Introduction
Modern organizations are subjected to an increasing amount of compliance regulations and requirements. In parallel, the high volumes of information and records organizations need to maintain continues to spiral out of control, and businesses continue to store content in silos across several different systems and repositories. While digitization of information has simplified manual compliance practices in some ways, the accumulation of systems and content weaves a complex web that needs additional tools for effective management.
Herein lies the challenge: how can organizations effectively comply with increasingly complex laws and regulations and ensure proper information governance with so much content sprawled across so many different systems?
This blog looks at the history and challenges associated with ECM compliance, explores the limitations of ECM systems when it comes to managing corporate compliance, and discusses how a novel approach to document viewing can help address these increasingly complex challenges.
Systems, Systems, Everywhere
Enterprise Content Management (ECM), Document Management (DM), and Records Management (RM) systems, among others, have offered responses to this challenge with solutions to help automate and streamline compliance processes and information governance. Still, organizations face new pressures that make it harder to deliver effective compliance management, including the need to address the spiraling volumes, content scattered across the organization in growing numbers of disconnected information silos, and newly emerging regulations such as GDPR and CCPA.
As the needs of organizations and user expectations continue to evolve — only exacerbated by the rise of the remote enterprise — effectively managing compliance via a single ECM solution is no longer realistic. Users need fast access to content when and where it’s appropriate to their task, and compliance managers face the challenge of properly securing that content for staff, suppliers, and customers alike.
However, according to a recent AIIM report, modern organizations are losing the battle against this information chaos. Their data governance practices have yet to catch up with the speed and volume of data being collected and generated.
Luckily, effectively managing compliance doesn’t have to involve stripping away an existing, multi-system infrastructure or adopting yet another third-party system to try and control the chaos. By rethinking something as simple as how documents are viewed, organizations can provide a single point of access to any content, regardless of where it physically resides, and compliance managers can consolidate security controls and requirements into one centralized view. This modern approach to content viewing can simplify the labor involved with managing evolving compliance requirements on each independent system.
A Brief History of Compliance
Conversations around data compliance have increased over the past several years with the rollout of new regulations such as GDPR bringing data compliance back into the public eye. In reality, companies have been navigating the complex and constantly evolving world of privacy laws for some time. We’ve all seen the headlines in the media concerning corporate giants like Enron and Siemens for issues of non-compliance and governance failures. Still, to understand the challenges organizations face when it comes to meeting compliance standards, we must first understand what compliance is and how regulations have evolved from public initiatives to protect consumers in the early 1900s into the complex rules imposed on organizations today.
According to the International Standards Organization (ISO), regulatory compliance means following all the laws, regulations, standards, and policies that apply to a particular business. These may be established in legislation or statutes or in frameworks that a company has agreed to — such as the conditions of a financial services license, for example. As outlined by the 2010 Federal Sentencing Guidelines Manual, every organization must have an effective compliance program regardless of scope or industry. However, regulations have become so complex that large organizations often have entire departments allocated to these efforts as the cost of non-compliance is three times greater than that of an effective compliance program.
Compliance: The Origins
Compliance began as a means to protect consumers and define governance over public safety concerns at the outset of the 20th century. The first regulatory guidelines of the Food and Drug Administration (FDA), for example, began in 1906 with the enactment of the Pure Food and Drugs Act to provide basic protection to customers. Organizational governance as we know it today began to emerge in the 1950s and 60s when capital growth in the US brought to light the necessity of compliance programs not only in society in general but also within organizations.
The 1970s Foreign Corrupt Practices Act and the creation of entities like the Environmental Protection Agency (EPA) and Drug Enforcement Administration (DEA) led to a shift in the structure of compliance programs from public initiatives to internal functions within organizations. In the 1980s, industry-wide initiatives urged the government to create guidelines for creating, adopting and implementing ethical practices, which meant it was the contractor’s responsibility to ensure ethical business practices on behalf of the government.
