Compliance Building

Data breach Sharing Framework

With the Massachusetts Data Privacy Law now in place (and presumably you are in compliance with it), you need to think about what to do if you have an incident.

Verizon has published the Verizon Incident Sharing Framework to help.

Our goal for our customers, friends, and anyone responsible for incident response, is to be able to create data sets that can be used and compared because of their commonality. Together, we can work to eliminate both equivocality and uncertainty, and help defend the organizations we serve.

The framework is set up to help classify incidents, their discovery, mitigation and impact.

Sources:

Verizon Incident Sharing Framework
Verizon Incident Metrics Framework Released on the Verizon Business Security Blog

Data Breaches and Knowledge Management

One of the features of the new Massachusetts Data Privacy Law is that it forces some knowledge management on companies in the context of data breaches.

Since the law required compliance on or before March 1, 2010, I assume you already have the policy and safeguards in place. That is, if you have social security numbers or financial account information for any Massachusetts resident in your computer systems or files. Yes, the reaches beyond the borders of Massachusetts and is not limited to Massachusetts companies.

201 CMR 17.03(h) and (i) require regular monitoring of your program and a periodic review of its scope.

201 CMR 17.03(j) goes on to require that you document any responsive actions, have a post-incident review and document any changes to your program after the review. That sounds a lot like knowledge management to me.

The Office of Consumer Affairs and Regulation has published a handy 201 CMR 17.00 Compliance Checklist (.pdf). You should also review and be familiar with the law itself contained in 201 CMR 17.00 Standards for the Protection of Personal Information (.pdf).

Image is by Darwinek in Wikimedia Commons: Flag Map of Massachusetts

Today is the Deadline for the Massachusetts Data Privacy Law

March 1 is the compliance deadline for the Massachusetts Data Privacy Law. 201 CMR 17.00 requires you to be in full compliance on or before ~~January 1, 2009~~ ~~January 1, 2010~~ March 1, 2010.

If your company receives, stores, maintains, processes or otherwise has access to “personal information” acquired in connection with employment or with the provision of goods or services to a Massachusetts resident you are subject to the requirements of 201 CMR 17.00.

If you have employees or customers in the Commonwealth of Massachusetts, then you are subject to this law. The law is not restricted to companies located in Massachusetts. But if you are located in Massachusetts then you have Massachusetts employees and their personal information, making you subject to the requirements of the law.

The law is a bit watered down since its initial form, but you still need to pay attention to it. There are some reasonableness standards in the requirements that make it easier to comply. You still need a policy, need to inventory your stores of “personal information” and educate your employees about the importance of safeguarding personal information.

The Office of Consumer Affairs and Regulation has published a handy 201 CMR 17.00 Compliance Checklist (.pdf).

You should also review and be familiar with the law itself contained in 201 CMR 17.00 Standards for the Protection of Personal Information (.pdf).

Since today is March 1, you still have a few hours to get things in place to be compliant with the law. If you haven’t done taken the proper steps, stop reading and go do it.

Previous Posts:

Compliance Bits and Pieces for February 26

Here are some interesting compliance related stories from the past week:

List of Troubled Banks at 16-Year Peak, F.D.I.C. Says by Eric Dash in the New York Times

After weathering the nation’s worst run of bank failures in nearly two decades, the Federal Deposit Insurance Corporation announced Tuesday that it had added 450 institutions to its list of challenged lenders in 2009 and warned that the industry was likely to remain under stress.

Rakoff Backs BofA Accord, Unhappily By DAN FITZPATRICK, KARA SCANNELL And CHAD BRAY in the Wall Street Journal

A federal judge harshly criticized but approved a $150 million settlement Monday between Bank of America Corp. and the Securities & Exchange Commission, resolving claims the bank should have disclosed billions in losses at Merrill Lynch & Co. before it was acquired by the bank. U.S. District Judge Jed S. Rakoff said the fine was “paltry” when considering the Merrill merger “could have been a bank-destroying disaster if the U.S. taxpayer had not saved the day.”

SEC Announces Efforts to Educate Investors About Participating in Corporate Elections – SEC Press Release

The series of measures include amending the SEC’s e-proxy rules, issuing an Investor Alert, and creating new Internet resources that explain the proxy voting process in plain language.

