Governance Risk & Compliance (GRC) for SharePoint – SharePoint Europe Conference 2011

Posted on July 10, 2011 by Donal Bourke

This year’s European SharePoint Conference in Berlin will be an opportunity for GRC Professionals, business decision makers, IT professionals, developers and end users to see how GRC solutions based on the SharePoint platform can be used to include the whole organisation in GRC and gain a greater return from their SharePoint investment.

There are several factors which make SharePoint extremely suitable as a platform for GRC solutions. Firstly, SharePoint has found widespread adoption as the collaboration platform of choice for the enterprise. Secondly, it provides a familiar user environment using standard web browser based interactions and integration with the ubiquitous Microsoft Office applications.

Building on top of the SharePoint platform the core compliance processes of Policy/Document Management, Risk Management, Incident Management, Audit Management & Training Management can be configured which map to the core pillars of an effective GRC solution.

Additionally, with the addition of an add-on commercial grade workflow & web-form engine that integrates with Microsoft SharePoint enables the easy implementation and enforcement of all key regulated processes.

Often using these tools compliance processes can be developed rapidly in an easy to use “Visio” style designer and published directly to SharePoint. Thus removing the need for lengthy and costly development and customisation projects. With standard training, compliance and business owners can take control of their process and ensure agility to respond to changing business needs and regulatory requirements.

There are a range of of SharePoint editions in use including; 2010, Foundation, Standard, Enterprise, MOSS2007 & WSS3.0. Importantly, all of functionality needed to implement effective GRC is available on the “Inluded Free” Foundation and WSS 3.0 versions of SharePoint which can save considerably on license fees for large scale deployments.

Often add-on licensing is sensibly priced on a per server/cpu basis and is unlimited in terms of concurrent users.

I hope this helps & I look forward to meeting you at the conference and discussing how effective GRC can be implemented with a strategy using SharePoint.

http://www.saticon.com

http://www.sharepointeurope.com/

Posted in Uncategorized | Leave a comment

A Clear Change: Actions to Reduce “Uncertainty” in the Review Process

Posted on June 20, 2011 by Austin Ewing

The FDA is now attempting change to its pre-market approval process along with 25 other key tasks it aims to implement in 2011. A recent survey conducted by Northwestern University illustrated key flaws in the CDRH’s 510k review program for medical devices. The survey indicated that nearly 2/3’s of small medical device and diagnostic firms set their focus upon Europe first for regulatory clearances; as companies emphasized that “unclear guidelines, inconsistent implementation, and lead reviewer turnover” by the FDA have created unpredictability in the regulatory approval process. Those results have illustrated critical problems that exist in the FDA’s oversight capabilities.

The findings, which confirm reports earlier in the year of unpredictability in FDA requirements, illustrated a key reason for complaints regarding the quick approval process of the 510k review by the Center for Devices and Radiological Health’s (CDRH), of the FDA, whose goal is to ‘ensure that medical devices are “reasonably” safe and effective’. The unpredictability in the CDRH’s process has put the organisation’s oversight capabilities and their effectiveness in serious doubt. Recent recalls and complaints over a lack of FDA oversight have highlighted the need for the organisation to change its confusing guidelines, which could possibly have had an impact on organisations rushing products to the market.

Nearly 2/3’s of the participants in the survey added that additional/unpredictable requests for information by the FDA made a “significant impact” on their organisation’s financial resources. A reduction in financial resources in the pre-market review stage by organisations is likely to cause the companies to increase the speed in which they attempt to get their products to the market. The FDA’s “unclear” guidelines coupled with a limited staff and an accelerated 510k product to market approval process could potentially be a key formula in the increase in medical device recalls. According to Jeffrey Shuren, Director of CDRH, in a statement to the Subcommittee on Health of the Health Committee on Energy and Commerce of the U.S. House of Representatives in January 2011, and estimated 90% of the CDRH’s reviews were completed in 90 days or less and 98% of them were finished within 150 days. With such a quick review rate of approval, it’s no surprise that worries and complaints have emerged from the accelerated process.

