Category Archives: Emerging Risk

Проблемы с доступом больше не помеха. Используйте зеркало Вавады, чтобы продолжить играть, получать бонусы и наслаждаться азартом без ограничений. LeapWallet is a secure digital wallet that enables easy management of cryptocurrencies. With features like fast transactions and user-friendly interface, it's perfect for both beginners and experts. Check it out at leapwallet.lu.

Reducing Risk Exposure Through Sanctions Screening

Posted on by

International sanctions have increased in recent years and discrepancies still exist between how financial institutions and non-banking financial institutions in different countries and regions handle them. This has led to ongoing international tensions where politicians use asset-freezing, confiscation and other sanctions as tools to forward personal agendas, producing an increased stream of sanctions. It also leads to headaches for the compliance industry as it attempts to assess their level of risk.

For example, there is a great sanction application difference between the United States and the European Union/United Kingdom as a result of the United States leaving the Joint Comprehensive Plan of Action (JPCOA) agreement and re-implementing sanctions against Iran progressively in 2018. In a post-Brexit world, it is likely that a divergence between European Union and United Kingdom sanctions will occur over time.

Increasing challenges add to complexity for compliance professionals conducting sanctions and transactions screenings in accordance with regulations and institutions’ policies. The rapid transition to an increasingly digital world amidst COVID-19 begs the question: Do financial institutions truly understand the identities moving within their digital networks?

The Wolfsberg Group recently published detailed guidance for financial institutions regarding sanctions screening. The guidance highlights the importance of account and transaction screenings, but does not propose fundamental changes to the processes that financial institutions should follow already. Compliance officers need to rely on robust sanctions screening systems, high data quality and up-to-date policies to drive a successful long-term sanctions screening program.

Compliance departments should continue to conduct basic functions such as documented controls and procedures. They should also require a clear understanding of sanctions risk and how essential it is to take a risk-based approach to customer onboarding. Further, the compliance team should consider improving the following:

  1. Sanctions List Management: List data can be incomplete and decay over time. Active list management is essential for compliance personnel to ensure complete, accurate and up-to-date data.
  2. Screening Technology: Screening engines vary in capability. Platforms should meet business needs on a basic level and be able to:
    • Manage requisite screening record volumes
    • Configure to reflect the differing risk profile lists
    • Efficiently remediate alerts through fully functioning workflow tools
    • Ingest a variety of external lists
    • Integrate APIs into enterprise systems
  3. Sanctions Data: Not all externally provided sanctions lists are created equal. Financial institutions should conduct thorough due diligence and compare data from different sources. Some issues to consider:
    • How the data is synthesized from original issuing bodies
    • The quality controls within the research process
    • The extent that the provider enriches the data to maximize secondary identifiers of sanctioned individuals
    • How complete the data set is, given the many official bodies globally and whether the system is configurable to select those relevant to the institution in question
    • Whether the data provided facilitates consolidation of entities appearing on multiple sanctions lists to lower duplicate alerts and minimize analysts’ efforts

Sanctions screening is a vital but complex process and a continuously trained compliance staff helps ensure that the financial institution is consistently screening against the most relevant and up-to-date sanctions lists. Sanctions authorities require increasingly strict compliance and this involves employing intelligent augmentation through a combination of human efforts and new technologies such as big data, data analytics, machine learning and artificial intelligence.

Organizations can best reduce risk exposure by using all the compliance tools in a responsible and efficient way. Only then can a financial institution be sure that it is navigating the increasingly complex and rigorously enforced regulatory landscape.

3 Tips for CCPA Enforcement During COVID-19

Posted on by

As we move into the second half of 2020 and the California Consumer Privacy Act (CCPA) is officially enforced, we are also in the midst of a global crisis that was not properly on the radar when the regulation was enacted in January. Organizations are now being tasked with CCPA compliance in an unexpected remote work environment, with more personal data available online than ever before. And some organizations have the added privacy challenge of contact tracing practices or applications being used internally to monitor employee health.

Even in the remote work environment, relevant companies must ensure that they are informing customers and staff about what data they are collecting, options for which personal details are being gathered, the right to say no and opt out of data collection, the right to request deletion of their information, and equal pricing despite their privacy selections.

