4. Automation is key
Manual processes are the mortal enemy of efficient reporting and monitoring systems. People might report data incorrectly, or submit it twice, or forget to submit it at all. The result is an inaccurate picture of compliance activity, exactly what any compliance officer wants to avoid. Effective reporting and monitoring systems should automate those manual processes out of existence wherever possible. The ideal is continuous monitoring, where the flow of data is constant and human intervention is minimal. A compliance trends survey published by Deloitte in 2015 also affirms this orientation towards automation in reporting and monitoring and report that “survey respondents listed desktop software and internally-developed tools as their most common IT systems for a wide range of tasks, including core responsibilities such as compliance monitoring and reporting, or measuring the effectiveness of the compliance department.”
Reporting and monitoring are indispensable processes for an effective compliance program. Compliance officers want to rely on optimal reporting and monitoring systems to examine the right data delivered and understand what to do next. That is what effective reporting and monitoring help to bring about.