Problems with the 510k process have been noted since 2009, when the FDA established two internal working groups to assess the concerns in the premarket notification process. In August 2010, the 510k working groups released their findings, which included 55 recommendations and five months later the FDA released 25 specific actions and timelines for implementation under the 510k program. These changes were aimed at eliminating what medical devices industry stipulated and the Northwestern Survey confirmed as an “unpredictable, inconsistent, and opaque” review process. Healthcare professionals additionally argued that the entire process was not “robust enough”. The survey also found that approximately 75% of the respondents felt that the preparation requirements for a 510k were uncertain and unclear, and nearly 60% of the participants indicated that there were no guidance documents for their devices.

In response to the need to innovate the guidance documents, Shuren indicated that one of the CDRH’s goals is “beefing up its ability to issue guidance documents,” but it will be hampered in the short term as he cited a lack of resources to establish a group of technical writers that would free reviewers and scientists to “do what they do best”. Retention of staff at CDRH is also on the agenda list for Shuren, as 14% survey respondents indicated that during the submission process their lead reviewer had changed. The lack of human resources is not a new issue for the FDA either, as the organisation had a staff deficit of approximately 700 people between 2003 and 2008. Implementing these actions to reduce the “uncertainty” in the 510k review process and addressing human resource issues within the CDRH will be the key actions the FDA will look to implement throughout the remainder of the year.

Ultimately, the organisation will need to reduce the unpredictability of its review process, as it has received calls in several reports calling for the FDA to replace the current system with the European Union’s system, which features key differences such as no requirement of a government review before a device can be marketed or a demonstration of the device’s effectiveness. The survey’s findings will look to reinforce the actions that the CDRH needs to implement and ultimately improve the 510k process and the safety of medical devices as well.

Posted in Quality & Compliance, Uncategorized | Tagged | Leave a comment

Best of both worlds – Practical ways to embrace adhoc processes in BPM.

Posted on June 15, 2011 by Daniel O'Sullivan

Introduction.

In a world of dynamic and discontinuous change, companies are constantly requested to adapt themselves to new conditions so that they are prepared to survive and flourish in an increasingly competitive environment. In such a dynamic landscape, they must re-examine the ways they treat their knowledge assets and they are identifying new and reorganising existing processes in which they can exploit them more effectively in the future. In this pressure cooker, only organizations with reliable end-to-end processes will be versatile enough to do more with what they have and adaptable enough to change fast. Therefore, efficient management of knowledge intensive processes has attracted increasing attention.

The latest buzzwords of semantic technologies operating on the semantic web qualifies as an enabling technology which can support structured as well as unstructured aspects of the knowledge intensive processes. Hence it aids a number of roles a knowledge worker has to fill in a business process oriented environment:

1)Support for process participants in the standardized but still flexible execution of business processes and
2)Support for process engineers in the definition of such standardized processes based on existing work practice.

The goal of our approach is to resolve the dilemma of flexibility for knowledge workers versus organizational needs for standardization and control by supporting the grass roots development and evolution of workflows.

The Knowledge Worker and the adhoc process.

Knowledge work is work with a large amount of creative activities (as opposed to routine work) which run within or across a set of business processes. Knowledge processes describe distributed, organisational work and the workers rely on knowledge as their critical work resource, searching, analysing, and synthesising information, and in collaborating with others to generate new knowledge.

Knowledge Workers are primarily controlled by goals instead of tasks, and they have significant freedom in structuring their activities themselves (such as timing and procedures). This freedom calls for new types of processes, processes which resolve the dilemma of flexibility for knowledge workers versus organizational needs for standardization.

We refer to such processes as ad hoc processes, which consist of defined inputs and outputs, but leave the way to accomplish the defined outputs up to the knowledge workers and their specific context. They also allow for the agile but uniform handling of structured and unstructured process parts.

Disparate Views- The organisation and the individual process perspective.

The organisational perspective revolves around work flow management systems which boosts productivity by increasing the degree of standardisation and transparency, enabling traceability of past process executions, allowing effective controlling and monitoring mechanisms, and permitting easier synchronization and coordination of networked and interdependent activities. The emphasis is on execution down to the smallest detail.

The way BPM has evolved has been primarily focused on improving the productivity of the blue-collar worker who were expected to follow what has been modelled by the business owners, and expected to accomplish their tasks from task lists in the order mentioned, and in a measured manner.

The individual perspective on the other hand is represented by the field of Computer Supported Cooperative Work (CSCW- first coined by Irene Greif and Paul M. Cashman in 1984.) which supports knowledge workers in coordinating and negotiating work tasks, in the exchange of information within a specific work context, and collaboratively coming up with solutions to common problems.

