How Compliance Leaders Can Prepare Companies for Audits

NOTE: Schellman has since updated and expanded on this information in an article here.

Nobody likes a compliance audit, but they serve a necessary purpose in the business world. If an organization is lacking in its adherence to global compliance regulations, there could be serious fallout. Employees or customers may lose trust. Your company’s reputation could be damaged, and worse — lawsuits and fines can significantly damage financial health. For this reason, chief compliance officers must change the way they think about audits. Painstaking as they may be, an audit provides you the opportunity to rectify issues before they become larger problems. Instead of dreading and avoiding an upcoming audit, here’s how compliance leaders can prepare their company to make the review process less agonizing.

Know Your Industry

Be aware of all the specific regulations associated with your industry, not just the most obvious. Furthermore, gain an understanding of whether your company is up-to-date in its compliance with each. Common regulations include:

• The Federal Health Insurance Portability and Accountability Act (HIPAA)
• Gramm-Leach Bliley Act (GLBA)
• The Federal Information Security Management Act (FISMA)
• Payment Card Industry Data Security Standard (PCI DSS)
• The Sarbanes-Oxley Act (SOX)

Know Your Network

Understand the key systems involved in your company’s infrastructure and the critical systems necessary to provide services to your customers. This will play a critical role in determining which regulations that require compliance. Get organized by creating data flow charts for each key business process to ensure you understand how information is shared and protected within your company’s network.

Review Past Audits

Previous compliance issues that repeatedly go unresolved are an indication that the controls may not be functioning as intended or by the correct department. Identify these recurrent issues and figure out why they continually reappear to create a smoother audit next time around.

Have a Game Plan In Place

If any compliance issues are detected in your audit, you’ll want a plan in place to correct them — fast. Know ahead of time how you will prioritize, manage, delegate and execute resolution. It’s also important to consider how these efforts can contribute to continuous improvements in your company’s adherence to regulatory guidelines.

Communicate Clearly With Your Auditing Firm

The only thing worse than an audit is one that seems to last forever. Be forthcoming about the needs of your company, and confirm that the auditing firm understands how to properly field any difficulties that arise during the audit, which could inhibit their ability to reach key progress points.

Make Your Audit Work For You

Compliance audits cost money. To minimize the expense, use them as an opportunity to refine the way your company operates. Consider how you can use the insight provided by the audit to increase revenue, cut costs and better manage risk.

Preparation is the key to a painless audit. With proper foresight and planning, audits don’t have to be arduous, painful reminders of your company’s compliance shortcomings. They can be useful tools that provide invaluable insight into how your company can improve its operations to strengthen bottom line, fortify trust and reputation, protect itself from costly security gaps and compete in today’s increasingly regulated marketplace with confidence.