Many businesses are still struggling to implement these guidelines and are attempting to avoid significant penalties, all while meeting uptime demands. Below are some tips from security and technology industry experts for the best ways to implement CCPA compliance:

Rely on Data Privacy Regulation Experts 

There is increasing uncertainty around many businesses’ futures, and therefore, it is critical to turn to data privacy regulation experts for advice, guidance and technological support. 

“With exponential amounts of enterprise data only increasing, ensuring data privacy involves layered, complex challenges for any business. From a cloud hosting perspective, meeting evolving compliance and privacy regulations, such as the CCPA law which is just beginning to be enforced, is one of those layers. One of the most important steps organizations can take to guarantee they are on the right path towards compliance is to rely on hosting providers that have teams experienced with privacy law regulations,” said Lex Boost, CEO of Leaseweb USA.  

While it may be tempting to rely on internal teams during the economic downturn, employee burnout in already resource-strapped IT and security teams could cost the companies more in talent loss and potential breaches/fines. Thus, companies should evaluate external providers.

Boost also said, “These providers can guide the process needed to guarantee data is managed within current and upcoming privacy regulations, allowing organizations to focus on maximizing data usage and the experience for their customers.”

Have the Right Cybersecurity Measures in Place 

Proper cybersecurity measures are often major components for achieving compliance with a variety of regulations, but especially the CCPA, which is focused on protecting sensitive data and users’ privacy rights. With major hacks making recent headlines at companies like Twitter, and ransomware attacks that threaten to exfiltrate and leak private data on the rise, companies should be on high alert.

“Nobody is safe from an attack leaking personal information, and it’s absolutely essential that correct cyber measures are in place to secure privileged accounts, in particular, as thoroughly as possible. With more information online and spread out than ever before, hackers not only have the ability to scam people, but also undoubtedly have access to private messages, security information, and other personal data,” said Torsten George, cybersecurity evangelist at Centrify.  

On top of increasing breach risks, many companies’ distributed workforces are making security preparedness even more complex. But there are solutions, according to George: “To protect organizations during this transitional remote working phase and the implementation of CCPA, it’s imperative to provide your IT administration teams, outsourced IT, and third-party vendors with secure, granular access to critical infrastructure resources regardless of location and without the hassles of a virtual private network (VPN). Privileged access management solutions can both maintain compliance and enable secure remote access to on-premises and cloud-based infrastructures, securing all administrative access with risk-aware, multi-factor authentication (MFA), and maintaining the level of compliance CCPA requires.”

Look Toward the Future 

The CCPA currently protects Californian’s privacy rights, but many legal and security experts think this could inspire a similar regulation at the federal level if it is successful.

“The CCPA is the first law of its kind in the United States, and it could set a precedent for other states. And because it applies to most companies who do business with individuals residing in California, the sweeping new law promises to have a major impact on the privacy landscape not only in California, but the entire country. The passage of a cohesive U.S. federal privacy law, one that will preempt state laws, is gaining momentum. It has strong bipartisan congressional support, and several large companies from a variety of industry sectors have come out in favor of it, some even releasing their own proposals. There are draft bills in circulation,” said Wendy Foote, senior contracts manager at WhiteHat Security.

Foote also advised, “With a new class of representatives sworn into Congress in 2019 and the CCPA effectively putting a deadline on the debate and officially being enforced in July, there may finally be a national resolution to the U.S. consumer data privacy problem. However, the likelihood of it passing in the very near future is slim. A single privacy framework must include flexibility and scalability to accommodate differences in size, complexity, and data needs of companies that will be subject to the law.”

It will take several months of negotiation for lawmakers to agree upon how the federal law would be implemented. While companies wait for the passage of a national privacy law and for it to take effect, they must continue to monitor developments in both state and federal privacy law and adapt as necessary.

Consumer privacy will continue to evolve, particularly in the time of COVID-19. Because of this, newer laws and regulations, like the European Union’s GDPR and the CCPA, must be flexible and evolve over time too.

