SEARCH

A Chief Compliance Officer (CCO) is responsible for ensuring that an organization complies with relevant laws, regulations and to a broader sense – all stakeholder obligations associated with safety, security, sustainability, quality, environmental and internal commitments. The role of a CCO is crucial in ensuring that a company operates ethically and responsibly while minimizing the risk of legal, financial penalties, and loss of stakeholder trust. While a CCO has significant responsibility, they cannot fulfill their duties alone. They need help from other members of the organization to ensure alignment with organizational values and compliance with policies and procedures. This is because the outcome of compliance requires a collaborative effort that involves everyone in the organization working together. Additionally, a CCO needs help to fulfill their duties due to the complexity of compliance regulations and the constant changes to these regulations. Staying current with regulations and industry best practices requires constant monitoring and adaptation. Therefore, a CCO relies on other professionals within the organization to provide insights, identify risks, and recommend corrective and proactive actions. A CCO also needs assistance in implementing and enforcing policies and procedures. They may need to work with other departments such as human resources, legal, finance, and IT to ensure that compliance requirements are integrated into daily operations. However, for too long, many organizations have been managing their compliance in isolated siloes, only addressing issues after they've already occurred. This outdated approach is not only making the job of the CCO more difficult but also less successful. It's time to embrace a more proactive and integrative approach that takes a holistic view of your organization's capabilities. By doing so, you can stay ahead of the curve and ensure success in today's fast-paced business environment. A Proactive and Integrative Strategy For Compliance This approach involves several key elements, including integrating compliance into the organization's culture, taking a proactive rather than reactive approach to compliance, providing the necessary resources to enforce compliance, establishing clear communication channels, and adopting a culture of continuous improvement. First , the organization must integrate compliance into its culture. Meeting obligations and keeping promises must be a core value that guides the behaviour of everyone in the organization. Each person must understand their compliance obligations and take responsibility for adhering to the rules and regulations. By integrating promise keeping into the organization's culture, the organization minimizes the risk of non-compliance, reducing gaps in conformance and ensures sufficient performance to advance the outcomes of compliance: better safety, security, sustainability, quality, and stakeholder trust. Second , the organization must take a proactive approach to compliance. Instead of waiting for issues to arise, the organization should anticipate potential risks and take steps to mitigate them. This involves identifying areas of the organization that are particularly vulnerable to compliance issues and developing strategies to address those vulnerabilities. By taking a proactive approach to compliance, the organization can prevent risk as well as mitigate their effects ensuring the organization always stays between the lines. Third , the organization must provide the CCO with the necessary resources to enforce compliance effectively. This includes budget, technology, personnel, and training. The CCO should have access to the necessary tools and resources to monitor and enforce that obligations are met and promises kept. The organization must also provide training and education to employees to understand their compliance obligations and how to meet them. By providing the necessary resources, the organization supports the CCO in meeting their responsibilities which in turn helps the entire company keep all their promises. Fourth , clear communication channels between the CCO and other departments can support compliance. The CCO should be involved in all major decisions that could impact compliance, and other departments should consult with the CCO before making any decisions that could affect compliance. This ensures that compliance is considered in all decision-making processes and helps to minimize the risk of non-compliance. Finally , the organization must adopt a culture of continuous improvement. Compliance is not a one-time event but a continuous process. The organization should regularly review and assess its compliance program to identify areas for improvement. The CCO should work with other departments to develop and implement strategies to improve compliance continuously. By adopting a culture of continuous improvement, the organization provide the assurance that stakeholders require. Summary Compliance is crucial for the success of any organization, and the CCO plays a critical role in ensuring that the organization meets its obligations. However, they cannot do this alone or as an isolated part of the organization brought into the discussion after the fact. To support the CCO, the organization must adopt a proactive and integrative approach to compliance. This involves integrating compliance into the organization's culture, taking a proactive approach to compliance, providing the necessary resources, establishing clear communication channels, and adopting a culture of continuous improvement. By doing so, organizations minimize the risk of non-compliance and ensure it is able to continually stay between the lines and ahead of risk protecting value creation and engendering greater stakeholder trust.

