By Mitch HoppenworthMany businesses operate in environments where regulatory changes occur frequently. Despite the burden created by the volume and pace of changes, they need to keep on top of the shifting legal landscape and have knowledge of relevant requirements.
Failure to stay abreast of changes can lead to negative business consequences such as enforcement actions by regulators and private lawsuits. Either possibility will likely be decided by settlement or judicial decision.
Complicating organizations’ efforts to stay current is the fact that requirement changes come from different sources, including legislative bodies, executive agencies, and judicial opinions. Companies must regularly monitor multiple venues, each of which can exist at the international, national, state, and local levels. The stakes of staying informed are high and keeping abreast of the ever-changing regulatory environment can seem overwhelming.
Requirements of an Effective Process
Regulatory mapping, also known as regulatory change management, is how organizations identify the laws, regulations, and requirements that apply to their business and industry sector, and how they monitor changes in those requirements.
In the U.S., in particular, effective regulatory mapping includes surveying and discussing the varying approaches taken by states to the same or similar regulatory issues. Regulatory mapping is also important for businesses wanting to expand into additional jurisdictions so that they can understand requirements before expanding.
To avoid negative consequences, businesses must be aware of new and existing requirements and understand if and how the rules and subsequent changes affect their policies, procedures, and internal controls. Organizations can reduce risk of an enforcement action or a private lawsuit by being aware of the effect of changes and implementing processes to meet them.
However, regulatory mapping can only protect a business if it is designed and executed well.
Effective regulatory mapping systems are not static. They must be able to identify changes that affect or may affect an organization’s compliance obligations. This can be done in a variety of ways, such as becoming a member of a trade association that provides updates, subscribing to a legislative alert service, getting free alerts from government agencies, law firms or other third parties, or hiring outside counsel or consultants to monitor changes.
The system must also be able to analyze changes to determine their applicability and scope. Inside or outside legal or compliance staff or third-party consultancies can provide these services. In some instances, analyzing changes could include a forward-looking function that makes predictions about future changes.
Effective mapping also requires implementing processes to satisfy obligations. Implementation should include not only what change must be undertaken, but also who will make the change and how, and the deadline for accomplishing the change.
Lastly, regulatory changes, as well as actions undertaken should be documented by updating policies, procedures, and other affected areas. Consideration should be given to documenting the reasons for the changes with regulatory analysis supporting why certain steps were taken.
How to Achieve an Effective Process
As recently as a decade ago, businesses could meet their obligations by monitoring regulators’ websites and reaching out to in-house or outside lawyers if a new rule seemed complex. This is no longer true. Today, the volume and frequency of changes require significantly more effort.
Meeting the challenge of remaining informed and addressing regulatory change often means businesses should consider implementing regulatory mapping processes that combine subject matter expertise with technological capabilities.
While it may be possible to craft such a solution in-house, it can be resource-intensive. An alternative can be found in third-party services that provide subject matter experts and use technology to monitor multiple sources for up-to-date notification and analysis customized to an organization’s needs.
Such services may even use state-of-the-art technology solutions that enable delivery of changing information to the organization, while allowing direct mapping to the established policies, procedures, and controls for the client organization. In short, the right combination of expertise and technology can ensure changing information reaches the right people at the right time, thereby enabling an organization to be accurate and nimble in meeting new challenges in the most cost-effective way possible.