There is an increasing realisation within the corporate world that proactive risk management and good corporate governance is a mandate to comply with regulations. It is also a strategy for building and sustaining competitive advantage for organisations, for which a comprehensive Operational Risk Management framework is needed.

Organisations are looking beyond adherence to regulatory compliances and a broader ecosystem of organisational compliance to meet regulatory norms and accrue business benefits through improved risk management. It is also interesting to note that many of the organisations in the BFSI and ITES segment have hired or are in the process of hiring dedicated compliance managers in India.

Due to the new RBI regulations like BASEL II, it has become mandatory for every bank to have technological solutions that meet compliance requirements. With India becoming a major hub for software development, the technical audit for software has also become a major compliance requirement in India.

Elaborates Sivarama Krishnan, executive director, PricewaterhouseCoopers, “Organisations are facing increased compliance obligations and are exposed to civil and criminal liability apart from facing reputation risk. The risks associated with non-compliance are increasing day-by-day. On the other side, the advantages for achieving compliance are many. It can result in more cost-effective and efficient business and IT processes; increased security of data and top management support.”

Investment challenges before CIOs

CIOs view compliance as a statutory requirement that they have to abide by rather than something that they would opt for willingly considering the gains it can bring to their businesses. Achieving compliance and sustaining it with limited IT resources, skill sets and budgets, is what challenges CIOs the most.

CIOs also need to ensure that the compliance efforts evolve from ad-hoc IT projects to cost-effective and efficient processes that can be applied across various compliance domains involving security and availability of information.

Implementing compliance standards requires huge investment, and this is another major roadblock. Approval of the investment from the management, maturity in technology, ease of use and training the IT team on compliance are some of the key considerations before CIOs in maintaining compliance.

Anxiety concerning data protection

Compliance has emerged as an important trend that has defined the adoption of storage techniques by Indian enterprises. The need for storing information for long periods and then retrieving it at short notice while adhering to regulations has given an impetus to the storage market around compliance. The CII-PwC Information Security Survey has earlier reflected that security measures in India are mainly reactive and not proactive in nature.

The current compliance requirements provide a great opportunity to organisations to shift their focus from reactive to proactive controls and get business and IT processes aligned to best practices. Information security has been an integral part of the business and has been a subject of the boardroom because of the compliance requirements and the consequences of not complying with them.

According to Diwakar Nigam, managing director, Newgen Software, “Public and private companies in virtually all of the data intensive industries, such as financial services, pharmaceutical, life sciences and government, face tremendous burden to comply with a variety of new compliance regulations; including Sarbanes Oxley, HIPAA and SEC Rule 17a-4. Major challenge for organisations today is to manage the huge volume of information generated and the ability to safely and systematically capture and retain the information in a manner that can quickly be recalled to satisfy litigation or industry-specific regulations.”

Compliance in India

Analysts and vendors believe that although there is real awareness regarding compliance in India, the market is still in its infancy and should develop strongly in the next year and a half.

“If we look at the global figures, approximately one-third of the total spend on compliance involves IT spending. In India, such figures vary based on a number of factors, out of which the most important one is the nature of the industry. The BFSI, ITES (such as BPOs, KPOs, Call Centres) and telecommunications industries are typically more regulated ones and therefore their IT investment on compliance is more, compared to other industries. There is substantial IT investment in services, hardware and software as far as compliance is concerned,” concludes Krishnan.