This week we launched our “Learn with Me” program were we take a course together. The course we decided to start with is Sustainable Development (SD) and Environmental Stewardship (ES) provided for free by Polytechnique Montreal. This 4-week course introduces the topic and walks through 10 guidelines of sustainable development and environmental stewardship for Professional Engineers created by Engineers Canada in 2016. The first session began with us hearing from a variety of engineers, city planners, and others involved in sustainable engineering efforts. This provided the context of why this topic is so important. It also introduced us to important definitions: Sustainable Development - “development that meets the needs of the present without compromising the ability of future generations to meet their own needs” (Brundtland Commission) Environmental Stewardship - “the wisest use of the finite resources in nature to produce the greatest benefit while maintaining a healthy environment for the foreseeable future” (The World Federation of Engineering Organizations) Together, environmental stewardship is about keeping what we have, whereas sustainable development is about getting what we need. These definitions are intended to be practical and operational. They shape an objective to maintain a healthy environment at a cost but not at all costs recognizing that the environment will adapt and evolve. Sustainable engineering defines an approach to engineering to meet the challenges of sustainable development and environmental stewardship. Sustainable engineering assumes a broadened responsibility across the pillars of environmental, social and economic development. These pillars must be balanced to achieve a world that is livable, viable, and fair. The technical challenges alone that face sustainable engineering are immense. We learned using the IPAT equation that technologies will have to improve their efficiencies and emit up to 87% less green house gas for each unit of goods and service produced to achieve greenhouse emission targets. Clearly, there is much work to be done and considered. In many ways, in Canada, we have not done as much engineering as we used to. However, we now have an opportunity for that to change. Engineering needs to take on a more significant, broader, and intentional role if we are to achieve sustainable development and environmental stewardship objectives. To put all this into practice the national guideline on sustainable development and environmental stewardship for professional engineers outlines 10 guidelines for engineers: Engineers: Should maintain and continuously improve awareness and understanding of environmental stewardship, sustainability principles and issues related to their field of practice. Should use expertise of others to adequately address environmental and sustainability issues and enhance understanding and improve practices. Should incorporate global, regional and local societal values applicable to their work. Should establish mutually agreed sustainability indicators and criteria for environmental stewardship at the earliest possible stage in projects, and evaluate these periodically against performance targets. Should assess the costs and benefits of environmental protection, eco-system components, and sustainability in evaluating the economic viability of the work. Should integrate environmental stewardship and sustainability planning into the life- cycle planning and management of activities that impact the environment, and should implement efficient, sustainable solutions. Should seek and disseminate innovations that achieve a balance between environmental, social and economic factors while contributing to healthy surroundings in the built and natural environment. Should become engaged in a leadership role in the ongoing discussion of sustainability and environmental stewardship and solicit input from stakeholders and accredited experts in an open and transparent manner. Should assure that projects comply with regulatory and legal requirements by the application of best available, economically viable technologies and procedures. Should implement risk mitigation measures in time to minimize environmental degradation where there are threats of serious or irreversible damage but a lack of scientific certainty. Today these are voluntary for the most part. However, it is conceivable that in the near future “should” may be replaced with “shall” as governments strengthen their environmental commitment. Accepting responsibility is alway better when done voluntarily so now is the time for engineers to do just that. This after all is what engineers have always been good at –accepting responsibility – which is embedded in our code of ethics: The primary duty of engineers is to hold paramount the protection of public safety and welfare with due regard for the environment and societal values - Engineers Canada Code of Ethics I look forward to the weeks ahead as we continue to explore the topic of sustainable development (SD) and environmental stewardship (ES).

The Hoshin Kanri method is a popular LEAN approach used to align strategy with outcomes. It uses what is called an X-Matrix that functions as a compass to ensure that all planned effort is working towards long term priorities and principles. The X-matrix is oriented in the following way: North : guiding principles, priorities or goals South : long term outcomes, results, or breakthrough objectives West : short term objectives, initiatives, or actions East : processes or metrics to improve The corners are used to map the correlation or contribution between each component of the matrix starting at the bottom and working your way around clock-wise. This is a great time of the year to get out your compliance compass and make sure that your plans are working towards better compliance. To help you do just that we created the following X-Matrix using The 10 Principles of Effective Compliance as the basis to guide initiatives towards better compliance outcomes: This compliance compass is available in XLS formats here . May it guide your path and help you make certain that you are always in compliance.

Assurance is not an activity that compliance does or something that can be inspected into a business. It is an outcome that is created when stakeholders have confidence that an organization is meeting all its obligations today and will continue to be meet them in the future. This confidence is necessary for assurance and ultimately for trust to exist. That's why confidence levels are an important measure of success for all risk & compliance programs. Improving the level of confidence is therefore an important objective which often involves conducting audits to verify process outputs and validate program outcomes. However, conformance to procedures and processes, as important as that may be, are not enough to provide the necessary confidence for trust to be granted. Confidence is increased when companies take steps to make certain that promises are kept. This has more to do with improving the probability that the organization is heading in the right direction, operating between the lines, and is making progress towards its mission objectives. The best way that this is demonstrated is by having an operational compliance program to properly contend with obligation and operational risk. An effective compliance program will ensure that required capabilities and performance exist to meet all obligations today and in the future. These capabilities will include resiliency, sustainability, quality, safety, diversity, or any of the abilities that contend with the risks that matter to the organization. Measuring effectiveness of these capabilities is not something that traditional audit or assurance functions have done. However, this is what is now required to provide confidence that the business has a future. To improve the outcome of assurance the following questions need to be answered: What is the level of confidence that your organization will meet all of its obligations? What capabilities do you need to ensure that you will meet your obligations in the future? What measures can you take to make certain you can keep all your promises? What resources do you need to provide the necessary capabilities and measures? How will you evaluate your progress towards greater levels of assurance?