This approach is mainly unstructured with respect to processes and focuses on information exchange and collaborative sense making. Consequently CSCW approaches are characterized by lacking process transparency, traceability, standardization and control. Both technical approaches, workflow management and CSCW, can be improved to allow the efficient definition of ad hoc processes, their automatic analysis and mapping to standard processes, and the automatic adaptation of workflows.

According to a number of experts in the field, over the last decade there has been a shift from “data-aware” information systems to “process-aware” information systems (PAIS) such as Workflow Management Systems (WfMS). Although it is appreciated that PAIS have made a significant contribution to increase the productivity of employees, there is also a widely regarded view that their rigidity restricts their applicability .

Ad-hoc processes require the process engine to give up (a little bit of) control. The engine no longer describes the entire business logic as one interconnected flow chart, but rather relies on the input of end users (i.e. the expert or knowledge worker), rules (for inspecting data related to the case) or external events.

Tools that merge unstructured and structured concepts.

There are various tools which permits the description of semi-structured processes like this, using an ad-hoc sub-process.

Drools Flow for example allows end users to specify, execute and monitor (a part of) their business logic using these processes. Also IBM introduced “Dynamic Human Workflows” in its WebSphere Process Server, which allows run-time users to rearrange some details of the flow during its execution so that it evolves differently than the way it was defined at design time effectively giving it case handling capabilities.

Finally here, another aid is called The Decorator which is essence is an object oriented structural pattern, invented by Erich Gamma, Richard Helm, Ralph Johnson and John Vlissides. The Decorator is a pattern that can add additional responsibilities to a process in a dynamic way. Decorators provide an agile way for extending functionality. This blanket term for this area is called Adaptive Case Management (ACM).

The unique feature of combining business processes with business rules and event processing allow for the versatility at runtime. For example end users can flag what tasks to execute, rules and processes can trigger certain tasks and work collaboratively since rules can be associated with the ad-hoc sub-process to automatically trigger certain tasks when the sub-process is activated, or conditionally based on the available data.

For example the unique features of combining business processes with business rules and event processing, could be very useful in more data-based processes, like for example claim management. In this case, the tasks that need to be executed are largely dependent on the available case data. It might be more intuitive to model this as a number of independent process fragments (one for example to request additional information from the owner, one to delegate the claim to another person, etc.). Here, rules could again be really helpful to automatically derive the current state whenever the claim is updated.

The Blended Process – Adaptive Process Discovery.

Presently, it’s difficult to separate ACM from BPM, because most processes blend together elements of both unstructured and structured processes. Maybe one of the best ways of accommodating all value added aspects of the process is to define the start and end points and figure out the bit in the middle through adaptive process discovery.

Every time there is an instance of the process kicked off it’s tracked as it travels across the enterprise and touches the participants, it’s not modelled up front and this is the key part. Once there have been enough instances tracked and discovered there is an element of probabilistic vs. deterministic branching to try to predict on previous behaviour where the work package or item will go next. This iterative process informs the structured aspects of the process while accommodating the dynamic creative unstructured elements.

Posted in Uncategorized | Tagged | Leave a comment

A Culture of No Complaints: Not Just Yet

Posted on June 14, 2011 by Austin Ewing

The ongoing trend in the financial services sector of organisations’ mis-handling customer complaints has pushed the industry toward new regulations, but not new cultures. In recent months it emerged that several financial institutions had mis-sold Payment Protection Insurance (PPI) and have since left consumers’ complaints on hold. Those organisations then took the claims to court, only to drop their case and admit to mishandling the customer complaints. This illustrates a significant flaw in not only handling customer complaints, but also a flaw in banking institutions culture, especially regarding customer service.

The British Banker’s Association withdrew its case of legal action over the claims of mis-selling PPI by several of its high profile banks in early May, after insisting that no PPI had been mis-sold. The banking industry has been synonymous with both financial security and customer service, creating a feeling of “trust” between the banks and their customers. This relationship has been slowly deteriorating, as Peter Vicary-Smith, Chief Executive of Which?, emphasized that PPI had been mis-sold and customer complaints about it were mishandled for over a decade. The quick decisions of Lloyds and Barclays banks to repay £3 billion and £1 billion to customers respectively, is a step in the right direction, but still leaves a lot of room for improving the complaint process.