Supreme Court Sets Oral Argument in Quon v. Arch Wireless for April 19, 2010 in the Hunton & Williams Privacy & Information Security Law Blog

The U.S. Supreme Court has set oral argument for April 19, 2010, to review the Ninth Circuit’s 2008 decision on employee privacy in Quon v. Arch Wireless Operating Co. Although Quon concerns the scope of privacy rights afforded to public employees under the Fourth Amendment, the case also has forced private employers to renew their focus on ensuring robust and consistent enforcement of employee monitoring policies. Unlike government employers, private employers are not subject to the Fourth Amendment’s prohibition against unreasonable searches and seizures; instead, they must comply with federal wiretap statutes and state law.

The All-In-One FCPA Enforcement List from the FCPA Blog

This is really it. A snapshot of (we think) all FCPA-related ongoing prosecutions, pending sentencings, extraditions, at-large fugitives, and appeals.

How To Write a Code of Ethics by Josh Spiro in Inc.

A code of ethics can help a business determine its priorities and values. It can also help you down the line if one of your employees or vendors drags you into legal trouble.

Another Charge in Madoff Fraud

The SEC has charged Daniel Bonventre, Madoff’s Director of Operations, with securities fraud.

“According to the SEC’s complaint, Bonventre was responsible for the firm’s general ledger and financial statements that were materially misstated because they did not reflect the manner in which investor funds were maintained and used. Bonventure ensured that BMIS financial reports did not reflect the firm’s massive liabilities to investors or the corresponding assets received from investors. To hide the fact that BMIS normally operated at a significant loss, the firm used more than $750 million in investor funds to artificially improve reported revenue and income.

The SEC alleges that Bonventre also helped Madoff, his lieutenant Frank DiPascali, Jr., and others orchestrate lies to investors and regulators when investment advisory operations at BMIS came under review. With Bonventre’s assistance, they made serial misrepresentations to external reviewers by manufacturing reams of false reports and data.”

…

This is the SEC’s seventh enforcement action in the Madoff fraud since the scheme collapsed in December 2008. The Commission previously charged Madoff and BMIS, DiPascali, and auditors David G. Friehling and Friehling & Horowitz CPAs, P.C., who have all pleaded guilty to criminal charges related to their conduct. The SEC also charged certain feeder funds with committing securities fraud, and charged two computer programmers at Madoff’s firm for their roles in covering up the scheme.

Sources:

SEC Press Release – SEC Charges Madoff’s Director of Operations with Falsifying Accounting Records and Siphoning Investor Funds

SEC Decides to Think Further About IFRS

The Securities and Exchange Commission voted to issue a statement that lays out its position regarding global accounting standards. They want to make it clear that “the Commission continues to believe that a single set of high-quality globally accepted accounting standards would benefit U.S investors.”

By 2011, the SEC will decide whether to incorporate IFRS into the U.S. financial reporting system, and if so, when and how. In trying to reach a decision, the SEC has published a Work Plan. It has six key areas:

Sufficient Development and Application of IFRS for the U.S. Domestic Reporting System
- Comprehensiveness
- Auditabilitity and Enforceability
- Consistent and High-Quality Application
The Independence of Standard Setting for the Benefit of Investors
Investor Understanding and Education Regarding IFRS
Examination of the U.S. Regulatory Environment that Would Be Affected by a Change in Accounting Standards
The Impact on Issuers, Both Large and Small, Including Changes to Accounting Systems, Changes to Contractual Arrangements, Corporate Governance Considerations, and Litigation Contingencies
Human Capital Readiness

Certainly it would be better to have a single universal accounting standard. But is IFRS better than GAAP, worse than GAAP, or just different?

Sources:

SEC Press Release – SEC Approves Statement on Global Accounting Standards
Commission Statement in Support of Convergence and Global Accounting Standards (.pdf) Release Nos. 33-9109; 34-61578

Keeping Your Colleagues Honest

Mary C. Gentile put together a great piece on how to challenge unethical behavior at work in the March issue of the Harvard Business Review: Keeping Your Colleagues Honest.

She starts with four rationalizations for staying silent when encountering an ethical problem:

It’s standard practice.
It’s not a big deal.
It’s not my responsibility.
I want to be loyal.