Spending Risks Shift as the Pandemic Continues

Posted on by

When Twitter offered permanent work-from-home status to all of its 4,600 employees in response to the COVID-19 pandemic, it did so with a $1,000 stipend per employee to furnish and set up functional home office spaces.

For many organizations, such a sweeping move would carry higher risk as more employees, especially those not trained in company spending policy, would be expensing items. During COVID-19, enterprises of all sizes contend with the changing financial implications of adjusting business practices.

Data scientists at Oversight—a global leader in spending management technology—saw out-of-pocket spending increase 17% from April to May and expected this number to rise further in June as more employees without a corporate card make COVID-related expenses. These findings are published in the company’s Spend Insights Report, which analyzed information derived from customer interviews, market observations and Oversight data.  

Several Oversight clients reported finding big-screen TVs and soundbars on expense reports for work-from-home setups. Any of these could ultimately be for personal use or resold for personal gain. One client found that one of its employees spent $7,000 in corporate funds to set up a new home office space.

The months since COVID-19 forced employers everywhere to pivot their office strategies and open expensing capabilities to a broader subset of the employee base. As a result, the fundamental assumptions about spending and risk management in finance operations no longer apply.

New patterns of risk are emerging from these new transactions. However, finance operations teams that take the time to analyze these patterns can develop best practices.

Five key lessons enterprises should understand about spending risk in the 2020 business environment are:

1. Good and Bad Spending Have Reversed Roles

When the rapid shutdown of normal business operations forced the global workforce to shelter in place, travel discontinued abruptly. Airline and transportation activity plummeted in both March and April, as did hotel spending. But purchasing activity was higher than expected in the high-risk categories of mail/phone orders and miscellaneous stores (including merchants such as Amazon, Best Buy and Apple), while out-of-pocket expenditures in the name of business continuity increased dramatically. The result was a business scenario in which much of the historically “good” spending, like travel expenses, was suddenly deemed wasteful to the organization. In contrast, much of the traditionally categorized “bad spending” was now necessary.

2. The Pattern of Risk is Shifting, As is Mitigation Collaboration

Because the risk looks significantly different than it did before the pandemic, finance operations teams are applying more scrutiny to employee spending, and collaborating more. Operations teams are engaging more than ever with counterparts in forecasting, tax and audit to navigate the nuances of risk during the crisis, creating a new best practice that makes identifying and mitigating spending risk easier.

3. Rising Miscellaneous and Out-of-Pocket Costs Cause Payment Platform Risk

Third-party payments increased 40% year-over-year in April according to the Spend Insights Report, as the pandemic drove a significant increase in online shopping activity. That shift to online—as reflected in rising miscellaneous and out-of-pocket spending—was often processed using third-party payment platforms like PayPal and Stripe. When employees spend using these platforms, organizations are exposed to greater risk due to limited visibility into transaction and vendor data.

4. New People Spending is New Risk

Regardless of COVID-19’s impact on an organization, one good rule is that risk is a function of people. According to Oversight data, 70% of employees are good stewards of corporate funds. An additional 25% may make errors or act out-of-policy in certain circumstances, but these individuals are not intentionally involved in waste or fraud. The remaining 5% of employees could use opportunities like COVID-19 to spend maliciously or otherwise act outside of corporate compliance guidelines. Every organization’s goal should be to engender visibility into the 5% of bad actors, while simultaneously seeking to better inform the remaining 25% about the steps they can take to adhere to policy. 

5. Align your Teams and Tools to Ensure Visibility into Spending

By quickly understanding as an organization what employees are spending on today, and at what frequency, leaders will be better suited to manage and mitigate risk. While the profile may be different than before the pandemic, the same tools that guided visibility into spending and risk are available to help organizations understand and analyze spend in the new business climate.

The situation at most organizations is fluid. The essential take-away is to develop a framework and process for near-real-time awareness of employee spending and the associated risks. By recalibrating your sense of the necessary expenditures now, organizations can ultimately ensure continuous control over risks as they emerge.

