| ARTICLES | September 2006 |
Compliance and Risk Management
A Big Challenge for Small Business
IT has been particularly interesting to watch the dramatic changes in the market over the last couple of years and the motivation of organisations to archive digital records. In the past, those organisations that put in place long-term data archive strategies did so for their own internal benefit. Either historic data was a critical part of their business process like insurance records and medical images or there was a cultural mandate to retain information in the case of government and public records. While these motivations still exist, an increasing number of organisations are being forced to put an archive strategy in place to comply with industry regulations and to manage their exposure to litigation. These issues are no longer the sole concern of large organisations; they are having a major impact on SMEs across virtually all industries.
The SME Challenge
In this article, we discuss how the new priorities are changing business operations and in many ways small business is bearing the brunt of this new landscape. Larger organisations had always had a significant reporting burden and have carefully managed their risk exposure. Taking on new industry regulations that require specific records be carefully retained for extended periods of time is no small task, but the fundamental infrastructure exists. They have lawyers to advise them on risk, specialists on process management and IT experts to implement new technology.
By contrast, SMEs do not have any of this infrastructure in place, but are expected to respond to new regulations in an equally professional way. This lack of infrastructure means that the new regulatory obligations will have a disproportionately large impact on the overall operation of a small business. Where a larger organisation might put together a task force to research the issues and report back with recommendations, many SMEs simply do not know where to begin.
A Good Offence
Faced with this rather daunting task, it is understandable why some SMEs have chosen to ignore the problem since they feel there is no credible way of properly addressing the issues at hand. This does not have to be the case. In fact, an argument can be made that if approached in a pragmatic way, these new regulatory requirements can be used to drive improvements in business process, protect their investment in information assets and even create new business opportunities.
Complying with regulations will never be an exact science. They can be interpreted in different ways and you can never be certain of addressing all of the obligations. In this circumstance, the best defence is a good offence. Compliance cannot be achieved by buying a single piece of hardware or software. Technology plays an important part, but compliance is a way of doing business. SMEs need to design an archive strategy that addresses specific data retention requirements while tipping the legal scale in their favour. In litigation terms this is often referred to as evidential weight. All aspects of the archive environment should contribute to the overall integrity and authenticity of the data. Protecting the SME from both the letter and intent of the law.
Be Selfish
Given the limited resources, SMEs should be very selfish in the way that they implement an archive strategy. They must be certain that all aspects of the strategy provide direct benefits to their business and does not just address an esoteric regulatory detail. For example when choosing an archival storage technology it should meet their compliance obligations, but should not impose unjustified financial and administration burdens. This philosophy should carry through all aspects of the regulatory challenge, which includes process, software and hardware.
Find the Opportunity
Rather than viewing these regulatory requirements as a burden, SMEs should consider how the availability of information could benefit the business. A number of SMEs use newly implemented data archives to save resource and offer additional services to their customers. A structured archive strategy enables the online availability of archive records, allowing SMEs to save many man-hours searching for older records so they can quickly repurpose information for new projects and services.
Regulatory compliance and risk management is a major new burden for SMEs. The big question is how they respond. It is a complex issue that each business will have to deal with on its own terms. The important thing is not to view compliance and risk management in isolation. Instead, it must be seen as an integral part of the overall business process. Since compliance isn’t something that can be ignored, those SMEs that view it as an opportunity to improve the way they do business will put the limited resources to good use and, in the process, will realise a major competitive advantage.
Plasmon plc. www.plasmon.com
