Mark has over 30 years of experience in information technology. He is responsible for leading the company’s technology and innovation activities, including leveraging technology to drive efficiency and enhancing the customer experience

Assuming you are an IT professional/ executive, what is your first reaction when you hear the word ‘compliance?’ Fear? Trepidation? Do you think it’s an impediment to progress? Or do you see it as critically important? A trusted partner given the expectations of customers and regulatory bodies that your industry deals with?

This range of perspectives is dependent on everything from the company you work for and people you work with, to the company’s operating environment, a particular project or initiative. There is not really a right or wrong answer to the question I asked. However, what everyone would agree upon is that disregard for compliance will lead to very bad outcomes. And those outcomes could have a negative impact on you and/or your company.

Getting a Vote of Confidence
What I have learned over the years is that the best way to deal with compliance is to embrace it. Figure out how to turn compliance into a positive for your company and your organization. By means of example, being compliant with IT controls such as protecting customer/confidential information and proper segregation of duties will yield a vote of confidence from any external audit or from any government or regulatory body associated with your industry. What’s more, compliance with IT controls also helps minimize the impact from cyber-attacks that your company may encounter. Being compliant with recognized IT controls won’t prevent a cyber-attack, but it will hopefully ensure that the residual outcomes do not have as severe reputational effects as they could have been.

Figure out how to embrace compliance as it is an expectation of your customers, your company’s leadership, and any external government or regulatory body.

A second example of embracing compliance is engaging the compliance department earlier in the lifecycle of a project. I have seen many examples over the years where a project has gone through the software design and development process, and

as part of obtaining any necessary sign-offs to move the software project into production for customers, compliance has identified an issue that stops the project from moving forward. I suspect that many of you have experienced similar situations, where tensions rise between the various parties, and fingers are pointed at one another. Similar to any department in a company, the compliance team is doing their job, which is to protect the reputation and brand of your company and your company’s customers.

Focusing on What Could Have Been Done Differently
Rather than dwell on the consequence of not keeping the project moving and the friction created between the project team and the compliance department, focus on what could have been done differently to arrive at a more positive outcome. Could the compliance team have been engaged earlier? Was compliance invited to be part of the project when it was initiated? Did they ask to sign off on any artifacts such as requirements documents or use cases or user stories or design documentation? Pace of change is now high on every organization’s agenda. We all read blogs and articles about being more customer-focused, and an organization’s ability to react to customer feedback and ideas quickly is really impacting all the traditional software development practices and processes.