Compliance Today
The 2008 financial crisis changed the face of corporate compliance as we know it today when global financial giants’ compliance failures spurred over $300 billion in fines and losses. And this was only the beginning. Recent McKinsey research indicates that most senior managers feel more comfortable with their credit-risk management than compliance risk due to the newly emerging and ever-evolving nature of compliance standards.
The emergence of the new regulations such as the General Data Protection Regulation (GDPR) regulations of 2018 in the EU or California Consumer Privacy Act (CCPA) enacted in early 2020 has brought data compliance to the forefront once again. These laws require organizations to control where and how customer data is stored. Businesses must obtain prior consent if they want to get any kind of personal data from users. Failure to comply with user requests can result in steep fines and reputational damage. The risk of these repercussions has pushed companies to become more serious about data security and information governance, but navigating these changes and ensuring the appropriate security measures are in place across all corporate and customer data is a never-ending battle for organizations.
Challenges with Compliance
With the continuous growth of information only exacerbated by the emergence of Big Data, organizations are struggling to manage the sheer volume of data that is generated and processed in modern business. This, in turn, impacts control, security, productivity, and overall organizational performance and increases the risk of failing to comply with applicable regulations.
If you, like many organizations, are struggling to find or implement the right systems for successfully managing data compliance, chances are you’ve encountered one or more of the following challenges with managing security and compliance.
- Keeping up with regulatory change: As existing regulations are revised, and new rules and policies emerge, organizations must continuously work on updating their compliance processes and ensuring that all requirements are respected.
- Disconnected systems: With information living in silos across disparate systems and repositories, the technology used to manage that information and carry out responsibilities is often disconnected. This makes it difficult to effectively manage compliance processes across business lines, functions, and information locations.
- Manual processes: Today’s organizations aren’t yet immune to manual processes. But using spreadsheets and shared files to accurately manage compliance and manually update every spreadsheet in every location to accommodate constantly changing regulations is time-consuming and prone to human error.
- Incomplete Reporting: With so many disconnected systems, reporting often becomes a painful patchwork process of manually pulling information from each system. Without advanced analytics or automation technology, this is time-consuming and error-prone, with information that only speaks to the past.
- Audits and Monitoring: Identifying inconsistencies or potential errors in compliance processes is next to impossible without a consolidated view over all compliance-related activities. The result? Errors can easily slip through the cracks.
For more on challenges with ECM compliance, read our blog, 5 Challenges with Using ECM to Manage Corporate Compliance:
Types of systems used to address compliance
With modern organizations operating multiple systems containing high volumes of structured and unstructured data, ensuring proper governance of that data is as challenging as it is vital. Establishing a consolidated view of that data in a single repository with standardized formats helps compliance officers centralize compliance-related activity and monitor and audit those activities more easily.
Information management systems such as Enterprise Content Management (ECM), Document Management (DM), and Records Management (RM) systems have offered some relief in the uphill battle with information governance and data compliance.
Using ECM to manage compliance
ECM refers to the technologies used to capture, manage, store, preserve, and deliver content and documents related to organizational processes. ECM tools and strategies allow the management of an organization’s unstructured information, wherever that information exists. ECM solutions can help cope with the ever-increasing volume of information organizations manage, improve operational efficiency and access to critical content, and address quality and compliance activities and requirements.
ECM solutions can alleviate some of the weight on compliance managers by centralizing data governance and user access controls and facilitating audits and other compliance requirements. When properly managed, ECM solutions provide a cost-effective alternative to traditional physical storage solutions and an ability to develop improved business processes for document and data lifecycle management.
Centralized control of content
Having the ability to search and find documents easily is crucial to ensuring compliance and protecting your business. With content located on cloud servers, locked in silos on legacy systems, or physically stored in numerous onsite and offsite storage facilities, applying the necessary security controls to comply with regulations is next to impossible. Legacy storage technologies have struggled to respond to the changing demands of content and document archiving and are susceptible to complete data loss.
