In procurement, rogue spend, lack of training, and non-compliance with procurement policies can obscure the data essential to effective spend management and financial planning, making it difficult to maintain adequate cash flow, capture value and savings through strategic spend, or build a resilient supply chain to protect business continuity. Convercent is a lot more than just GRC. : The following are illustrative examples. Identifying and codifying these KPIs provides a compliance paradigm that guides all subsequent controls and policies. Four Compliance Metrics Risk That Need to Die, Empty compliance metrics that aren’t worth tracking or reporting, factors that contributed to the misconduct, A lack of confidence in IT systems’ abilities to fulfill the CCO’s reporting responsibilities—which nearly 60% of surveyed CCOs cited, A lack of technology to help meet reporting needs—OCEG’s research pegs 53% of organizations using spreadsheets, documents and email as their primary GRC tools, A lack of confidence in metrics—42% of CCOs say they’re only “somewhat confident” or “not confident” in the metrics they use to give a true sense of effectiveness, Issue trends by location, business unit, organizational title, employee demographics (tenure, salary, etc. “A specific set of metrics designed to measure how well an organization’s compliance department is maintaining that same organization’s compliance with internal and external policies, along with industry and government regulations, compliance KPIs are essential to protecting your business and helping it expand beyond its current capabilities.”. Nearly one-quarter of compliance professionals say they don’t measure the effectiveness of their compliance programs, according to the Compliance Trends Survey 2014, released by Deloitte & Touche LLP and Compliance Week. Product Specific Examples. Comprehensive, audit-friendly budgeting tools. For example, many companies track the percentage of employees who complete mandatory training. since a system or equipment failure. Mean Time Between Failures (MTBF) – This is a measurement of … We just need a bit more information from you so our specialists know how to assist you better. Non-Compliant Change Request Percentage – The percentage of change requests that do not abide by the change management process per total number of change requests. Examples of metrics to track to ensure HIPAA compliance include: Percentage Difference in MTTR: A measure of changes to MTTR as an indicator of relative efficiency, expressed as a percentage. They rely on this same data to evaluate the overall success of their efforts, and to guide the organization away from potential problems before they become actual disasters. HR Cost per Employee How much is the company spending on HR? Automatic three-way matching and contract compliance tools. When you choose a metric, make sure you ask, “So what?” If you can’t answer why the metric matters, or what the goal is for that metric, choose something else. Ratio of Disputed Invoices to Total Invoices, Percentage of Invoices Automatically Matched. The term key risk indicators (KRIs) is also used for some compliance metrics. No two organizations will share identical priorities with regard to risk mitigation, but businesses of all sizes can benefit from a compliance program built around measuring, evaluating, and adjusting workflows and policies with the help of compliance KPIs. Trends between type of misconduct and the factors that contributed to the misconduct —including rationalization, lack of awareness, pressure, etc. I’m continuously struck by the compliance industry’s challenges around program measurement and reporting. It was originally published on December 6th, 2008. Invest in the tools and techniques you need to build a robust, flexible compliance program using targeted KPIs, and your organization will gain competitive strength through more effective risk management and business strategies. Add in industry regulations, internal controls and compliance policies, and the need to comply with third-party requirements such as green business certifications or Energy Star regulations, and the average compliance team can find itself lost in wave after wave of data pouring in from countless sources. You need to be tracking cybersecurity metrics for two important reasons: For instance, many companies track the number of people who took training, or the number of training sessions given in a quarter or year. List common criteria for measuring achievement to goals through appropriate metrics. We are on a mission to drive ethics to the center of business for a better world. A compliance management solution such as PurchaseControl, for example, provides intuitive and flexible tools that support the creation, monitoring, and refinement of your most important compliance KPIs through: When companies track and refine their compliance KPIs effectively, they can expect: To address compliance issues effectively, senior management needs a compliance program that not only identifies potential risks, but helps ferret out and correct their root causes. Enter your email below to begin the process of setting up a meeting with one of our product specialists. And you can’t measure your security if you’re not tracking specific cybersecurity KPIs. Metrics help to demonstrate the “ris k tolerance” of an organization. However, given the ambiguities of this terminology, it is not always evident to débutants how these types may be characterized and used. Using needs analysis and risk assessment, you can identify your current compliance program effectiveness and then build your program based on