Does your improvement process properly contend with uncertainty and risk? Continuous improvement in the form of Deming's wheel (plan-do-check-act) has helped organizations in recent decades significantly improve their business and manufacturing processes. Traditional PDCA is an iterative process based on four (sometimes more) stages: Plan: establish objectives and processes required to deliver the desired result Do: perform the previously defined plan. Check (study): data and results are gathered and evaluated against targeted goals, objectives, and outcomes. Act (adjust): actions are identified to address non-conformities, issues, and opportunities for improvement. Variations of this process exist and include: DMAIC, A3, Lean Improvement Kata, and others. Each one serves a slightly different purpose but what they have in common is that they focus on problems after they have manifested themselves. This makes continuous improvement a reactive process triggered by the presence of problems, non-conformance, or other issues. Risk-based continuous improvement is a proactive process that helps you anticipate, plan, and act to make certain that outcomes are advanced in the presence of uncertainty. The focus is on anticipating problems before they become a reality and is triggered not by the presence of issues but by the presence of uncertainty. Problem solving skills and capabilities used with traditional PDCA processes, for example root cause analysis, can also be used with risk-based continuous improvement. However, what makes the process proactive is the identification and assessment of uncertainty (the root cause of risk) along with the implementation of effective risk controls which are essential. It is the effectiveness of these processes that determine how well problems are prevented and opportunities are realized. It is with these that continuous improvement is most needed. Risk-based continuous improvement proactively contends with uncertainty and its effects on goal-directed endeavors. It is triggered not by the presence of a problem but by the presence of uncertainty. It is applied to each process affected by uncertainty along with the processes that anticipate, assess, and treat risk (i.e. risk controls) to improve their effectiveness.

The answer is yes and you have been for some time. Nudging is broadly used today in many domains including governments to addresses policy effectiveness and regulatory gaps, private companies to make employees more ethical, and in compliance to change safety, quality, and environmental cultures. Nudging can be effective and justified to get us to do what is good for us such as investing more for our retirement. Nudging can also be used to exploit our behavioral biases to achieve outcomes that we do not need or want. The use of nudging in compliance has ethical implications that need be to considered and addressed. Companies may not explicitly implement nudging yet still find themselves using technology that does which may not align with their own ethical values. Values of users are being replaced with the values of the nudge designers and this is a cause for concern. What is Nudging? Many people became aware of the theory of nudging when the book: "Nudges: Improving Decisions About Health, Wealth, and Happiness" by Richard Thaier and Cass Sunstein, was published in 2008. In their book, they define nudges as: "A nudge, as we will use the term, is any aspect of the choice architecture that alters people's behavior in a predictable way without forbidding any options or significantly changing their economic incentives." In essence, nudges use behavioral insights to influence behavior towards specific outcomes. Nudge theory has been applied in areas as diverse as: product placement, using opt-out versus opt-in strategies, and applying it to business management systems. We also see private companies introducing nudging aimed at making employees more ethical. More and more companies are considering the use of nudges as a proactive strategy to achieve compliance outcomes [8]. In Todd Haugh's paper on "Nudging Corporate Compliance" [5] he defines nudges in the compliance context: "Nudges are simple interventions designed to promote desirable choices— such as compliance choices—by taking advantage of psychology . . . [including] a growing list of mental shortcuts, cognitive biases, and psychological quirks that subconsciously influence, and often sabotage, our decisions. Nudges are designed to either harness or neutralize these tendencies, and help us make better decisions, by subtly altering the decision-making process or the mental context in which the decision is made" Neutralizing cognitive biases to make better decisions seems reasonable but harnessing these same biases to achieve a specific outcome has its problems. Critics of the use of nudging argue that they are short-term and do not help people make long-term behavior changes. However, while the effectiveness of nudging might be in question, there are other issues more pertinent to the ethics of using nudging in the first place. In the paper by David Colader and Andrew QI Lin Chong [7], they make the following argument: "Thaler and Sunstein implicitly assume that people would be better off with a choice architecture that encourages them to save more. By making this and similar assumptions, they are replacing their views for the consumer’s views. Our argument is that the explicit goal of nudge policy in this case should not be to encourage individuals to save more; rather it should be to give individuals the choice of whether they want a choice architecture that is more likely to encourage to save more. This is a subtle, but important, distinction that Thaler and Sunstein gloss over, and which underlies the difference between our non-paternalistic and their paternalistic nudge policy." The key point is that choice architectures inherently promote a set of values that may differ from those of the decision maker. This has critical implications when applied to making ethical decisions involving risk and uncertainty where it essential that the decision making process not diminish the autonomy or the accountability of the decision maker. It can be argued that too much "suggestion" may lead to holding the choice architects rather than the decision maker accountable which is not what we want or need. As a result, careful attention should be given to the use of choice architectures particularly those embedded in the technology (i.e. digital nudges) used to support and manage compliance. There are many ways in which choice architecture manifests itself in the digital environment. The most predominant is the use of defaults[1] as expressed through: check boxes, drop downs, auto complete, search results, default settings, timelines, call to actions All of these have defaults that are pre-selected. When you see these you are being nudged. For example, more people select the auto complete suggestion than what they were originally typing. What is suggested can and does nudge users towards a specific outcome. The most popular example regarding defaults is the impact of default choices on organ donations compliance rates. Countries where people where asked to opt-out of organ donation instead of opting-in reported significantly higher consent[9]: Steps to Address Nudging There are several aspects that companies should consider when considering the use of nudges, beginning with: Is the outcome what we want and need? Is the level of persuasion used in the nudge consistent with our ethical values? Is the autonomy and accountability of the decision maker preserved in the process? Nudges should by definition be easy to avoid [6] and no costlier than accepting the nudge itself. When the cost to avoid is higher, the nudge becomes a shove which is a form of coercion. Sunstein[6] posits the following distinctions for nudges with respect to ethical considerations: Paternalistic nudges – protect people from their own mistakes including behavioral biases Educational nudges – inform so that people can make better choices for themselves Nudges that enlist or exploit behavioral biases He further writes, "It follows that the most controversial nudges are paternalistic, non-educative, and designed to enlist or exploit behavioral biases." Nudging is a method of control within a spectrum between persuasion and coercion. The difference between persuasion and coercion hinges on whether or not you are free to decide if you need and want the outcome; and there in lies the rub. At what point does nudging become forced and in violation of a person's autonomy and accountability. Where you draw the line is a decision that companies need to make as part of their ethics policies. They should not let technology determine for them where this line is and even what the outcomes are. As companies continue to investigate the incorporation of nudging in their compliance programs it is incumbent on them to establish ethical policies and guidelines to govern their use. Ethical companies should at a minimum: 1. Develop a plan for how they will address the use of nudging within their compliance programs 2. Decide what is ethical and what is not (don't let the technology choose this for you). 3. Evaluate how nudges are used in existing and new technology: Where are they used? What outcomes are being influenced? Can the outcome and the level of persuasion be changed to better align with compliance obligations and core values. 4. Require that if and when nudges are used they are consistent with ethics policies and guidelines. Further reading: Digital Nudges, Fabio Pereira, Presentation at GOTO Conference, https://gotober.com/2017/sessions/303 The Persuasive Power of the Digital Nudge, Julia Fetherston, https://www.bcg.com/en-ca/publications/2017/people-organization-operations-persuasive-power-digital-nudge.aspx Digital Nudging – Guiding Judgement and Decision-Making in Digital Choice Environments, Markus Weinmann, https://link.springer.com/article/10.1007/s12599-016-0453-1 Digital Nudging: Altering User Behavior in Digital Environments, Tobias Mirsch, Chistiane Lehrer, Reinhard Junk, https://link.springer.com/article/10.1007/s12599-016-0453-1 Nudging Corporate Compliance, Todd Haugh, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3004074 The Ethics of Nudging, Cass Sunstein, http://digitalcommons.law.yale.edu/cgi/viewcontent.cgi?article=1415&context=yjreg The Choice Architecture of Choice Architecture: Toward a Non-paternalistic Nudge Policy, David Colander and Andrew Qi Chong, http://sandcat.middlebury.edu/econ/repec/mdl/ancoec/1036.pdf Cast no shadow, Dr Tim Marsh, http://www.rydermarsh.co.uk/pdfs/SHP.0112.pdf Nudge Database v1.2, Mark Egan, https://www.stir.ac.uk/media/schools/management/documents/economics/Nudge%20Database%201.2.pdf

When it comes to selecting commercial-off-the-shelf (COTS) compliance software there was a time when this involved a structured process based on a requirements-first approach. This has now been largely replaced with a demo-first approach encouraged by cloud vendors as well as by the buyers themselves. Instead of a bake-off compared against requirements, software is now chosen based on how well the software demos and looks. Does this approach result in better outcomes? Let's find out. Requirements-first Approach: A requirements-first approach typically includes the following steps: Request for Information (RFI) – survey of the market to identify candidate vendors and solutions Request for Proposal (RFP) – request for written responses to requirements from identified long list of candidate vendors. Short Listing – a short list is created based on the selection criteria rubric Request for Quotation (RFQ) – obtain firm and final pricing from the short listed vendors Live Test Demonstration (LTD) – make sure the short list of vendors actually meet the stated requirements by following a scripted walk-through. Select Apparent Winning Offeror – selection of the best alternative based on vendor performance, fit for purpose, and technical requirements. Pilot System - validation that the solution can achieve the intended outcomes as well as the verified technical requirements. The purpose of following these steps is to manage risk inherent in selecting a solution that best fits the scope, budget, and requirements. In addition, it also creates level of playing field, keeping everyone honest on both sides of the table. The following data is a compilation