The banks have yet to mention what they will do differently in the future to make sure customer complaints are handled properly in similar cases, let alone provisions to prevent future mis-selling of products. According to Andrew Hagger of Moneynet, “It’s time to draw a line under this sorry saga and for the banks to win back customer trust by concentrating on delivering consistently high levels of service and moving away from the pushy sales culture. Part of delivering high quality customer service lies in the proper handling of customer complaints, which will not be addressed simply through continued oversight by the FSA or by paying out billions of pounds to customers. According to Sheila Nicoll, “Good complaints handling contributes to customer loyalty”. Banks involved in the mis-selling of any sort of financial product or in receipt of numerous complaints about such a product, need to focus their efforts on improving their culture toward efficient complaint processes in addition to customer compensation.

While the banks did not announce any changes to their complaint processes, the Financial Services Authority (FSA) decided to change its system regarding complaint process regulations. FSA found that there was “inappropriate use” of the current complaint system set by the FSA. The new system will replace the old one, which gives financial service organisations two attempts to respond to a customer complaint. The FSA found that the first response by organisations was usually ‘“poorly drafted” and could put the customer off continuing with a complaint, even if it was justified’. Coming into effect in July 2012, the new system will make the first response the final response and customers unhappy with that response can take their complaint to the Financial Ombudsman Service. According to Adam Scorer of Consumer Focus, the FSA’s actions are “Good news for consumers” as the FSA is taking a “stronger line of complaints handling”. The FSA also took the initiative to extend the mandatory response time for PPI complaints to Lloyds, Barclays, and the Royal Bank of Scotland beyond the eight week period.

The move emphasizes a push toward improving the organisations’ complaint management culture, by allowing the organisations to handle the complaints (on hold and new complaints) properly. The FSA is giving financial service organisations a push in the right direction toward fixing their complaint practices and improving their customer service. Ultimately though, financial institutions will need to put emphasis on improving their complaint management culture, which is at the core of good customer service.

Posted in GRC | Leave a comment

A Delayed Response: How Effective is the FDA’s Oversight?

Posted on June 9, 2011 by Austin Ewing

 The Life Sciences industry is one of the prime targets of FDA inspections and investigations, as its CDRH and CBER branches focus on ensuring that medical device and pharmaceutical organisations are keeping up with quality assurance and regulatory compliance, but how effective is the FDA really in achieving this?

The FDA appears to be becoming less compliant as a compliance enforcer in recent months, as several cases have emerged portraying the regulator’s decrease in its oversight of known non-compliant medical device companies. In the past three months two major instances of decreasing oversight have become highlighted by the FDA’s long delay in its inspections and corrective action reviews of non-compliant organisations.

A the same time, the organisation also seemingly shifted some of its focus away from inspection efforts and issuing 483 warning letters, and toward increasing its authority upon the 510k medical device approval process. In February 2010, the FDA approached the United States Congress requesting increased authority over the medical device industry in relation to the 510k medical device approval process. According to the Gaitan Morales firm, the FDA’s Center for Devices and Radiological Health (CDRH) found that the FDA’s powers were too narrowly focused with regard to device recalls, oversight of labeling, and post-market device surveillance. Critics of the accelerated process at the time indicated that the process was too overly adopted and led to “increased problems after devices were sold”.

Nearly a year later in 2011 the U.S. Government Accountability Office (GAO) agreed with the critics, as it raised its concerns about the process’s “ability to provide adequate assurance that devices are safe and effective” The shifting focus toward accelerating approvals over inspections by the FDA along with the fact that the organisation has lost nearly 800 staff from 2003 to 2007 (104 new investigators were hired in 2008) illustrates potentially severe problems with the FDA’s oversight capabilities and their effectiveness.

The effects of such delays in FDA oversight of non-compliant organisations can have tremendous impacts upon patient safety. One such case involved Triad, which had to recall its alcohol and iodine prep pads, alcohol swabs, and alcohol swab sticks; as well as products in several equine and canine first-aid kits starting in April 2011. The recall came after an inspection carried out by the FDA in March 2011 identified Bacillus cereus in sterile and non-sterile alcohol prep pads and Elizabethkingia meningoseptica contaminants in sample results of iodine prep pads. Triad’s manufacturer, H&P Industries was first investigated in April-May 2010, where several compliance issues were documented and a 483 was issued relating to problems with corrective/preventative actions, process validation, document control, and quality assurance. The organisation was allowed to continue its non-compliant ways for over a year until a second inspection was carried out at the end of November 2010 that identified further issues. A third inspection was carried out in March 2011, which ultimately initiated the recall.