the business objectives you’d like to achieve. Distributing policies is nothing new for compliance teams, and as a result this has become a fairly mundane “check the box” activity. When evaluating your current compliance ecosystem, your ranking system might look something like this: Having everything in black and white not only makes it easier to train your team to follow your new compliance policies and protocols, but also provides a concrete, audit-friendly record for internal and external review. Proposed compliance risk metrics: Issue trends for key risk areas. By carefully monitoring these KPIs, compliance officers can avoid the costly headaches that come with non-compliance, identify the root causes of compliance issues, and better insulate their organizations against potential risks. Governance, risk and compliance KPIs help to measure the organisation’s governance in terms of risk, social responsibility, compliance, environmental responsibility and sustainability, on different levels. Cybersecurity benchmarking is an important way of keeping tabs on your security efforts. Metrics that are precise and insightful help an organization identify its key risks and root causes so that resources can be applied where they most matter. The survey responses related to metrics and executive concerns provide insight, but may not be encouraging. Editor’s note: This article was contributed to Corporate Compliance Insights by Jim Nortz. Yes, these metrics are driven in large part by the expectations set out by the Federal Sentencing Guidelines—but I’d argue that in their most basic form they follow the Guidelines in letter, not spirit. Step-by-Step Guide: 8 Steps to an Effective Compliance Programme. Readily measurable across within a given period and across business units. HIPAA compliance refers to The Health Insurance Portability and Accountability Act of 1996, which was created to protect patient privacy. Designed to consume resources with maximum efficiency. ), Trends between type of misconduct and the. A few factors certainly contribute to that challenge, including: Compliance teams can’t waste time with data that won’t ultimately help them make better decisions. GRC-friendly automation and workflow management. Purchasing compliance. Centralized, cloud-based data collection and management. Data storage and management compliance. Following you’ll find example metrics for monitoring, auditing and investigations. The metrics that measure quality measure effectiveness. Financial compliance, including internal and external audit management. Use PurchaseControl's Advanced Digital Toolset for Optimal Compliance Management, by Keith Murphy | Oct 2, 2020 | Business Strategy, Stay up-to-date with news sent straight to your inbox, Sign up with your email to receive updates from our blog. Misconduct reporting and investigation trends are continuously cited by CCOs as one of their go-to metrics for program and risk management effectiveness. Issue trends by location, business unit, organizational title, employee demographics (tenure, salary, etc.) Attestation trends (good and bad) by region, business unit, organizational title, etc. Many of the metrics seek to measure the "culture of compliance," a phrase used frequently by New York's Office of the Medicaid Inspector General, in order to gauge the understanding of, and adherence with, compliance obligations among staff. Greater consistency and compliance across the entire organization. You may wish to create import metrics that track the total number of entries by method of transportation and by port; the percentage of paperless entries that were entered paperless, EDR or intensive; and the total entered value by mode and by port. Best-in-class data security compliance to minimize cybersecurity-related risks. The following 70 HR metrics are illustrative. Many organizations use the results of their risk assessment to prioritize their compliance program efforts—and with good reason, as regulatory guidance continually cites a risk-based approach to compliance as a hallmark of an effective program. HR Cost 1. For example, if you want a metric to tell you which new vendors have not completed due diligence, and your source for that data is Fred from Procurement, who enters the records manually in Excel and then uploads them to the dashboard every two weeks—suffice to say, you’ve gone against the spirit of Big Data analytics. So, how do KPI’s and metrics help measure security compliance? Internal and external stakeholders expect (and demand) optimal performance, profitability, and compliance—all backed by absolute transparency. For example, Section B.12 offers suggestions regarding Information Security Training metrics as discussed above. Mean Time between Failure (MTBF): The total number of minutes (or hours, or days, etc.) Clear and concise with regard to related risks and their mitigation. Incident drivers to differentiate misconduct that was intentional, rationalized, unwittingly committed, driven by pressure/compensation and any correlations between drivers and risk areas, locations, business units, organizational titles, etc. Developed and implemented consistently across the organization. Total Number of Compliance Issues Currently Open, Total Number of Open Employee Relations/Human Resources Issues. Regular reporting of HR metrics is a good tool for managing any Human Resources department. metrics for to measure compliance program effectiveness 2. Number and type of sanctions applied by incident type, location, business unit, organizational title, employee demographics, etc. Some Compliance Metric Examples. Doing business in the modern