Published: September 23 2008, 05:30 AM | no comments
by Sumner Blount

Many of the large companies that we at CA talk to about their risk and compliance activities have different approaches, with somewhat different challenges that they need to meet. Still, the one common element that virtually all of them have (at least to some degree) is the problem of "information silos."

The meaning of this description is fairly obvious "" pockets of information spread around the organization which contain either similar, or in some cases, identical data relating to compliance activities. And, of course, when the same information is stored in multiple places, the opportunity for inconsistency is persistent.

The reason why this is such a pernicious problem is that the existence of these silos is often invisible to the people who need to know where this information is kept. A simple (and common) example is that of a SOX program team that conducts a test of some Sox controls, some of which are failing to operate effectively. The SOX team can attempt to initiate a project to remediate their controls, but these controls also are used for PCI compliance, and that program team is not aware of these control failures. The result is higher risk for PCI compliance that is invisible to upper management.

This situation also results in significant duplicated work, and some controls get tested redundantly, simply because information about previous tests is spread out around the organization in multiple spreadsheets.

It also makes it very hard to identify the total costs of compliance, since cost information tends to be spread around the organization, but more importantly, not tracked on a formal basis across all these units. Most companies tend to be spending much more on compliance than they are aware, because these "hidden costs" don't get captured sufficiently to help measure their total compliance costs.

As with almost any problem of duplicated information, it only gets worse over time. New regulations mean that there is more controls testing going on, and probably more groups within the company that need to obtain and track this type of information.

So, what's the solution? Well"¦it's obvious"¦.a way of centralizing information about risk and compliance, and mapping (cross-referencing) it, so that everybody can always know the current status of all information objects (e.g., polcies, controls, risks, remediation efforts, etc) at any time. The challenge, though, is how to do this effectively and expeditiously. Simply finding where this information exists can be a significant challenge for a large organization. In addition, there are often major political challenges when attempting to centralize that information (and therefore remove it from local groups).

The bottom line is that information silos is probably the most common challenge in risk and compliance, but with sufficient planning (and political finesse), it can be solved.