DeJean
REGULATION: Which new regulations will occupy your time in 2004? How do you plan to deal with issues like Sarbanes-Oxley, Basel, 17a-4, Patriot Act and BCP?
Ira Lehrman
The main areas of legislation are: Basel II, Sarbanes-Oxley, BAFin, and other regional data protection and retention laws.
These pieces of legislation have common themes such as control, security, accuracy, accountability, and the need to protect data supporting the above. The challenge is to give us a level of technical sophistication to react to the ever evolving and demanding compliance and regulatory environments.
We have been deploying a set of business services to provide a global platform for the creation, retention/storage, distribution and management of all businesses' digital assets to solve the regulatory and compliance issues around managing this data.
Timothy Theriault
All of the areas you asked about are important for us to address. What is REALLY important for us - is making these regulatory initiatives work by embedding them into our operating model. Like business continuity, it has to be part of our operating model, not an exercise to conduct when necessary.
For Basel, our operating risk metrics need to be created from systems which are integrated into the operating systems - not a stand-alone system.
Richard Rosenblatt
We will be taking a fresh look at our approach to 17a-4 and BCP. Rather than continuing to develop and implement in-house solutions, to the extent possible we are looking to outsource. In the past this was not our first choice, but for a company of our size outsourcing is often more cost effective than implementing an in-house solution. We will also look to reduce the number of tools used in support of the new regulations and consolidate where appropriate.
Robert Palatnick
All of the above. The answer to this question could take volumes. BCP is an enormous initiative, which requires continuous improvement. Sarbanes-Oxley has huge IT implications, minimally to support business aspects of the act, but also in terms of the audit of control requirements which hits technology, and especially the implementation of information security across the board. The same applies to the risk assessment implications of Basel II. In terms of data retention (17a-4), the basic standard has been set and corporate standards written, but the devil is in the implementation. How do you store, index, categorize and retrieve VoIP digital conversations?
Tweet This