Role Up-Role Up

At the recent European ID conference Tim Cole from Kuppinger Cole gave a presentation detailing a consultative checklist to be used when procuring an automated compliance tool. Tim suggested a tool must meet the following criteria:

• Policy Based
• Process Driven
• Comprehensive
• Localised
• Dashboard View
• Ex-post Analysis (logs etc)
• Real Time
• Highly Reactive
• Actionable
• Tamper-proof

All really logical, the one checkpoint I do have an issue with is “comprehensive”. Can any tool be comprehensive when we look at compliance documents such as CoBIT or ISO 27001. I guess not, better wording may have been “fit for purpose”. At a vendor panel after Tim’s presentation we discussed Compliance Automation, as you would expect all the vendors agreed that no one solution would meet all compliance requirements, unfortunately there is not a black box that plugs into the network and makes it compliant (I doubt there are any combination of 5 tools that could do this). When we look at comprehensive in Tim’s checklist we need to bring it back a step and address controls or sets of controls, rather than the issue of compliancy as a whole.

I recently attended a presentation by Klaus Thelemann from the Partner Advisory Services at E&Y. Klaus gave an extremely well informed talk on the upcoming changes to the EU compliance legislation. The crux revolve around the changes that are being made to the 4th, 7th, 8th and the transparency directives. Some of the more interesting points are within the 8th directive, this basically states that all companies of public interest are required to conform, previously EU companies have been able to d-list from the US stock market to avoid SOX compliance. Moving forward, the d-list tactic will not allow the majority of EU organisations to escape their compliance commitments.

So, compliance is going to hit Europe in the same way that it has hit the US. It will not be an overnight process as there are still many points to get ratified centrally within Europe, it is envisaged that this process will be completed and passed as European law by the end of June 2008. Post that date, member states will have  to pass the EU legislation as law in their own countries. If the law follows similar a process to SOX I guess companys will have a few years to show they are fully compliant before anyone gets prosecuted.

It sounds like a long time, but in reality most organisations are already looking at compliance at various levels. Within the EU, I do not think we will see the rush to achieve compliance that the US has witnessed. A high percentage of large company’s, especailly within the UK have already adopted or are adopting a strategy that involves Corporate Governance.

The “GOTCHA” in this are the companies of public interest, these may not and will not in many cases be the large corporates. Even the smallest of companies could fall in to this category, as will public sector organisations. Compliance does not come cheap, multi-nationals will be able to absorb these costs with very little impact on Joe public, but SME’s will have no choice but to pass these costs on…to us.

Bit of a personal dilemma, I welcome the extra business that compliance should drive but are not looking forward to paying for it.

I guess its well recognised that the UK are about 12 to 18 months behind the US when it comes to the up take of technology, my colleague Brent Thurrell and I had a lengthy discussion around this topic with a customer  last week. The UK’s lagging can be clearly highlighted when you look around at the number of UK companies embarking on IAM projects, to say the least it’s been limited. The drivers to deploy the technology and reap the benefits are not the same; excluding US listed organisations we do not have the dreaded SOX as a driver in the UK. It would appear that is about to change.  

The EU has tabled its Capital Requirements Directive (CRD), which is the EU’s transposition of Basel II into European law. It will become effective in each country once every EU member state has ratified CRD into its own national legislation. Ratification of the EU’s interpretation of the Basel II framework in the CRD directive means that financial institutions must comply with its rules by 2007, or by 2008 for the most advanced set of internal risk ratings provided.

 Although many financial institutions put their plans for complying with Basel II on the back burner while the accord’s effective date was in question, the impending ratification of CRD means that compliance strategies have been brought back to the budgeting table - for European companies at least.   

Pure speculation at the moment but this may happen as soon as April, for those in the IAM space in the UK, we should find ourselves a whole lot busier. Bring on the legislation……. 

For those that are interested this link is worth a read http://www.it-director.com/business/compliance/content.php?cid=8031