ECM solutions provide a way to search and find documents from a central repository, so your compliance team can quickly find the information they need and implement the appropriate security controls. Not only is it easier to locate important documents that prove compliance, but ECM systems are often equipped with built-in security controls. With a centralized view of content, compliance managers can more easily apply security rules across all enterprise data.
Complete audit trails
Oversight is a critical part of any security or compliance plan. When implementing security controls, organizations need the appropriate reporting tools to ensure they can spot abuse or irregular usage patterns of a malicious invader or unintentional misuse by staff. Modern ECM solutions are equipped with complete audit trails. Every time users access, view, edit, or act on a document, the action is recorded in an audit log that managers can easily view.
These audit trails ensure maximum transparency, enable faster detection of future problems, and enforce accountability on any changes made to content or files.
Access control and user permissions
One of the key benefits of ECM solutions is that they offer greater control with authorized access to data. Gone are the days of lost or stolen files that wind up in the wrong hands–with content in digital format governed by access controls, organizations can set the appropriate permissions for employees who need access. For example, in a human resources department, some employees may need access at the folder level or down to the specific document type. HR can govern how their staff has access, ensuring management’s peace of mind and employee confidentiality protection.
By allowing line managers to define the relevant security controls, ECM solutions ensure that documents and records are accessible only to those who need them. Employee data, financial data, customer documents, and other sensitive content can be kept in a single repository without worrying about unauthorized access.
Records management: automation and preservation
Having the right ECM solution enables business and compliance leaders to centrally manage and archive critical information based on specific business needs, lifecycle requirements, and retention policies. This helps ensure that the right content is stored in the right location for the appropriate amount of time and with the proper security controls.
Most business content has a limited lifetime, after which point it either must be destroyed for compliance reasons. ECM systems allow policies to be set to determine the lifecycle of specific document types. The system stores content for the required length of time and continuously regulates when out-of-date documents can be deleted. With ECM, and by understanding what business information is essential for regulatory compliance, the appropriate classification and retention policies can be put in place to manage both the lifecycle and destruction of data.
Why this isn’t enough: continued challenges with ECM compliance
But as the amount of content organizations store and manage continues to grow, relying solely on ECM systems to control compliance and information governance can leave gaping holes in corporate security protocols. Compliance officers could be left scrambling to fill the gaps, or worse, putting your organization at risk for non-compliance.
Inevitable use of multiple solutions
According to an AIIM study, 52% of organizations have three or more Enterprise Content Management (ECM), Document Management (DM) or Records Management (RM) systems and 22% have five or more of these systems. From accounting software, human resources management platforms, or CRM, these solutions generate and store data in silos, making it nearly impossible to have a global view of all enterprise content, and making it difficult to access or control content throughout its entire lifecycle.
And these trends don’t appear to be going in a favorable direction.
In the wake of the current global situation with more organizations deploying remote working solutions that involve new and disparate systems, these ad-hoc deployments may be putting organizations at even greater risk of fractured governance if not accompanied by the appropriate compliance strategy.
Per a recent "2021 Audit Plan Hot Spots Report" by Gartner’s Audit Leadership Council:
"As organizations rapidly scale their remote work capabilities and deploy new technology, IT capacity is increasingly strained. … Organizations’ data governance practices have yet to catch up with the speed and volume of data being collected and generated. Data environments are also becoming more complex, increasing the likelihood of duplicated effort and compromised data security. … Organizations are still struggling to successfully implement and enforce data governance frameworks. As they accumulate new types of data and rely on fragmented storage systems, they are more exposed to regulatory, ethical, and data security risks."
Growing amounts of content and file types
Users need fast access to information on demand, and organizations have responded by enabling new systems or building custom applications to accommodate those needs and support growing amounts of content. This content sprawl is a compliance officer’s nightmare. While managers may leverage the built-in security features offered by ECM systems, ensuring enforcement of those measures across each disparate system is no easy feat. And beyond the content stored in those systems, there are other considerations like business applications built on those systems or business processes relying on the underlying content services.