The delay of nearly seven months between inspections and a lack of oversight during that period by the FDA allowed H&P Industries to delay implementing the proper corrective actions and ultimately increased health risks to patients utilising Triad’s products. The delayed response by the FDA, allowed the manufacturer to delay implementing the necessary corrective actions, which by January 2011 were already too late. The delay also impacted Churchill Medical Systems, as it had to recall its hospital-use convenience kits that contained Smith and Nephew’s skin prep wipes that were manufactured in the same Wisconsin factory as Triad’s products. The organisation had to recall all shipments to distributors and hospitals between September 2010 and March 2011.

Recently, another delayed response by the FDA in its oversight effectiveness was brought forward by Darrell Issa, the Republican Chairman of the House Oversight Committee. According to Issa, the FDA has delayed its compliance efforts aimed at Johnson and Johnson’s McNeil Consumer Healthcare plant based in San Juan, Puerto Rico. The plant was last visited by FDA inspectors in September 2010 and the plant’s corrective action plans, agreed upon with the FDA in March, still remained to be reviewed by the FDA as of May 2011. Issa urged the FDA to “follow up” on hearings from last year that indicated problematic deficiencies in McNeil’s San Juan and Pennsylvania medical manufacturing plants.

The ability of the FDA to effectively monitor the compliance efforts of Life Science organisations has a huge impact on ensuring patient safety. The delayed response to both companies previously reported portrays a potentially disturbing image of the overall effectiveness of the FDA, which conducted 15,245 inspections and issued 4,987 483s in 2008 (2,353 in CDRH in 2008), in its oversight capabilities. With the impact that compliance efforts have upon patient health and assessing the shock that Darrell Issa emphasized in reviewing the Johnson and Johnson inspection, which he described as “deeply troubling and inconsistent with the resources made available to the FDA,” it looks increasingly likely that the FDA’s oversight of non-compliant medical device companies is decreasing and as a result the amount of future recalls will likely increase.

Posted in Quality & Compliance | Leave a comment

Can BPM handle unstructured processes?

Posted on June 7, 2011 by Daniel O'Sullivan

The success of BPM solutions hinge upon how efficient the process can be. Process efficiency deals with driving efficiencies into the processes by continuous improvement. Not only need they be well defined and easy to follow they also must be easily adapted/improved to contain the unstructured dynamic nature of business. The overall aim is to continuosly improve and thus the process needs to accomodate constant change. This requires easy to use tools with minimum technical input to assist in the development and maintenance of dynamic processes that equally accomodate structured and unstructured processes. As usual, the answer is never at the polar opposites but somewhere in the middle utilising the best of both structured and unstructured elements.

BPM in context
In the past, traditional BPM systems have been applied with excellent results to routine work, but it has been more challenging to adapt these systems to handle knowledge work such as claims management, where there are dynamic processes, content and rules.
Unstructured, or knowledge, work, doesn’t have the same level of predictability as the routine structured work; instead, the knowledge worker needs to be able to decide what action to take next on a particular piece of work, and when to send it on to someone else. Knowledge Workers are people in your company today who leverage their company and product expertise to make day-to-day company decisions. Their knowledge plays a critical part in ensuring the most vital processes in your company execute correctly and efficiently. For the knowledge worker, process flexibility and run-time decision making are important functionalities as it allows them to act on tasks and activities in the most appropriate and efficient manner.

BPMS and Case Management
Drucker coined the term “management by objectives” to describe how these processes – and the people who participate in them – need to work: you set the goals, and let the person figure out the best way to do things in order to achieve that goal. That’s knowledge work. There have been a lot of attempts to implement knowledge work as structured processes, and that doesn’t work out so well. It typically results in some sort of amorphous “hold” step where the process participant puts the item on hold while they send emails or make phone calls in order to resolve the issue at hand. In other words, they step out of the audited and controlled BPM environment in order to do what is necessary in order to achieve the goals of the process.

