Jump to content

Regulatory compliance

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Schmetterling5 (talk | contribs) at 10:56, 2 May 2013 (→‎International compliance). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

"Compliance (regulation)" redirects here. For other uses, see Compliance (disambiguation).

In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Regulatory compliance describes the goal that corporations or public agencies aspire to achieve in their efforts to ensure that personnel are aware of and take steps to comply with relevant laws and regulations.

Due to the increasing number of regulations and need for operational transparency, organizations are increasingly adopting the use of consolidated and harmonized sets of compliance controls. [1][2] This approach is used to ensure that all necessary governance requirements can be met without the unnecessary duplication of effort and activity from resources.

International compliance

The International Organisation for Standardisation (ISO) produces international standards such as ISO17799. The International Electrotechnical Commission (IEC) produces international standards in the electrotechnology area.

Some local or international specialized organizations such as the American Society of Mechanical Engineers (ASME) also develop standards and regulation codes. They thereby provide a wide range of rules and directives to ensure compliance of the products to safety, security or design standards.[3]

Compliance in different countries

USA

Corporate scandals and breakdowns such as the Enron case of reputational risk in 2001 have highlighted the need for stronger compliance and regulations for publicly listed companies. The most significant regulation in this context is the Sarbanes–Oxley Act developed by two U.S. congressmen, Senator Paul Sarbanes and Representative Michael Oxley in 2002 which defined significant tighter personal responsibility of corporate top management for the accuracy of reported financial statements.

The Office of Foreign Assets Control (OFAC) is an agency of the United States Department of the Treasury under the auspices of the Under Secretary of the Treasury for Terrorism and Financial Intelligence. OFAC administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign states, organizations, and individuals.

Compliance in the USA generally means compliance with laws and regulations. These laws can have criminal or civil penalties or can be regulations. The definition of what constitutes an effective compliance plan has been elusive. Most authors, however, continue to cite the guidance provided by the United States Sentencing Commission in Chapter 8 of the Federal Sentencing Guidelines.[4][citation needed]

On October 12, 2006, the U.S. Small Business Administration re-launched Business.gov (new Business.USA.gov)[5] which provides a single point of access to government services and information that help businesses comply with government regulations.

There are a number of other regulations such as PCI-DSS, GLBA, FISMA, Joint Commission and HIPAA. In some cases other compliance frameworks (such as COBIT) or standards (NIST) inform on how to comply with the regulations.

UK

There is considerable regulation in the UK, some of which is from EU legislation. Various areas are policed by different bodies, such as the FSA (Financial Services Authority), Environment Agency and Scottish Environment Protection Agency, Information Commissioner's Office and others.

Important compliance issues for all organisations large and small include the Data Protection Act 1998 and, for the public sector, Freedom of Information Act 2000.

The UK Corporate Governance Code (formerly the Combined Code) is issued by the Financial Reporting Council (FRC) and sets out standards of good practice in relation to board leadership and effectiveness, remuneration, accountability and relations with shareholders. All companies with a Premium Listing of equity shares in the UK are required under the Listing Rules to report on how they have applied the Combined Code in their annual report and accounts (The Codes are therefore most similar to the US' Sarbanes-Oxley Act).

Australia

Standards Australia revised the standard titled "AS 3806 - Compliance Programs". While many aspects of the original standard produced in 1998 standard appear in the 2006 version there are additional principles covered. The regulators in Australia continue to endorse and encourage (by regulation) the use of the standard when establishing a compliance framework.

The regulators are the Australian Securities and Investment Commission and the Australian Prudential Regulation Authority (APRA).

Compliance demands in the superannuation industry continue to increase due to the new licensing regime implemented by APRA. The new licensing regime requires trustees of superannuation funds to demonstrate to APRA that they have adequate resources (human, technology and financial), risk management systems and appropriate skills and expertise to manage the superannuation fund. The licensing regime has lifted the bar for superannuation trustees with a significant number of small to medium size superannuation funds exiting the Industry due to the increasing risk and compliance demands.

Canada

See Keeping the Promise for a Strong Economy Act (Budget Measures), 2002, commonly known as C-SOX or "Bill 198".

Challenges

Data retention is a part of regulatory compliance that is proving to be a challenge in many instances. The security that comes from compliance with industry regulations can seem contrary to maintaining user privacy. Data retention laws and regulations ask data owners and other service providers to retain extensive records of user activity beyond the time necessary for normal business operations. These requirements have been called into question by privacy rights advocates.[6]

Compliance in this area is becoming very difficult. Laws like the CAN-SPAM Act and Fair Credit Reporting Act in the U.S. require that businesses give people the “right to be forgotten.” In other words, they must remove individuals from marketing lists if it is requested, tell them when and why they might share personal information with a third party, or at least ask permission before sharing that data. Now, with new laws coming out that demand longer data retention despite the individual’s desires, it can create some real difficulties.

Compliance data is defined as all data belonging or pertaining to enterprise or included in the law, which can be used for the purpose of implementing or validating compliance. It is the set of all data that is relevant to a governance officer or to a court of law for the purposes of validating consistency, completeness, or compliance

See also

References

  1. ^ Integrated Governance, Risk, and Compliance Standard Terminology List[dead link]
  2. ^ Silveira, P., Rodriguez, C., Birukou, A., Casati, F., Daniel, F., D'Andrea, V., Worledge & C., Zouhair, T. (2012), Aiding Compliance Governance in Service-Based Business Processes, IGI Global, pp. 524–548{{citation}}: CS1 maint: multiple names: authors list (link)
  3. ^ Boiler and Pressure Vessel Inspection According to ASME
  4. ^ USSC.gov[dead link]
  5. ^ Business.USA.gov
  6. ^ "Compliance Challenge: Privacy vs. Security". Dell.com. Retrieved 06-19-12. {{cite web}}: Check date values in: |accessdate= (help)
  • Business.USA.gov, Official U.S. Government Portal for Complying with Regulations.
  • European Project COMPAS, European Project COMPAS - Compliance-driven Models, Languages, and Architectures for Services; funded by the EU 7th Framework Programme Information and Communication Technologies Objective.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Regulatory_compliance&oldid=553179948"