global economy isn’t exactly a walk in the park. Number of policy exceptions and disclosures submitted alongside rollouts of related policies like conflicts of interest, gifts and entertainment, etc. Drawn from practices and benchmarks informed by needs analysis. Supplier Defect and Compliance Rates: Ratios of accurate and contract-compliant orders completed, respectively. As one of the most fundamental components of even the most nascent compliance programs, CCOs often report on the number and topics of the courses they’re distributing, completion rates and the results of any related comprehension tests or knowledge assessments. Start with tracking and evaluating your most business-critical compliance KPIs, and then adapt your workflows to develop a more nuanced approach as needed. Complete, high quality information on business processes, gathered more quickly. Following a few best practices will strengthen your compliance policies and ensure you’re making optimal use of the compliance metrics you’re tracking. Although that number is an improvement from the previous two surveys, other evidence suggests compliance professionals aren’t wholly comfortable with the metrics … systems or equipment were actually available divided by the total number of minutes they should have been available. Most recently, it was the annual Compliance Trends Survey from Compliance Week and Deloitte that delivered the bad news: 35% of CCOs cite data reporting and analytics as one of the top three most challenging aspects of their job, while nearly a third of CCOs aren’t measuring the effectiveness of their program through compliance risk metrics at all. – Using Metrics To Measure Compliance Performance KPIs for Compliance. How KPIs and Metrics Can Help Measure Security Compliance. May be referred to as “downtime.”. The same is true for compliance, where a poorly executed compliance program can leave organizations at risk of reputational damage, costly fines and fees, or potential litigation and regulatory intervention. a compliance issue, for example, then it is clearly essential that those are remedied. A specific set of metrics designed to measure how well an organization’s compliance department is maintaining that same organization’s compliance with internal and external policies, along with industry and government regulations, compliance KPIs are essential to protecting your business and helping it expand beyond its current capabilities. Metrics help to demonstrate e ffectiveness in process (i.e. Not all the examples will fit your program. Examples. This presents obvious problems for a program’s defensibility: If you don’t know if or how well your compliance initiatives are working, you’ll be hard pressed to defend or improve your program. Compliance KPIs can be implemented as an early warning system to detect potential compliance issues, and help the business move quickly to implement controls or other measures to prevent regulatory action, bad publicity and/or employee dissatisfaction. Technical jargon disguises the simple premise that information security KPIs are substantially similar to other types of metrics. Compliance KPIs can be considered “watchdogs” or “early warning systems” for potential risk exposure. Key performance indicators (KPIs) and metrics can assist security teams and senior management with strategic … One of the most important areas where KPIs are used is compliance management. by Jim Nortz. Effective compliance metrics support compliance efforts by providing a window into an organization’s compliance risks and controls. quantifiable value expressing the business performance in a shorter time-frame level With limited resources—and facing increasingly high stakes, expectations and scrutiny levels—compliance teams can’t and shouldn’t waste their time compiling and analyzing data that won’t ultimately help them make better compliance decisions. You hear a lot these days about how analytics can drive security operations but compliance is increasingly critical in many industries and sectors. The need to capture, organize, and analyze Big Data in order to obtain actionable insights has made the use of tools such as key performance indicators (KPIs) an essential part of every proactive and successful business management plan. Risk disposition by location, business unit, organizational title, etc. It has been updated for clarity. Quantity metrics may also be given in percentage. Deciding which metrics to use may be based either on the need to address potential gaps in the compliance program, for example, or the need to assess an area that has not been assessed in a while, Snell of the HCCA says. The metrics you choose should be closely aligned with your industry, business and strategy. Share via LinkedIn, Twitter, Facebook, Email. System Availability: The total number of minutes (or days, hours, etc.) When you’re using key performance indicators to manage risk, it’s important to have measurability, consistency, and adaptability built into your compliance program. Relationships between policy attestations and training completion/certifications, Impact of policy rollouts on misconduct reporting rates, Impact of incentives and communication initiatives on policy engagement and understanding. Average Compliance Investigation Cycle Time by Type, Percentage of Internal Audits Completed On Time. Designed to assess accountability and performance for risk owners. Tracking these KPIs and adjusting compliance policies and workflows accordingly helps compliance officers manage risk more effectively through the use of internal audits, policy enforcement, and compliance training at all