across 20 projects that followed a requirements-first approach: * Waterfall = Gated, Structured Approach * Hybrid = Gated, Agile Approach Key lessons learned from these projects include: System scope was the major influence in determining overall procurement cycle time. However, there is only an incremental increase (8 versus 12 months) when considering departmental versus platform solutions. The overall duration was largely determined by vendor and buyer schedules Waterfall approach using approval gates was preferred the larger the project scope In addition, 90% of projects did not purchase their first choice for reasons that included: Failed live test data (LTD) – RFP responses was good but based on software that was not yet available or didn't withstand scrutiny of actual use. Failed pilot system due to poorly understood or specified requirements Requirements changed during the procurement process It is worthwhile stating that each project completed successfully even though it was not with the first choice of vendor. Having a second choice proved to be a significant factor when mitigating the uncertainties experienced during the procurement process. Demo-first Approach: These days it seems that many companies jump right to requesting a demonstration of software without first understanding what it is that they need. While this may prove successful for some applications, when it comes to critical compliance solutions at the scale of the enterprise this can lead to decisions that are less than optimal and waste valuable time, resources, and possibly exposing companies to unnecessary risk. Companies who have used the demo-first approach have noted that these projects tend to produce the following: Scope creep – everyone wants all the capabilities that they see demonstrated Difficulty in making an apples to apples comparison of the alternatives Cost overruns due to unplanned integration, customization, and data migration Schedule overruns leading to late ROI and in many cases unrealized benefits Solutions that only meets rudimentary requirements and not capable of meeting the full demands of the organization Loss of data and information due to insufficient planning and resourcing for data cleansing and migration activities In addition, projects still end up taking the same amount of time to procure a solution as with a requirements-first approach. Although, in the case of a demo-first approach they tend not to follow a risk-based process. This makes them vulnerable to uncertainties that an RFP, LTD, and Pilot steps would have discovered. Companies have also noticed an increased tendency to choose software that may have: demoed the best, had the most capabilities, had the lowest initial cost, or the one that was used at the last company that someone worked at. In other words, without a set of requirements there was no basis on which to make an effective comparison based on actual and anticipated need. It would be reasonable to ask why companies would choose a less rigorous process for selecting compliance solutions. Here are some of the reasons given: Our current system doesn't work and we need something else but we don't know what that looks like I don't know what I need so looking at software helps me figure that out All I want is something that is user friendly. I expect the vendor to know what my requirements are. This is off-the-shelf-software so why do I need to write down any requirements. Don't they all do the same thing. I am just looking to replace what I currently have so those are my requirements We are looking at cloud-based software and the subscription costs don't warrant a large project Our business analysts used to do that but we don't have those roles anymore I don't have the time to go through a structured process. We are following an agile approach which means we don't need to figure out what are requirements are right now Even if it the software doesn't work we can replace it easily because its all in the cloud As more organizations move their systems over to the cloud it is expected that the use of a demo-first approach will increase. Of course each company will have different levels of success, however, the probability of success can still be improved by effectively managing uncertainties specifically with respect to scope. Risk-Based Approach: Acquiring software to support critical compliance processes still requires that risks be properly addressed. The most significant source of risk hasn't changed and is still scope creep or scope gallop as it often the case. Managing scope is essential to every project and this applies to choosing compliance software. Software demonstrations can be an effective way to learn about what is available in the marketplace. This in many ways has replaced the use of RFIs. However, demos do not replace the need to specify what the software needs to do or the need to manage risk. Requirements may not be as detailed as they once were and may take the form such as user stories. At the same time, they still must be sufficient to cover what the software contractually needs to deliver and how it needs to perform in order to achieved the desired outcomes. It is always good to remember that you are not the product the software is. In addition, as previously noted, it is a good strategy to always have a second choice because your first choice is likely not the one that will achieve the desired outcomes. Whether you follow a demo-first or requirements-first approach or not you still need to get answers to the same set of questions. The timing of when you get these answers will significantly influence the success of your project. If you wait until after you purchase the software you will need to deal with the effects of not knowing or what is called, "epistemic uncertainty." The risk of not knowing can and often leads to failed projects that in many cases doubles the cost since the project has to be done over again. Here is list of items that some companies chose not to know in advance: The importance of integration with other systems and consequently neglected during the procurement phase The value associated with legacy data leading to no budget for data migration The loss of control over how processes are