Without a centralized solution to consolidate the siloed parts, users may continue to share sensitive corporate or customer information in unsecure ways, leaving organizations vulnerable to security breaches. According to AIIM, file shares are still in widespread use among 52% of companies with at least one ECM system in place.
Not to mention, content formats vary according to the nature of the content and the system within which it lives. Be they Microsoft Office files, PDFs, Zip, Png, CAD, MP4, or other formats, both users and compliance managers need easy access to all types of content, regardless of format.
Modern organizations need a solution that offers fast, easy access to information stored in any business system or application and ensures maximum protection of sensitive information. Compliance officers aren’t superhuman, and time is money. Finding a way to automate these controls and reduce the need for in-depth maintenance or oversight could be a game-changer for organizations of all industries.
Rethinking document viewing — a novel way to solve the compliance challenge
As we’ve seen, most ECM tools were not initially designed with information fluidity and ease of access in mind, and the move from a paper economy towards a digital economy has only complicated the challenge with new information flows generating vast amounts of data.
Viewing a document should be a simple task. Yet, according to CMSWire, employees can spend over 30% of their day looking for information due to fragmented information management, sometimes not even finding the desired file, or struggling to open or access it. This challenge however, is not the only one faced by users:
Native apps must be client-side
To access, work on, and share content, that content often needs to be downloaded in its native application — for example, Microsoft Word for a .docx file. If the solution in which the document transits does not allow direct viewing from its interface, the user has no choice but to download the document to their workstation, open it in its native application, save it to their workstation, and re-download it within the solution. This is a significant time suck.
Download times and costs are steep
With files getting larger and larger, downloads are taking longer and users are inevitably consuming significant bandwidth. The more bandwidth a user consumes and the longer they spend waiting for files to download, the higher the cost for the organization.
Low user adoption
These added inconveniences often push users to find workarounds that can be impossible to trace. Frustrated users will inevitably try to avoid losing time by making phone calls or sending emails, adding processes on top of existing processes that don’t work well. These ad-hoc information exchanges that only increase amounts of unstructured data are a compliance manager's worst nightmare.
Limited reporting = bad decision-making
Tracing and tracking so much unstructured data in various streams and systems is next to impossible, leading to decisions based on non-existent or faulty indicators. Content management is constantly evolving, and the perception that users have of content is also changing. Making the appropriate decisions to improve any service activity should not be left to chance–this is the challenge of optimized content management.
Security and compliance issues
Without control over content, how can that content be adequately protected? Customers, partners, external suppliers all need to know that their data is in good hands, but without controlled access to content, this protection can’t be guaranteed.
Customers need to know that their personally identifiable information (PII) and confidential corporate content remains secure when working with vendors or partners, just as business leaders seek to protect corporate information exchanged internally and managed by staff. With users frequently downloading content to their workstations, removing it from the native solution and then re-uploading, all information integrity is lost.
4 Ways to Strengthen ECM Compliance
Using a universal content viewer can help address compliance challenges that can’t effectively be managed with an ECM system alone. Adopting a single, web-based solution that sits on top of existing systems can allow easy access to content from any solution, in any format. This solution not only streamlines content access and prevents local downloads but also enables compliance managers to consolidate security controls and requirements into one centralized viewing solution.
Adopting a content viewer solution with built-in security and audit features can help strengthen compliance and enforce information privacy for staff, suppliers, and customers alike. All parties will rest assured that their information is treated with care, building trust and ultimately strengthening business relations. Below we detail four key ways that enhanced content viewing can strengthen ECM compliance:
Redaction uses sophisticated technology to intelligently identify and remove sensitive information from your documents. Manually searching for and removing social security numbers, credit card numbers, and other sensitive data across thousands of documents and multiple repositories can be time-consuming, labor-intensive, and prone to human error. Automated redaction can identify the kind of information that needs protecting upstream, saving compliance officers vast amounts of time, and protecting corporate and customer data.