The meat of the article is about helping a manager to speak up when confronted with an ethical problem.

Treat the conflict as a business matter.
Recognize that this is part of your job.
Be Yourself.
Challenge the rationalizations.
Turn newbie status into an asset.
Expose faulty either/or thinking.
Make long-term risks more concrete.
Present an alternative.

I particularly liked her use of the rationalization argument.

“If people make the point that an issue is not your responsibility, you are in a strong position to press ahead—in using this rationalization, they have already conceded that the behavior is wrong, or at least questionable. They are not arguing with your assessment; they’re looking for a way to avoid the conversation.”

She also pulls out the New York Times technique on rationalization: “If it is expected , are we comfortable being public about it?” I usually amplify this to ask “Would you be comfortable with this being told in a story on the front page of the New York Times?”

The full article is behind the paywall at HBR.org.

Mary C. Gentile is a senior research scholar at Babson College in Wellesley, Massachusetts. Her book Giving Voice to Values is forthcoming from Yale University Press in September 2010.

SEC Commissioner is a Blog Commenter

So you write a blog post about the fiduciary duty of financial service providers to their clients. Actually, the real story is about the lack of fiduciary duty that brokers have to their customers. Then an SEC Commissioner chimes in.

Tara Siegel Bernard writes for New York Times blog, Bucks: Making the Most of Your Money. On February 16 her post was Will You Be My Fiduciary? Her proposal was to arm consumers with fiduciary rights, regardless of what the law says. Merely ask our provider to sign a fiduciary pledge so they have a contractual obligation to be a fiduciary.

Perhaps to her surprise, she got a comment from Elisse Walter, Commissioner, Securities and Exchange Commission:

This well-written, easy-to-understand proposal captures the way that all financial professionals should treat investors. It recognizes that all financial professionals should be subject to a fiduciary duty. And in a simple and straightforward way it articulates the scope of the duty and cuts through what has become non-productive debate on this issue.

This articulation allows us to move on to another critical issue: financial professionals are unfortunately subject to different obligations when they are performing virtually identical services for investors. For example, a person cannot start a brokerage firm unless she demonstrates to a securities regulator that she has the expertise and operational capacity to engage in the type of business she proposes to start. No equivalent process exists for investment advisers. And, the law requires an adviser to disclose to his client the full range of circumstances where their interests may conflict, while the law governing brokerage firms does not impose that blanket obligation.

These are only two examples of the obligations that should be harmonized. I’m ready to see us get on with that work.

According to a message I got from Mark Story, the SEC’s Director of New Media, it’s only the second time that a senior-level SEC official has commented in a public forum.

The first was when former SEC Chairman Christopher Cox commented on a blog post by Jonathan Schwartz: Sunlight on a Cloudy Day….

It looks like an SEC Commissioner posts a blog comment every three and half years. Plan ahead for 2013.

Actually, I’m surprised that the SEC Commissioners have commented at all. I recognize that high-level government officials have to be much more cautious about what they say in a public forum. They run into a similar problem with the dissemination of information that public companies have with Regulation FD. Surprisingly (or not), that just so happens to be the subject of that first SEC comment.

Wrap Up of the Global Ethics Summit 2010

Dow Jones and Ethisphere put on a great conference addressing ethics and compliance professionals. The Global Ethics Summit 2010 had a stellar line up of panels and presenters.

As with most conference’s it lacked power and wifi access. Fortunately, my company’s sturdy laptop battery and AT&T wireless access card allowed me to live blog from the sessions. Below are the blog posts that contain my notes from each session.

For pictures, DowJones has published some photos on Flickr: Global Ethics Summit 2010 Photos. There is also a stream of updates on Twitter from the conference: #GlobalEthics.

Since the posts were live from the sessions they are probably riddled with typos and grammatical errors. At least it’s better than my handwriting.