implemented resulting in the using vendor generic workflows The impact of using generic approaches that were sub-standard to the company's higher standards The lack of understanding of how an on-demand pricing model would be affected by a fixed operating budget The lack of understanding of how the software is going to be transitioned and rolled-out All of these could have been known in advance and addressed using a requirement-first, risk-based approach. Here is a list of things that you should know when selecting compliance technology: 1. What defines success? What are the intended outcomes for the system? What defines what done looks like? How do you measure progress towards done? What steps are critical to achieving done? What risks need to be addressed that hinder achieving done? What opportunities should be pursued to increase the likelihood of getting to done? 2. What is the purpose for the software purchase? Technology replacement? Architecture alignment? Process improvement? Improved compliance? New capabilities? Increase or decrease in scale or complexity? Cost reduction? Introduction of best practice?. Point solution or platform to support multiple solutions.? 3. What are all the requirements for the expected use of the software? System, application, process, and other functional requirements? Compliance, security, data, privacy, and sovereignty requirements? Platform, network, communication, and other technical requirements? Performance, and reliability requirements? Customization, and integration requirements? Implementation, sustaining, and end-of-life requirements? Backup and recovery requirements? 4. What strategies will be used to introduce and sustain the use of the software? Lift and Shift - Improve processes first then shift? Shift and Lift - Shift to the new software first and then improve processes? All users at once or a phased roll-out? All modules at once or a phased roll-out? Distributed or centralized support? Business owners or IT support? 4. What are the impacts and risks associated with the choice in software, implementation strategies, and sustaining activities on the business What gaps in requirements need to be addressed by customization, work-around, or additional software? What is the total cost and budget needed to sustain and use this software over its anticipated lifetime? How is compliance maintained during and after the implementation? How will changes to the software or configurations be managed and validated? What actions are needed to address uncertainty in: capabilities, cost, user acceptance. ability to meet compliance obligations, and so on? Who owns the data and will the data be monetized by the vendor? How and when will breaches in service be communicated? What is your exit strategy and when will this be triggered should you need to revert to your second choice?

Back in the day I would visit bookstores in the places that I travelled particularly for work. Browsing the book isles was one way you could get a sense for what the current trends were and which way the wind was blowing. This for me was a from of sense-making. Trying to determine what is relevant in a sea of constant change. You could say that going to the Gemba for me was going to the bookstore. Today, you can do the same thing by using Google’s N’grams based on google books. And here is what you would find: Quality peaked in 1992 and is now in decline (around the time that ISO 9001 was introduced and the quality movement was at its peak). Risk as a general topic continues to grow and dominates the discussion across all risk & compliance domains. Safety, Security, and Fraud have peaked and on the decline since 2000. Perhaps as a result of Y2K no longer being an issue. Regulation is near the bottom and declining. Cyber, Sustainability, Climate, are on the uptick but still way behind the others. What could this all mean? Less books are being written on the various topics. Traditional risk and compliance theory and practice have stalled i.e. nothing new is being added to the discussion. New compliance concerns are starting to take over. Compliance is a zero-sum game i.e. focus on something new takes away from existing resources. If the last one turns out to be true, then it is likely we will see organizations reallocate existing resources to tackle new areas of risk. To meet the new demand without sacrificing existing risk & compliance performance organizations must find ways to leverage existing capabilities. This will include one or more of the following: Apply LEAN principles and practices to reduce waste. Apply Risk Management principles and practices to focus on what really matters. Take a Holistic view of systems and processes to ensure the parts all work together to realize compliance outcomes. Embed compliance into processes to ensure the organization always stays between the lines. Leverage common principles and practices across all risk & compliance programs. Apply Proactive and Preventive strategies to stay ahead of risk

When we consider compliance we often think of being compelled by regulation to follow an arbitrary set of rules that get in the way of achieving business outcomes. No wonder many companies only want to do the minimum. However, a more useful way of looking at compliance is as a game that we want to play and one that want to be good at. As with all games they have rules. These rules do not inhibit playing the game they instead make it possible to play the game not just once but many times. That is what we want for our businesses. We want to act in such a way that we can continue to play the game over time for as long as we want to play. This requires a long-term perspective. However, some prefer a short-term view and take short cuts, cheat, or otherwise hack the game. When they do this they find that no one wants to play with them anymore. Customers do not want to buy from them, suppliers do not want to sell to them and stakeholders do not want to invest in them either. They have ended the game for themselves and as a consequence ended their business or at least severely damaged it. Don’t sacrifice your business by choosing actions that take you out of the game. Instead, learn how to become competent at playing the game well.