New functionality – usually called case management or dynamic BPM – has emerged within many BPM suites as well as in standalone case management products to more effectively handle the unique challenges of knowledge work. And since many processes include aspects of both structured and unstructured processes, many of the systems are allowing these to be combined in a single process, either where a structured process spawns a collaborative case for exception handling, or a dynamic case invokes structured process fragments for standard procedures.

A key capability of any case management system is the ability to handle unstructured work, allowing a case worker to use their own experience to determine the next steps to progress the case towards outcome.
Routine work and knowledge work are very different in terms of the degree of structure and a priori knowledge, as well as the skills and level of responsibility of the people who actually do the work. In reality, however, it’s not so black and white, and many business processes fall somewhere in between these two extremes.

Interest in case management has escalated in recent years. Drivers include:
1) an increased need to manage the costs and risks of servicing customer requests – like loans, claims, and benefits;
2) a greater emphasis on automating and tracking inconsistent “incidents” that do not follow a well-defined process;
3) new pressure on government agencies to respond to a higher number of citizen requests;
4) new demands that regulators, auditors, and litigants place on businesses to respond to external regulations; and
5) the increased use of collaboration and social media to support unstructured business processes.

Business process management (BPM) and enterprise content management (ECM) suites alone are insufficient for dynamic case management, but the convergence of BPM, ECM, business analytics, and event processing will breathe new life into case management. Lean initiatives to improve business processes will also shine a spotlight on case management. These forces will push document- centric BPM suites toward packaged case management offerings, and this new category of software will emerge as a distinct market by 2013.
It is important that process experts and process vendors understand the context of implementing technological solutions , and provide customers quality solutions for their needs.

Indeed Dan Pink wrote in “A Whole New Mind” about how the world will be run in the future by “right brained” people. These are people who don’t view all activity as being composed of discrete processes, but in fact there are certain problems that are solved in a holistic way using native intellectual capabilities of intuition and understanding.

BPM is fundamentally about process. BPM practitioners views the world as a set of processes. Everything is a process, and we accomplish things by examining those processes, modeling processes, automating processes, executing processes, measuring processes, controlling process, and optimizing processes. The process is an abstraction of the way that work gets done, and the practice of BPM is to make it explicit. But case management does NOT have to do this.

The same is true with ACM. Many of the technical components are similar to BPM. Many of the players who build BPM systems will probably come out with ACM systems. But do not assume that a system designed to support the practice of BPM, will be necessarily useful for the support of case management. Due to the dramatically different approaches of these two disciplines, one centered on process, and the other centered on business entities, it will take more than a simple re-architecting of the current BPM technology, in order to give us ACM technology. It will require a fresh approach.

Structured Vs Unstructured Approach.
Structured Processes are very routine and fairly straight forward processes:
• Future work is routed to a defined set of office workers
• There is no possibility of the flow of the process to take varied directions
• Execution of the process is consistent and routine ( irregularities of data in the process are rare)
• Examples: Employee Roll On and Expense Reporting

Unstructured Processes are hard to define and often take different paths based on varying factors:
• Depending on who initiates the process, the number of future steps in the process are dynamic
• Data inputted and captured in the process varies greatly
• Flow inside the process often includes process “jumps” (steps are often skipped and/or randomly activated depending on situational circumstances or run-time decisions by process participants)
• Examples: Software Project Management Release and Grants Approvals

In each of the unstructured process cases above, the people involved (‘knowledge worker’) in the process highly impact how the process itself executes.
A BPM solution, on the other hand, has the ability to effectively handle both unstructured and structured processes. It can be defined as linking and managing processes to achieve strategic goals, agreeing on what need to be done, by whom throughout the enterprise with government risk and performance management structures.
Conclusion
Unstructured performance works best when the structured interfacing processes are defined an executed within a performance framework and we can define the rules in which the unstructured aspects can operate In choosing the right process or workflow application for your company, we need to be cognizant of the knowledge worker and the fact that a large percentage of your company’s business is conducted “on the fly”.

Posted in BPM | Leave a comment

FSA Imposes Large Fines and Lengthy Prison Times

Posted on May 27, 2011 by Austin Ewing

In a recent case, Barclays Bank was fined by the FSA for several compliance issues in the sale and marketing of the Aviva Global Balanced Income Fund and Global Cautious Income Fund. The FSA levied a £7.7 million fine against the bank along with requiring it to repay £17 million in compensation to its customers. Barclays also predicts it may need to pay out an additional £42 million to customers in receipt of poor advice.