Compliance 2010 – What’s Next?
New challenges abound amid advancing best practices, not to mention the continually escalating rate of enforcement both by U.S. regulators and overseas officials. What’s on the horizon for compliance? This roundtable discussion comprised…Read more »

Working Toward a Healthier Organization: Pfizer’s Compliance Program
There are a number of challenges associated with maintaining integrity as a top priority in a highly competitive global business. But sometimes, despite company’s most earnest efforts to effectively implement compliance metrics and…Read more »

Tone at the Top: The Board’s Role
Understanding and supporting a prudent ethical and compliant tone throughout an organization is a core responsibility of the board of directors. Board actions are more transparent than ever to employees, investors, regulators, media…Read more »

Global Insights into the Anti-Corruption Landscape
Dow Jones Risk & Compliance presents the results of a recent survey of current anti-corruption regulation, emerging trends and the impact on corporations around the world.The speaker was Rupert de Ruig, Managing Director,…Read more »

Doing More with Less: Compliance During Tough Economic Times
Let’s face it: compliance is usually seen as a cost center. While there’s been some good and interesting research about the positive impact on the business of a good ethical culture and brand,…Read more »

Training a Diverse Workforce: Best Practices
Having a code of ethics is not enough to ensure compliance. Training is the vital step that brings these standards to life—effective training helps ensure that key tenets are retained and applied. While…Read more »

Don’t Be Evil: Imagination at Work with Google and GE’s Compliance Programs
General Electric and Google are two very different, yet equally substantial powerhouses with varying businesses to each company’s name. Ensuring compliance with U.S. and foreign regulations while maintaining Google and GE’s respective competitive edges…Read more »

Transparency – What, How Much and When?
How much should a company be disclosing to shareholders, investing communities, regulatory authorities and customers about its compliance program and other ethics-related activities? What risks does a company shoulder when it takes a…Read more »

When the Government Comes Knocking
What’s the best course of action when addressing a regulatory inquiry? Many have suggested that having a better than average compliance program to showcase will certainly help your case. But what are some…Read more »

Does Compliance Matter?
When trouble arises, one of the factors prosecutors consider during an investigation is the existence of a strong compliance program. Recently proposed amendments to the Federal Sentencing Guidelines would formally lower the sentencing…Read more »

Does Compliance Matter?

I am attending the Global Ethics Summit 2010, hosted by Dow Jones and Ethisphere. Here are my notes, live from this session:

When trouble arises, one of the factors prosecutors consider during an investigation is the existence of a strong compliance program. Recently proposed amendments to the Federal Sentencing Guidelines would formally lower the sentencing range for companies with certain compliance mechanisms in place. But is there enough incentive for companies expending resources, particularly in tough economic times, or will they just get in trouble anyways? And at a time when a company’s brand value is increasingly dependent on intangible assets such as reputation, what are the financial repercussions on compliance? Do companies with ethical reputations really outperform those not known for their good behavior?

Panel:

Joan Meyer, Partner, Baker & McKenzie LLP
Jeffrey Benjamin, Vice President & General Counsel, Novartis
Patricia Nazemetz, Chief Ethics Officer, Xerox
Charles Elson, Director, HealthSouth
Gregory S. Nixon, Senior Vice President, General Counsel, Corporate Secretary & Chief Compliance Officer, DynCorp International

Jeff noted the importance of a “Speak Up” culture at a company. You need employees to report problems up the chain. Leaders at all level can chill a “Speak Up” culture.

Since Greg’s company is a government contractor, they need to make the government happy or they lose their biggest customer.

Jeff thinks one of the key elements of an effective compliance program. Live training is by far the most effective. (He gives an “F” to the summit because there was not much interaction.) He makes sure that the trainees get lots of documentation and information before the training session. He makes sure that annual training is different each year.

Patricia sees alignment as a key you need to make sure the compliance program is aligned and in the context of the underlying business. Access is key so that people have an open door to ask questions. Analysis is key to make sure that you spot issues. Adjudication needs to be in place so that bad acts are punished. You need to think about how much disclosure you make internally and externally.

Charles emphasized the need for repetition is needed. You need to keep sending out the message. He also though compliance and legal departments should be looked at as profit centers, not cost centers.

Greg emphasized the need to have a way for people to come forward and for the company to know what to do when someone comes forward.

Charles compared the hotline to the moon mission. People complained that going to the moon was a waste of time and money. But there were tremendous collateral benefits from the moon mission. (Love that Tang and Velcro.) The same is true for the hotline. It can provide tremendous insight to the corporate operations even if nothing material as a compliance issues comes from the hotline.