Manage User Rights
Effective user rights management is critical to ensuring compliance and preventing unauthorized access to PII. Department managers must be able to effectively control user activity and keep sensitive data out of unauthorized hands. Centralized access controls allow admin to set restrictions to ensure that only authorized personnel have the right to do certain things—such as viewing or editing a document—while maintaining transparency for everyone.
Maintain Content Integrity
When dealing with sensitive corporate information such as financial data, legal data, or contracts, ensuring the validity and accuracy of that data is critical. Organizations need to trace all changes made to any document or record and assure the consistency of data throughout the entire document lifecycle.
With a web-based content viewer, the underlying file remains unchanged throughout its lifecycle. For example, one user may see a redacted version of a contract based on his/her viewing permissions, while another user may see a watermarked version of that same contract. In both instances, the underlying document is preserved in its original state. Any annotations or content redaction are overlaid on the original file, ensuring the integrity of that data at all times. Plus, these annotations are easily tracked with detailed audit trails and user activity reports.
Stream for Enhanced Performance
Web-based document viewer software allows content to be streamed rather than downloaded, so files can be opened fast, eliminating lengthy download times or storage challenges. Documents are rendered accurately without transmitting the original document to the user, removing security risks associated with users downloading and saving sensitive files. This also allows for greater document traceability and complete visibility into which pages have been read, downloaded, printed, and sent to or by another user. This is a game-changer for ECM compliance and for ECM in general.
To find out more about the benefits of using a content viewer, read our blog, Four Benefits of Using a Content Viewer to Secure Your ECM Solution:
The Future of ECM Compliance
According to the IDC, the amount of data created by organizations will nearly triple by 2023, with 80 percent of that data unstructured. Artificial Intelligence (AI) is increasingly leveraged to make sense of unstructured data and perform sophisticated analyses or even detect potential anomalies in information, thereby mitigating certain compliance risks. These advancements can further help cut costs associated with manual compliance practices and increase efficiencies in third-party risk management, giving employees and compliance managers more freedom to perform their jobs effectively.
AI offers opportunities to further automate compliance-related processes like redaction by automatically identifying PII and other sensitive data and using custom extractors to redact even the most challenging data without human intervention or configuration. These technologies can also help locate data with techniques specifically optimized for highly variable document formats, particularly in industries like finance and accounting.
Modern technologies like AI and Machine Learning have an unharnessed potential to increase efficiency and enable better collaboration between departments and other entities, which could have significant benefits for ECM compliance processes and beyond.
Conclusion
Managing compliance has been increasing in importance and complexity for many years. Growing data volumes, information silos, and an ever growing list of regulations make the management of information in a controlled, secure, and auditable manner harder every day. But there is light at the end of the tunnel.
By treating all documents in the same way, regardless of where they physically reside or what format they are, the negative impact of information silos and content sprawl is minimized, and maintaining vast volumes of information becomes a non-issue. The ideal remedy is a single viewing solution that can consolidate enterprise information access in one place, rather than having several solutions that lead to inconsistencies and security issues.
Adopting a web-based universal content viewer enables compliance managers to consolidate security controls and requirements into one centralized viewing solution while still allowing users secure access and sharing capabilities for content located in any system or application.
Administrators can define access controls and user permissions that will apply to any system the user may be working on, and establishing a consolidated view of all corporate or customer data helps simplify the labor of managing evolving compliance requirements on each independent system. Governing content from a single, central platform can also open up opportunities for additional, AI-based automation that can bring record management processes to new heights.
Can something as simple as redefining the way people view content really make that big a difference to overall corporate information compliance? Absolutely. But it won’t happen on its own — you need to make the decision to move towards a web-based, streaming, secure document viewing solution today.
