Developing IT Compliance Program: Challenges, Risk Assessment, and Key Regulations

GROUP ASSIGNMENT 1:
DEVELOPING IT
COMPLIANCE PROGRAM

Table of Contents
1. Introduction.......................................................................................................................................1
2. IT Division’s Challenges to Achieve Regulatory Compliance........................................................1
3. Risk Assessment of IT Governance’s and its Impact on IT Division.............................................3
3.1 Arguments..................................................................................................................................3
3.2 Improvement of IT Governance Process..................................................................................3
3.3 Tips for IT Governance.............................................................................................................4
4. Key Regulations and Standards.......................................................................................................4
5. Risk Assessment of Key Business Processes and IT Compliance Factor.......................................5
5.1 Key Business Processes..............................................................................................................6
5.2 Compliance Risk Assessment....................................................................................................6
5.3 Compliance Management..........................................................................................................7
6. Project Plan........................................................................................................................................8
6.1 Vision of Project Plan..............................................................................................................10
6.1.1 Analyzing Phase...............................................................................................................11
6.1.2 Initiation Phase................................................................................................................11
6.1.3 Planning Phase.................................................................................................................11
6.1.4 Development Phase..........................................................................................................11
6.1.5 Implementation Phase.....................................................................................................11
6.1.6 Reporting Phase...............................................................................................................12
7. Conclusion........................................................................................................................................12
References................................................................................................................................................14

1. Introduction
The problem encounter is that in the business activities, the members of IT department
have no clear regulations to follow and compliance maintenance is missing. It is also determined
that proper training is not provided according to standard and regulations, which is resulting in
poor compliance levels of the resources and legal obligations for the organization.
The problem is referred by the following- All the organizations must implement the
necessary policies and must approach IT compliance for effectively managing the business
activities. It is necessary for the organizations to have policy and control measures; have suitable
compliance management; ensure screening of personnel; control assessment; provide training
and communication for compliance; for IT controls ensure constant monitoring and auditing;
consistently enforce control environment and; prevent and respond to incidents and gaps in IT
Controls. Any organization requires these steps for building IT compliance program, which can
help to boost the confidence of its business performance (Rasmussen, 2006). Based on this, the
project refers to the development and implementation of IT compliance program for an
organization, for its IT department to meet the regulatory compliance and standards.
The objective is to determine how to design a Compliance Project with the egulation of
HIPPA, Gramm-Leach-Bliley, PCI, Ethical and professional codes of conduct and Sarbanes-
Oxley Act, where effective communication for the key regulations to all the members of IT
department will be provided. The necessary steps will be defined for maintaining the
compliance. The steps to motivate and guide the members in following the regulations will be
provided.
2. IT Division’s Challenges to Achieve Regulatory Compliance
The identified issues and challenges for achieving the regulatory compliance are related
to the IT division’s members who are not provided with proper regulation to follow the business
activities ("4 Challenges of Maintaining Regulatory Compliance & How To Overcome Them",
2017):
1) An effective flow for reviewing the routine processes in the business, for improving
the process with new actions is missing.
1

For this problem, the effective solution is to implement real-time intelligence record
system, alerts, charts and notification can benefit. Because, it helps in visualizing
the data and helps to automate the requests for the service.
2) Unawareness of the legal obligations and risks with respect to non-adherence to the
regulations.
This issues can be addressed by designing an easy to follow and organized process.
Along with a proper training program that educates key standard, regulations, and
methodology that has to be followed.
3) Unorganized processes without any standardized measures like routine monitoring
of the members is missing.
This problem can be resolved by enforcing a routine monitoring repository with
information security (Guzman, 2017).
4) The IT department faces problems related to disorganized data in the data retention
system. This leads to confidential information risk of both the organization and the
customers.
This problem can be dealt by just prompting access to relevant data with a protected
platform (Guzman, 2017).
5) Prioritizing the regulatory priorities is missing.
The solution is to re-draft the company policies and procedures. It is necessary to
evaluate the current overall compliance program. If, regulatory information
management is missing, ensure to mitigate the risks, take advantages of the coming
opportunities and maintain compliance.
6) Increasing compliance cost (Weinberg, 2011).
To cope up with the cost of compliance, following the below mentioned steps can
help:
a) Metrics defining: – What will you use to measure the success of your
compliance program and the ROI? Examples include legal expenditures and
fines that are avoided or reduced and efficiency gains in compliance
processes.
b) Baseline setting: It’s difficult to demonstrate improvements without baseline
measures, so if you haven’t done so, collect them now.
2