Hard-Boiled Compliance

Say What You Mean, and Mean What You Say

Aside from entertainment, there is no benefit to spin control, when running a compliance project. The reasoning is simple ... communication is the key, and spin control clouds communication.

Here's a sign I recently came across...

Here's their definition of "Modernization" ...

When running a compliance project ( or any project for that matter ), open and honest communication will make our break your success. Be sure to use clear language, and be honest in the communication above all. The above example isn't exactly a lie, but it's not what's really going on, is it?

Now, I know you could build a case, that when the project is over, the building will be more modern. This is playing games. The real impact to anybody in the building right now, is limitations due to construction happening, not modernization.

It's important to be real. I was once on a project, where the program office wanted to call the status of a project "orange", because the color "red" was unpopular. If it's red ... it's red. And if it's construction going on, just say it.

Where's the Flame?

As you may know, we are still going through a remodel. Here's my latest tale of woe.

We've been waiting forever to get our kitchen back. One of the first things our contractor decided to do, is demolish everything. For some rooms ( like the guest bedroom ) it's just annoying, but not having a kitchen really takes its toll.

Little by little, the kitchen has come to life. First floors, then cabinets. Then microwave, refrigerator, and dishwasher. But the other day was the most exciting ... the new stove was being hooked up!

The stove was a big deal, because we went from electric to gas. We had to run all new gas pipes from the outside, because a gas kitchen needs its own dedicated gas lines ( you cannot tee off any existing lines ).

So we spent a huge amount of time and money in getting the plumbing all set up. But, once everything was all set, we just needed the contractors to hook up the stove to the new gas line.

Well, the big day was an anticlimactic ( why be surprised at this point? )

Everything looked like it was connected properly, but when we went to fire it up -- no fire! You could hear the ignition trying to crank ( a rapid succession of "clicking" noises ), but nothing was lighting up. Then we checked the stove -- same story. A lot of "clicks" but no flame.

The contractors tried everything in an attempt to figure out what was going wrong. They pulled everything out, and disconnected everything again. Everybody was stumped until we went to the side of the house and discovered this ...

That pipe coming down the far right is our new gas line.

Do you see what it's connected to?

If you see NOTHING, then you're seeing what I saw. The plumbers managed to do all the plumbing, but never hooked it up to the gas source. So, now we have to wait until the plumbers can come back, before we have a working stove. Before that happens, the stove is just another place to put papers and tools.

I'll bet you've already guessed the moral of this story.

Actions are performed to produce a desired result -- that's the only reason. Don't mistake action for progress. A test case for this is pretty simple -- turn the knob and see if flames come out. You can do all the plumbing in the world, but if there's no fire, what's the point?

In Memory of Gary GyGax ...

This month saw the passing of a great mentor of mine, Gary GyGax.

For those of you who don't know, Gary GyGax was a co-creator of Dungeons and Dragons ( D&D ), and is considered the father of role-playing games.

Now before you write me off as some sort of geek, I'll have you know that Dungeons and Dragons in my neck of the woods was played by all. In fact, the "geek squad" ( who I knew pretty well ) were not the key people engaged, but the "stoners" ( who I also know pretty well ) happened to be big fans. We would often get into extended tournaments, that would last days.

Great memories :)

For Gary to come up with a concept like D&D was pure genius. Here's a game that had no board, no set "objective", and no real winner. It required an intense imagination, coupled with a sense for flushing out a scenario, and rooting it from a practical sense. For instance, you couldn't be a fighter ( even a paladin ), carrying 12 swords, 50 thousand gold pieces, full body armor, and a bunch of potions. A good Dungeon Master wouldn't allow it, because it's not possible. This is a small example of how D&D forced you to think.

Although I did some character development, my role in the neighborhood was primarily Dungeon Master ( DM ). That means, it was my responsibility to "create" the situation ( dungeon, voyage, etc. ) making sure the other players had a challenging, and entertaining voyage, with opportunities for others to build up their characters, and make sure that the game was fair and practical ( I can't say "realistic" -- because we're talking about dragons and magic here ).

