AREM

GDPR is here however the journey has just started.

Many organisations are still struggling in their efforts to comply with the GDPR requirements.

Our advice to organisations is to keep the GDPR initiative or project running at least for the next 6 months with the focus on:

• automate the processes related to GDPR
• plan and execute self assessments and optimise processes
• execute ad-hoc deep reviews on the technical level to confirm proper recording, existence and relevance of the audit logs
• monitor the use guidelines, use cases and explanations from the regulator
• simplify where possible,
• modify and add where needed.

Privacy is one of the domains of information management that is causing a lot of headackes to any entity that is collecting, using or processing personal information. Recent events related to data breach at giants like Yahoo are demonstrating that even organizations with vast amount of resources have challenges remaining compliant.

EU is moving forward in implementation of EU requirement related to privacy that can expose an organization to penalty of up to 20M EUR or 4% of annual turnover.

The General Data Protection Regulation (GDPR)(Regulation (EU) 2016/679) 

Even simple actions like storing your client data on your phone can present a significant risk from compliance perspective if not managed propplerly.

How good are your privacy practices? We can help you via a diagnostic review that will discover the gaps. We can help you with the design and execution of the privacy compliance remediation. Please contact us.

Chief Information Officer is valuable commodity. Just recently we have received a few requests to help identify or “Head hunt” a suitable candidate.

After discussing with the clients we have learned that motives in these organisations were different.

One organisation and its CEO has a firm belief that their ERP system needs to be replaced and that the organization needs a new CIO to make that happen.

The other wants to have CIO that not only runs after the latest and greatest in IT but has also the sence for ROI, costs, strategy and internal controls in IT.

It seems like the CEOs of these organisations have realised that the future potential for value creation sits in the intangible resources of these organisations – key people and information technology.

The question remains what have their existing CIOs done wrong or what they did not do? How could a CIO ensure he/she is doing the right thing? How could a CIO be a true value creator for an organisation?

We are addressing challenge via our diagnostic reviews of your IT functions. We will be happy to assist. Please contact us.

Absolute compliance can have significant impact on business. Compliance with laws and external regulations is perhaps more important than internal compliance in domains with less impact on business performance.

Example: If you choose to park your car on your bosses parking space might be a challenge for you personally however in most cases such an act would have minimum impact on business performance of an organization observed. In this case you have made a decision to break the rule. Was the benefit of having a few minutes extra since your bosses parking lot is way closer to your desk than yours, bigger than risk your action exposed you to, remains unknown in this scenario. We don’t know your boss, we don’t know compliance tolerance levels and we don’t know the culture of your organization.

To be on a safe side perhaps taking a bus would be the right approach or getting there earlier.

Compliance with laws and regulations is a must. Some organisations are worried about their compliance because they are using business models or resources that are perhaps not regulated yet. 

Managing compliance risks may be complex especially in regulated industries such as financial, insurance and pharma. 

Diagnostic review of your compliance maturity level might help your organisation in identifying opportunities for achieving an optimal compliance level for your organisation.  Please get in touch!

While innovation is vital for sustainability, risk management will prevent surprises and help your organization to operate within acceptable risk apetite. It is very important to establish common understanding of what your risk appetite is between all key stakeholders. Organizations success can be distorted if it is not put in the context of the risk exposure.

Without innovation organizations may lose their ability to create value. Enterprise Risk Management should sense weaknesses also in innovation. Where is the solution remains specific for each organization. Talent management, intellectual property management, cybersecurity, business intelligence, counterintelligence, compliance, motivation and innovation culture are just a few areas where organizations need to invest its resources to enhance innovation agility of the organization.