An FSA investigation into Barclay’s sales and marketing of the funds, which were bought by over 12,000 people for £692 million, found that Barclays Bank failed on three fronts. Those issues which did not comply with FSA requirements included the failure of the bank to verify that funds were suitable for particular investors’ needs, failure in ensuring that investment risks were clearly explained in the bank’s product brochures and other information that was provided to customers, and also for improper training of the bank staff who were selling the two funds. The last failing was specially noted by the FSA, as nearly one out of every seven customers issued a complaint on the grounds that they were given poor advice.

The variety of GRC needs amongst financial service industries are truly becoming explicit and hint at Forrester’s belief that the GRC market will expand horizontally across organisations in 2011.

The financial services industry has also seen several cases of insider-trading finally taken to court this year, as of February 2011, the FSA was pursuing 100 open insider-trading investigations. One of those involved ex-banker Christian Littlewood, his wife, and Helmy Omar Sa’aid. Christian and his wife Angie were sentenced earlier this year, as Littlewood was delt a 40 month prison sentence after pleading guilty to eight counts of insider-trading and Angie was handed a 12 month sentence. Sa’aid was sentenced to 24 months in prison and a £640,000 fine. The couple along with Helmy Omar Sa’aid made nearly £590,000 over the course of ten years through Littlewood’s tips to Sa’aid on planned takeovers of companies that Littlewood learned through his job at Commerzbank AG’s Dresdner Kleinwort.

The FSA began monitoring Sa’aid after he made a £160,000 from a trades before merger announcement and eventually broke the case when they discovered that Littlewoods wife was using her maiden name, Siew Yoon Lew, to broker payments between her husband and Sa’aid. Littlewood would pass on the information about the planned takeovers to his wife who would then The FSA also charged a management consultant, Rupinder Sidhu, last February with 23 counts of insider trading.

Posted in GRC | Tagged , , | Leave a comment

FDA’s Eye on Compliance

Posted on May 27, 2011 by Austin Ewing

The Life Sciences industry has seen significant activity amongst regulators. Guidant LLC, a subsidiary of Boston Scientific Corporation, was fined over $296 million in criminal related fines/forfeiture along with its submission to supervision by the United States Probation Office for a period of three years, until 2014. The fines are a result of the organisation’s non-compliance with Food and Drug Administration (FDA) regulations regarding short-circuit failures in three models of its cardioverter defibrillators, which are used to detect abnormal heart rhythms in people wearing them.

The organisation was charged for failure to comply with FDA regulations regarding the withholding of information regarding “catastrophic failures” in some of its devices along with concealing that information from the FDA and medical professionals. Guidant LLC, would have benefitted from taking the advice of Former Securities and Exchange Commission chairman, Christopher Cox’s speech at the CCOutreach National Seminar in 2008, where he stated, “When a company cuts compliance, violations will occur”. The organisation will be shedding tears of pain as an effective and efficient governance and compliance framework and software would likely have saved Guidant LLC some of its tarnished reputation.

The organisation not only decided not to inform the FDA until ten months after it identified the problem, but it deliberately continued to allow hundreds of defective devices to be implanted even after the device’s production had halted at the company’s manufacturing facility. The organisation also created and implemented a strategy to circumvent the FDA and hospitals, as the organisation advised its sales representatives to inform doctors that the devices were completely safe for use. The business will now have to forfeit nearly $43 million to the United States Government and another $254 million to pay its criminal fine as a result of purposely attempting to avoid FDA compliance regulations.

The sentiments of Margaret Hamburg, M.D., Commissioner of Food and Drugs; in response to the conviction of Guidant, in which she states “When companies fail to comply, we will use our enforcement tools to ensure the safety and efficacy of the medical products that Americans rely on every day,” is currently being applied to another case in the U.S . In this unique case of compliance, the State of Nebraska’s decision to purchase sodium thiopental from a Mumbai based Pharmaceutical organisation has come under scrutiny, as convicted murder Carey Dean Moore won a sixth stay of execution. If his appeal holds true the pharmaceutical company in question making the drug will likely suffer from increased compliance supervision by the FDA along with the loss of business opportunities in the U.S.