I never met Gary, but I call him a mentor, because if it weren't for him developing this amazing game to play, I wouldn't have the skills today to do what I do. Gary's thought-child of D&D forced me at a young age to think creatively, pragmatically, and thoroughly about any situation. It also taught me about conflict resolution, team dynamics, and applied probability.

Gary also gave me some of the best memories of my life. Those were great times back then. The friends that you meet, and the stories that you can spin together as a group, are times that you cannot put a price on. The modules that you could buy were fun, but the best times came from the stuff that was created on the fly. My role-players rarely knew this, but as Dungeon Master, I would only have a vague idea of how the journey was going to go. I would start with a scenario, and see where the players took it. Of course I would have to be a step or two ahead of everybody, but that's about as far out as I would go. It was just as fun for me to find out how it ended -- and I was the one controlling the game!

I was deeply saddened at the news of Gary's passing. I cannot repay him for the influence he had on my life.

Gary, thank you from the bottom of my heart, for your contribution to my generation. Your ideas have made this world a better place.

Rhode Island Chronicles - Standardize to Globalize

Today, I leave Rhode Island for home. It was a short conference, but I had a great time!

During my stay, I "happened" to "need" to go to a Best Buy :)

Take a look at this picture of the Rhode Island Best Buy that I was in:

Have you ever been to the Best Buy near you? I'll bet it looks a lot like this!

This is not an accident. Companies like Best Buy realize the value of standardizing on the layout of their stores, as they roll out nationally or even globally.

One of the key compliance challenges that I hear from global companies, is managing the compliance across seas and borders. Standardization is the key to pulling this off. This is done by holistically assessing the risks and controls in each geography, and purposely exploring how to consolidate key controls.

The danger with standardization however, is when it impacts productivity, even slightly. The real challenge is achieving consolidated controls without negatively impacting the existing operation. The key to pulling this off, is just framing the objective this way.

Rhode Island Chronicles - Good Ideas Don't Always Mean Good Results

I just flew out of Oakland into Boston this morning, to attend a conference in Rhode Island tomorrow and part of Tuesday. Being that this is a long flight ( nearly 5 hours ), I thought I would be able to get a lot of work done. When I woke up after "dozing off" to hear the pilot say, "We are beginning our initial decent into Boston", I guess that idea went out the window! Well, obviously I needed the sleep more.

As I always do, I made sure to rent a car that had a navigation system. I got hooked on nav systems ever since I purchased my last BMW X5, which has built in navigation. At the time, I thought it would be a "cool option", however now I don't see how I ever got along without it.

So, when I showed up at the rental car desk, and made my request ( demand ) for a car with a nav system. The girl said, "Okay" then disappeared into the back room, and came out with a little blue bag.

This was a first for me -- a nav system in a little blue bag.

Well, not as good as built-in, but I guess it will do. I get to my car, and pull out the system, and it's got  a large suction cup that you're supposed to attach to the windshield ( I guess ). It's also powered by the cigarette lighter.

So, I suction it to the windshield, plug it into the cigarette lighter, punch in the destination, and take off. Here's what it looked like when I pulled out of the car lot ...

and here's what it looked like 5 minutes later when I was on the interstate ...

Not only had it flown off the windshield, but it had managed to unplug itself so I didn't even have voice directions anymore.

I had no other option but to pull off the interstate and find a parking spot in the city where I could readjust. I managed to get power to it again, and repositioned it in the dash where the ashtray would have gone.

I'll bet this was a good idea on paper.

This is where most good ideas start, however they need to be hard-boiled in the real world before they remain good ideas. The key is not to commit too many resources before knowing how good your idea really is.

Flawless Compliance Newsletter - March 2008 Issue

The March 2008 Issue of Flawless Compliance is available, with Center Stage article, Where's the Control on Auditing Standard 5? What happens when the dog guards the dog food? Also, Obama pledges to audit Bush, building a Compliance Data System from sentencing guidelines, a crime-fighter is in the soup, and what happens when we can't understand our controls.

The Perfect Laptop?

I couldn't believe my ears when I first heard the media talking about Lenovo creating the Perfect Laptop.

The perfect laptop? Give me a break. A Windows-based machine is going to be the perfect laptop? I don't think so.

