Resource allocation

It’s obvious that dedicated compliance resources, or even internal audit staff focused on compliance engagements, will affect the workload of many teams. The centralization of some of the evaluation and coordination work would clearly free up the time from any operations staff who were tasked with those responsibilities. That particular benefit, however, is the least impressive on the list.

Organizations with a compliance status allocate operations resources to compliance tasks on an “emergency” basis. Because the compliance workload (e.g., evidence gathering, interview participation, issue remediation) is identified and resourced as the evidence requests and audit cycle dictate, rather than as part of daily operations, compliance tasks become a fire that must be extinguished. Often, when compliance tasks are required:

• Other operational priorities are put on hold or delayed for the compliance tasks. It is realistic to expect operations resources to be frustrated that they must put their “day jobs” on hold for work that doesn’t have an obvious operational value-add. Additionally, this approach negatively affects the stakeholders of the delayed operational work. The sudden reprioritization may have ripple effects throughout the organization as underway initiatives and even daily operations get bumped for audit.

• With emergency resource allocation, it’s difficult to ensure that the most suitable resource on each team is assigned to the work. The resource who usually completes compliance tasks may be engaged in a different, top-priority activity. This adds sudden training burden and risk to the audit activities, because the less-than-optimal resource must be given instruction about the specific compliance need or requirement that the seasoned resource wouldn’t have needed.

• Information and evidence gathering will be inefficient, if it’s done all at once, as it’s requested for audit. It will also be unlikely that the organization has developed a method for collecting the least amount of evidence required to successfully demonstrate compliance. Rather than identify one screenshot or record that meets multiple requirements, each team may be collecting evidence per individual requirement—creating duplicate and unnecessary work and increased administrative burden for storing, mapping, and providing the evidence to the assessor.

• If evidence is gathered under emergency conditions, there is a risk that it will also be poor evidence. First, a record may not be the best way to demonstrate compliance with a particular requirement, leading to increased auditor inquiry or investigation and additional evidence requests. Second, it’s possible that evidence will be missed, out of date, or misaligned with operations. Most importantly, though, there won’t likely be time to ensure the evidence is sufficient and aligned with the requirements. If there are operational issues that create a compliance failure, it won’t be noticed by the organization any earlier than it will be noticed by the auditor.

Instead, an organization with a compliance program designed to operationalize compliance tasks allocates resources as part of the staffing plan, workload prioritization, strategic alignment, and continuous improvement. So, not only are there dedicated compliance resources to ensure that operations teams are not burdened with audit coordination and evidence management, operations resources will be allowed to disperse their workload throughout the year. This leads to:

• Optimal prioritization: Resources will be able to plan for high-priority work and compliance obligations, ensuring seasoned/optimal resource availability for audit activities and interviews.

• Reduced evidence burden: Efficient evidence can be identified and mapped to compliance requirements, reducing the overall amount of evidence required to demonstrate compliance.

• Effective evidence: Evidence will also be evaluated for sufficiency, operational and requirement alignment, and issue resolution immediately as it’s created, providing time for compliance and operations personnel to mitigate any issues and collect corrected evidence for audit.

• Shorter audits: Most likely, audit engagements will be shorter, because there will be fewer issues requiring additional inquiry or evidence, and resources will have successfully integrated compliance tasks into their daily routines, making them ideal interview candidates.

• Ongoing, continuous relationships: An ongoing relationship ensures strategic and operational alignment with both current and upcoming requirements. If there is a compliance dependency on an operations group, there must be an ongoing relationship with those groups.

• Resource justification: Planned and prioritized compliance obligations can help create visibility into the potential need for additional operations resources to ensure organizational success.

• Transparency for issue identification: The relationship among the compliance and operations groups prevents an adversarial relationship, making way for an effective partnership to quickly identify, assess, and resolve any deficiencies. Rather than an adversarial relationship, a partnership between compliance and operational personnel allows for candid and immediate conversations if deficiencies are identified, potentially reducing negative effects on the operational groups required to resolve any issues, as well as the whole organization.