levels of their organizations. From avoiding corruption to ensuring food safety, government agencies offer their own sets of often complex compliance requirements companies must follow to stay on the right side of the law. Ideally, your compliance team will use KPIs that are: Every business is different, but most organizations can begin to improve their general compliance (and create a paradigm for monitoring more granular KPIs moving forward) by tracking some core compliance KPIs such as: An ounce of proactive prevention is worth a pound of compliance cure. But an effective compliance program isn’t built from minutiae. The term key risk indicators (KRIs) is also used for some compliance metrics. We just need some information from you so our specialists know how to assist you better. This field is for validation purposes and should be left unchanged. Much like their counterparts in the procurement and accounts payable (AP) functions, compliance professionals rely on clear, accurate, and complete data to perform their jobs effectively. Here are some overly broad and ambiguous metrics that many compliance teams still track—and some suggestions for how to make adjustments or add context to improve their value and utility. Percentage Difference in MBTF: Comparison of failure rates across different systems or units of equipment, expressed as a percentage. The following are common examples. 2. Metrics should be developed according to the organization’s maturity in compliance program and activities. After all, isn’t that the point? Stronger competitive performance through reduced risk and optimized workflows. Every other function—from finance to sales and operations to HR—continually monitors, reports on and is held accountable for in-depth analysis of their performance. Product announcements, speaker videos and more ethical inspiration. It is vital that organizations evaluate, integrate, and (when valuable) automate metrics that provide insights into their compliance efforts in order to more effectively prevent, detect, and respond to current and future compliance risks. Finding the accurate metrics to establish compliance issues usually involves the following. If compliance wants to consistently and meaningfully contribute to a company’s strategic conversations, while being able to demonstrate and defend its effectiveness to leadership and regulators, then comprehensive and thorough reporting will need to become a matter of course. Understand key points of an organizational risk profile and risk intelligence and how they interact with compliance program metrics 3. This compliance ensures senior management has the complete and accurate data needed to harvest insights effectively when reviewing compliance KPIs. Overview Effective compliance metrics provide a clear picture of an organization’s compliance program and its associated risks and controls. Number of disclosures submitted after conflicts of interest or GT&E training, Impact of training rollouts and results on hotline trends, Impact of incentives and communication initiatives on training engagement and understanding, Policy distribution and attestation trends for key risk areas. Toward that goal, best-in-class companies are increasingly choosing to implement digital tools designed to streamline and optimize compliance management—including tracking compliance KPIs. Data-driven, forward-minded, and dedicated to optimization across all business processes using continuous improvement, today’s business leaders need effective risk assessment and risk management tools if they want to stay ahead of the competition. Training trends (good and bad) by region, business unit, organizational title, etc. Return on Capital Employed The ratio of profits to the total amount of capital invested to achieve those profits. Data Governance Council Metrics these metrics evaluate the performance of the Data Governance Council, which is the governing body for the Data Governance program. One of our compliance metrics examples represent the whole of basic agreements a company and a supplier lay down. Relationships between disclosures and incident trends, Impact of training, policies, communication and incentives on number and types of incidents, contributing factors and resolutions reached, Demographic or behavioral trends among involved parties (reporters, witnesses or subjects), Training topics and trends for key risk areas. It is well known that ITIL ® describes four types of process metrics: process efficiency, process effectiveness, process progress and process compliance [see, in particular, the discussion in Service Design, §3.7.5]. The importance of cybersecurity metrics. Translating KPIs from technical to business language enables better compliance decisions. And while it’s critical to have compliance risk metrics  about your program in order to analyze effectiveness and make ongoing improvements, there’s still a tendency to cling to “vanity” metrics—hollow metrics that don’t actually help you do much of either. When measuring worker participation, a few key safety metrics to track each month include: – Number of safety meetings and toolbox talks attended – Number of training courses completed – Number of inspections conducted and submitted – Number of closed out corrective actions Total Compliance Employee Headcount – The total number of full-time equivalent compliance staff. But the persistency of this trend is also disconcerting because it limits how far or quickly the compliance function overall can advance if it can’t provide the breadth or depth of business unit analysis as its peers (current or aspirational) in the executive suite.