The new Lenovo is supposed to compensate for all the shortcomings of the new MacBook Air, including having a longer, replaceable battery, and the option to plug in a optical drive ( CD, DVD, etc. ) if you want to.

I think Lenovo products are good. I have one myself ( X61 Tablet ), and I really like it. But perfect? That's a far stretch.

Here's my problem. There is overwhelming evidence that Bill Gates disappoints, and Steve Jobs impresses. Lenovo may do a fine job on the machine itself, but for it to work, it needs a good operating system -- and Windows ain't it.

Evidence trumps hype. Use your evidence for compliance, use your hype for cocktail parties.

Roll Up Your Sleeves

It's been just about 21 years since I landed in Germany as a young Private in the United States Army. I didn't have a clue. It was great :)

I remember being in such a hurry to leave basic training, that I jammed my uniforms ( all four of them ) in the bottom of my duffel bag. When I arrived in Germany, a future great Army buddy that we called "P-Funk" helped me out with getting to know my way around. When he saw my uniforms all crunched up in a ball at the bottom of my duffel bag, he looked at me funny and said, "What the hell is wrong with you?"

Then he said, "Oh well, let's get started on ironing these out. This is going to take a while." He was right. It took hours to get my uniforms back to Army grade. In my entire 3 year term in Germany, I never had to spend that much time again on uniform maintenance.

I just had this flashback, because I just completed going through a huge backlog of snail mail, caused by the combined havoc of leaving Chicago, then moving straight to a the remodeling project from hell. It took just about all day, but all the piles are gone now, and it feels great!

The same goes for a big audit intelligence project. The problem with a big audit intelligence project is, ... well it's "big". Big things tend to paralyze people, because in their mind they make it bigger than it really is. They spend tons of time in meetings about the meetings that they're going to hold, then turn things over to business analysts that analyze the analysis.

It's not only ridiculous, but it's a huge resource sink.

Recognize this as it's happening, and stop it right away. Get some good project management in place, roll up your sleeves, and just get it done.

SOX Tips from former Viacom VP

I had the privilege of speaking with Neil Frieser, former VP of Internal Controls at Viacom the other day. We discussed a lot of topics, including his days back at Viacom when he had to manage through the $20 Billion company's SOX efforts.

For a company that size, you would guess that a boat load of money was spent on SOX compliance, however Neil claims he did it for only about $8 Million total!

$8 Million Total! That's amazing!

He says that a lot of his success was in his strategy. Like everybody else, he followed the standard compliance framework:

1. Identify Objectives
2. Identify Risks
3. Identify Controls

But what he did different than most, is identify all the risks enterprise-wide first, then take a holistic approach to controlling all the risks with the fewest amount of controls. This saved him huge amounts of money when it came to testing the controls, and rolling everything out for SOX readiness.

Thanks for the tip, Neil! Great advice!

I think this is great advice going forward with your SOX compliance efforts. In an effort to continually improve, you should look for ways to consolidate your controls around your risks, and revise them accordingly. This will provide huge savings down the line for your SOX ( and other ) compliance efforts.

Since Viacom, Neil went on to be the VP of Internal Audit at Warner Music, and is now an associate at Resources Global Professionals. Among other things, he can be a great asset on any Board of Directors' Audit Commitee as the appointed "Financial Expert".

You can view his LinkedIn profile at http://www.linkedin.com/in/neilfrieser.

New Article - Data Auditing Quiz : Does Your Data System Prove You're Innocent?

One if the biggest mistakes I see when visiting client companies, is their underestimation of how well their compliance data system can be audited.

It's understandable.

When you build a transaction system, your goal is to run the business. When you build a data warehouse, your goal is to analyze the business. But when does it become your goal to audit your business practices?

Usually, auditing business practices and data systems become an executive afterthought. It is in response to some regulation like HIPPA, PCI, or Sarbanes-Oxley ( SOX ). Or, it is when you have received notice that a big contract is being audited by an agency like the General Services Administration (GSA).

In all cases, when you are under-prepared for an audit it will cost you time, money and effort. Find out now if your data system proves your innocence and uncover some data audit-proofing tips for total compliance

Take This Data Auditing Quiz Now to See If Your Compliance Data System Proves Your Innocence:

... read the full article