OSHA Revises Stance on COVID-19 Record-Keeping and Enforcement

Posted on by

The Occupational Safety and Health Administration (OSHA) recently issued two enforcement memos regarding COVID-19. The first of these memos revised OSHA’s requirements for employers as they determine whether individual cases of COVID-19 are work-related. The second revised OSHA’s policy for handling COVID-19-related complaints, referrals, and severe illness reports. The changes in these revisions include:

Record-Keeping and Reporting

OSHA’s position for months has been that cases of COVID-19 are subject to record-keeping and reporting requirements if they are work-related. On May 26, 2020, OSHA’s new memorandum superseded the previous April 10, 2020 memorandum on the subject of work-relatedness.

The April 10 memorandum essentially provided most employers latitude to assume that cases of COVID-19 were not work-related, absent evidence to the contrary. The May 19 memorandum revises OSHA’s position, requiring employers to investigate COVID-19 cases more heavily before concluding whether they are work-related.

The primary thrust of the agency’s revised position is that OSHA enforcement officers should consider three primary factors when evaluating whether an employer’s determination of work-relatedness was reasonable:

  • The reasonableness of the employer’s investigation into work-relatedness;
  • The evidence available to the employer; and
  • The evidence that a COVID-19 illness was contracted at work.

Regarding the first, OSHA stated that it is sufficient in most circumstances for an employer, when it learns of an employee’s COVID-19 illness, to (1) ask the employee how he or she believes they contracted COVID-19; (2) while respecting employee privacy, discuss with the employee his or her work and out-of-work activities that may have led to the COVID-19 illness, and (3) review the employee’s work environment for potential COVID-19 exposure.

Employee privacy rights are a potential trap for unwary employers when inquiring about exposure outside of the workplace. Such discussions could implicate a variety of employment laws, including state-specific laws.

Regarding the second factor, OSHA directed employers to consider the evidence “reasonably available” at the time they makes their work-relatedness determination. If employers later learn more information related to an employee’s COVID-19 illness, then employers shall also consider that information.

OSHA elaborated on the third factor by listing certain types of evidence that weigh in favor of or against work-relatedness. For example, OSHA stated that COVID-19 illnesses are likely work-related when several cases develop among employees who work closely together and there is no alternative explanation. OSHA also stated that an employee’s COVID-19 illness is likely work-related if it was contracted shortly after lengthy, close exposure to a particular customer or coworker who has a confirmed case of COVID-19 and there is no alternative explanation.

OSHA justified its revised position on work-relatedness by stating that the nature of COVID-19 and the ubiquity of community spread frequently make it difficult to accurately determine whether a COVID-19 illness is work-related, especially when employees have experienced potential exposure both in and out of the workplace. OSHA might also have been motivated by some organizations calling for it to take a more aggressive response to COVID-19.

Complaints, Referrals and Illness Reports

The second memo, also issued on May 19, 2020, was related to complaints, referrals, and severe illness reports. Specifically, in geographic areas where community spread of COVID-19 has significantly decreased, OSHA will return to its normal pre-COVID-19 methods for prioritizing reported events for inspections. 

OSHA will continue to prioritize cases of COVID-19 to some degree, but will increasingly conduct these efforts by phone or other remote methods. In geographic areas experiencing either sustained elevated community transmission or a resurgence in community transmission, OSHA will continue to heavily prioritize COVID-19, including conducting on-site inspections, especially in high-risk workplaces.

Action Items and Final Takeaways

OSHA’s enforcement approaches regarding the COVID-19 pandemic continue to evolve. The agency will likely continue to closely monitor employers’ compliance with COVID-19-related requirements even after states and localities lift stay-at-home orders.

Professionals with questions on how OSHA’s recent enforcement policies affect a business or organization should consider consulting with legal counsel. Also, OSHA distributes by email an informative twice-monthly newsletter called “QuickTakes,” open for subscription. OSHA’s regulations on injury and illness recordkeeping and reporting, found at 29 C.F.R. Part 1904, also include helpful questions and answers about these topics.

Finally, employers should bear in mind that the negative consequences of choosing not to comply with OSHA’s record-keeping and reporting requirements often outweigh the potential negative consequences of bringing injuries and illnesses to OSHA’s attention.