In the words of W. Edwards Deming, “You cannot inspect quality into a product.” And yet, audits remain the primary mechanism to protect stakeholders from the effects of uncertainty. As Deming has rightly stated, inspecting what has already happened is too slow and too late to ensure risk does not become a reality. When it does, trust can be easily lost with those who have put their trust in your business, products, or services. Quality, safety, environmental, regulatory, and other compliance programs help to rebuild trust by reducing the risks associated with meeting the promises made to each stakeholder. However, most organizations view compliance as a necessary evil and something to avoid, let alone something to invest in. As a result, compliance remains mostly a world of disparate silos, competing cultures, inefficient processes, and excessive audits. Together with a narrow focus on prescriptive compliance to “shall statements” the opportunity now exists for threats to penetrate an organization’s defences in-between the checklists, procedures, and policies . Stakeholders now face the possibility of risk that is systemic, mostly undetected, and potentially disruptive. Looking for and filling every gap in meeting prescriptive obligations misses the gaps that are really important – the holes in the system . It is only by anticipating, planning, and acting that prevents risks from becoming a reality. This requires a proactive and intentional approach to compliance that focuses on outcomes, capabilities, and continuous improvement which are the hallmarks of an effective compliance system.

Over the last several decades companies have invested in paper-on-glass solutions as part of their digital progression. However, what only a few companies have done is change their processes to exploit the power of their digital technology. Dr. Goldratt, developer of the Theory of Constraints, speaks to this issue directly: "Technology can bring benefit if, and only if, it diminishes a limitation. Long before the availability of technology, we developed modes of behavior (policies, measurements and rules) to help us accommodate our limitations. But what benefits will any technology bring if we neglect to change the rules?" To achieve the benefits from technology, Dr. Goldratt suggests answering the following questions: What is the power of the technology? What limitation does the technology diminish? What rules enabled us to manage this limitation? What new rules will we need? The answer to the last question is most critical. To increase your return on investment from digital transformation you must change the way you currently do things. To do otherwise will: Limit your benefits to efficiency at the expense of improving effectiveness. As an example, converting paper forms to electronic forms and routing them around electronically may improve overall process time but will not achieve the benefits available using the power of the new technology. One of the limitations that paper-based systems had was its inability to use data to adapt the process to contend with risk. This often manifested itself in having complicated processes to accommodate every situation along with the need to incorporate multiple layers of approvals. However, using digital technology, it is possible to adapt work processes and incorporate the appropriate level of approvals based on collected information to contend with different levels of risk. By removing the limitation of static workflows companies can benefit from using adaptive work processes resulting in even greater efficiency but also increased effectiveness at contending with uncertainty.

It is easy to be sympathetic with those developing digital technologies that are frustrated with the relatively slow adoption of digital transformation. By analogy, the internet has significantly changed the way we think and operate our businesses along with our own personal lives. The internet continues to this day to be the foundation for new and exciting possibilities, including further digital transformation. It is no wonder that many are anxious to quickly move ahead and wonder why companies are only taking incremental steps. One of the reasons for this is that companies are inherently resistant to change. This is partly due to the resiliency needed to continually create products and services their customers enjoy. This resilience manifests itself in many ways that include: processes that produce consistent output, management systems that ensure quality, programs that drive down risk to keep employees and the environment safe, and competent workers that are trained to use the latest standards and best practices. Often these are developed over years and become part of the company culture. These "structures" contribute to reliably make the products and services we depend on every day. Most of us don't think twice when we turn the light switch and discover that the light in the room actually turns on and that it does this almost every time. This "resistance to change" comes in sharp contrast to the disruptive posture often used to promote digital transformation. There is often an appeal to evolution that argues that change is inevitable and therefore companies should adopt digital transformation or be left behind as did the proverbial dodo bird. This is understandable, but perhaps misguided, if only for the reason that we know that evolutionary change (in the Darwinian sense) results from chance not by design or intent. Asking companies to change, however, does require intent and that demands an appeal of a different sort. Companies need a reason to change and for that they need at least an answer to the question, "how will digital transformation help my company achieve its goals?" The promise of digital transformation Before we can consider possible answers to this question, we first need to understand what digital transformation is. At a very high level it can be framed in the following way: Digitization – the transformation of analog information into digital form Digitalization – is the process of the technological-induced change brought about by digitization (ex. Internet of Things, blockchain, cryptocurrencies, Industry 4.0, etc.) Digital Transformation – the total and overall societal effect of digitalization The impact of digital transformation is often presented in terms of improved productivity. However, after you consider the cost of undergoing a transformation, it is not clear that productivity improvements, particularity incremental ones, are enough. Companies already have significant investments in technologies that remain mostly unexploited that could be used to improve productivity. Why