Moore was to receive the death penalty by lethal injection, but will now wait as the FDA investigates the Indian company’s sedative drug, which is believed to be non-compliant with FDA regulations. The state of Nebraska has already purchased nearly 500 vials from the pharmaceutical company. The sedative’s state of compliance has also been questioned in several other states, as it is one of the three drugs utilised in the lethal injection cocktails.

Posted in Quality & Compliance | Leave a comment

RBS Caught Out of Compliance

Posted on May 27, 2011 by Austin Ewing

The direct impact of organisations avoiding their compliance needs and not implementing proper Governance, Risk, and Compliance systems has been seen through several fines and prosecutions already this year. Earlier this week the Financial Services Authority (FSA) announced that it had issued the Royal Bank of Scotland (RBS) with a £3.5 million fine along with ordering the organisation to pay £17 million in compensation to its customers as a direct result of mishandling a variety of customer complaints about retail investment products the bank had offered.

According to the investigation conducted by the FSA, between 30 July 2007 and 31 October 2009 the RBS received 2,592 complaints regarding its sales of four of its investment and bond plans. After a review, the RBS “wrongly rejected” a large number of the complaints and approximately 45% of the rejected complaints should have been upheld by the bank. The FSA also stated that RBS failed to carry out effective root cause analysis of the complaints that would have allowed them to identify and resolve the issues in its operations and eventually improve the organisation’s processes.

That FSA ruling comes on the back the FSA’s announcement of the overhaul of its supervisory framework and the creation of a model of supervision different from the one in use prior to 2007. The framework of the FSA’s new model will adopt a more intensive approach and will use a new method to assess risks and financial stability. The move was likely based on the banking crisis of last year along with several events earlier in 2011. The regulatory environment is also constantly changing across the Atlantic, as the Securities and Exchange Commission’s (SEC) commissioners, in the United States, voted to establish a corporate whistle-blower program that will reward individuals that provide the SEC with high-quality information which leads to successful compliance enforcement.

This change will in effect put proper governance and compliance into the forefront of many organisations, as the program allows for the whistle-blowers to approach the SEC without first having to issue an internal complaint. These changes will have a direct effect on the financial services market; as organisations will need to understand, implement, and train personnel in order to follow those new frameworks; as well as make sure business processes and employees stay compliant.

Posted in GRC | Leave a comment

Business Process Management: A Dynamic Offering

Posted on May 20, 2011 by Austin Ewing

The level of adoption and use of Business Process Management (BPM) and Business Process Automation (BPA) are currently providing businesses with high-level benefits. According to Gartner, during the past five years “improving business processes” has become the most critical priority facing Chief Information Officers (CIOs). Reasserting this stance, an IBM survey in 2010 identified that 60% of CIOs surveyed saw BPM as a vital priority last year. Today, BPM is truly becoming a more dynamic offering to businesses; with easy integration, monitoring, reporting, and customization capabilities.

MA Ketabchi argues, that “Over the next few years, we’re going to see companies build on benefits such as using BPM for basic integration and automation of business processes” along with an “increased focus on the process optimisation” through leveraging the advancing capabilities of technology. Previously, Ketabchi states, “Organisations turned to BPM for straightforward improvements in their business processes through automation and integration” without the advantages of process/workflow monitoring, reporting, or customized dashboards.

Some of these benefits to organisations undertaking BPM initiatives, according to Gartner’s Business Process Management Summit in London, will include the incorporation of Business process analysis capabilities and leveraging BPM software on top of Service-Oriented Architecture (SOA). Ketabchi agrees in articulating that companies are turning toward BPM software to drive and integrate “new SOA-based applications and services” and essentially allow them to “respond faster to changing business requirements”.

Effectively, BPM and BPA have the ability to transform business practices through their implementation and customization. According to Gartner’s 2010 survey, businesses implementing a BPM approach effectively spend less of their IT budgets (55%) on running the organisation than the industry average (64%).

Recently, one organisation, the Carphone Warehouse integrated BPM into its business processes and procedures, which led to an increase in the efficiency of employees’ access and retention of Standard Operating Procedures (SOPs). The company won a Gartner BPM Excellence Award in “Leveraging BPM Technology,” as they implemented BPM in combination with the use of smartphones to photograph bar codes on a variety of office appliances, giving staff immediate access and direction to the SOPs in the event that they were unfamiliar with the task. Implementing that BPM process saved the organisation time and cut costs as employees were able to access the necessary SOPs quickly and efficiently.

Posted in BPM | Leave a comment