this doesn't happen is a topic that will be discussed later in this blog. However, the primary motivation for pursuing digital transformation is not really about improved productivity, although that may happen. It is instead more about creating new ways of doing things that result in different processes altogether. Transformations of this kind are less certain in terms of what they might be, and the nature and extent of the impacts. We only need to look at companies like: Facebook, Twitter, Google, Amazon, Uber, as well as others to get an appreciation for this. Predicting with any measure of certainty that that these specific companies would emerge along with their specific impacts is something best left to speculation. What should companies do? So what do you do if you are a company that is involved in producing, let's say, physical things rather than purely digital products and services, for example, an oil producer. CEOs for these kinds of companies are correct to question how digital transformation can help them at all. Companies have many other concerns that need to addressed such as: increasing costs, threats resulting from cyber-attacks, increased regulations, and keeping their employees, communities, and the environment safe, to name only a few. Many CEOs may read about the "Internet of Things" and wonder how this might help their company. They already have sensors and control systems that monitor operations and collect lots of data all on their own secure networks. Perhaps, data could be made more useful by organizing it better. However, the thought of connecting all your sensors to the internet seems like it would add more risk rather than reduce it. Consideration of other digital technologies such as: block-chain, cryptocurrencies, machine to machine communications and others may also leave companies wondering how these would help: maintain adequate margins, keep people and the environment safe, or generally reduce the level of risk in operating their business. It is hard not to conclude that digital transformation might just be a set of technologies looking for a problem to solve, and these problems are not your problems. This is how it it was when such things as: personal computers, the internet, and cell phones, where first introduced. We knew that change was coming but it was not clear exactly what that change would be. The best you could hope for is that when the time came you would have the time necessary to adapt. How to get ready? A good question that companies might ask themselves is, "what capabilities do I need to have so that I am ready to make the change when the time came?" It may not be possible to know what specific skills you will need. However, it is possible to develop the skills and culture to adapt to changes more quickly and in a safe manner so as to increase the certainty that you will have the time you need to adapt to a new way of doing things. One might even argue that those that are already doing continuous improvement are in a stronger position to adapt to digital transformation or any other changes for that matter. These companies already have a culture that accepts change more easily and that might be the most important thing. Another capability worth considering is the ability to understand how to transform business processes to new ways of doing work. This is a skill that in many ways reached its pinnacle following the first introduction of computing. During that time we learned all about business modeling, re-engineering, and the like. This was when the role of the business analyst was essential to transforming business processes to adapt to MRP and later ERP, CRM, CMMS, and other enterprise management systems. You were a business analyst because you new the business and you understood technology and that combination is rare today. In fact, with the continued outsourcing of IT, this role has been eliminated in many companies. A jobs-to-be-done example I recently spoke with a company looking for a solution to a problem they were having with generating calibration protocols for customized laboratory equipment to be used by field technicians. This problem involved integration with existing data and documentation. This was a jobs-to-be-done (JTBD) example in an enterprise context and clearly a candidate for digital transformation. However, no one in their company understood the business or the problem well enough to form adequate requirements and evaluate possible solutions. In fact, the only person who best understood how to go forward was the director of marketing who was given the task because the source of the problem was a customer complaint. This was compounded by the lack of expertise, they discovered in the marketplace, to build enterprise solutions and who understood their business processes. This was in a part of the United States that has the most high-tech companies than any other, probably in the world. However, most of them, while skilled in the latest agile, programming languages, and cloud-based architectures where heads-down trying to become the next digital technology unicorn ($1Billion valuation) and had little interest in enterprise JTBD problems using technologies they consider to be old and obsolete. This is not a unique situation, although, it hard to know how wide-spread this issue is. However, it does appear that digital transformation is not really directed to help existing companies and is more about developing the next Facebook or Uber. Preventative measures Many companies have significant challenges and problems that need to addressed. They also have (for the most part) substantial untapped capabilities buried in their existing enterprise platforms that remain to be exploited. These may not be "emerging technologies" but they are definitely not obsolete either. The argument that companies need to tear down existing technologies and infrastructures in favor of the promise of something new and shiny should be considered cautiously. Change no matter how beneficial the outcome comes at a cost that needs to be accounted for. The diminishing of capabilities primarily in business analyst roles may have come at the expense of excessive cost reduction strategies brought about by the aggressive outsourcing of IT along with re-platforming to the cloud. It may be time for companies to bring back the role of the business analyst to help transform business processes to tackle the jobs-to-be-done right now and to help transform business processes when digital transformation strategies are more mature. Combining the role of business analyst with a continuous improvement culture is a powerful combination to prepare for change, planned or disruptive.