Hard-Boiled Compliance

ToadWorld - Keeping It Under Control With Approvals

Last week, we talked about reconciliation, as a control for a variety of risks. This week’s focus is on approvals. There’s no mystery or special compliance context to the word here – it’s simply an approval of some sort. There are different types of approvals, but the most common is a manager’s approval. What we’re talking about here, is making sure a manager approves of the activities that are going on.

... read the full article on ToadWorld

New Article - Four Secrets to Passing Any Business Audit : How the Best Companies Routinely Pass Audits

All companies have audit concerns. Public and some private companies deal with Sarbanes-Oxley financial and accounting disclosure rules; companies that take credit cards must comply with Payment Card Industry (PCI) data security standards; health care organizations deal with the Health Insurance Portability and Accountability Act (HIPAA); and we all deal with income taxes.

But what if you could get yourself into a position where any given auditor was of no concern, where passing an audit was pretty much guaranteed? Below are four secrets to passing any audit, any time.

... read the full article

Flawless Compliance Newsletter - April 2008 Issue

The April 2008 Issue of Flawless Compliance is available, with Center Stage article, Does America Need More Regulation? Paulson Cracks Down on America's Financial Markets. Also, college students are demanding firearms, managing risk on a compliance project, a spammer goes to the slammer, and a modern-day Flintstone car gets a ticket.

The April 2008 Issue of Flawless Compliance is available, with Center Stage article, Does America Need More Regulation? Paulson Cracks Down on America's Financial Markets. Also, college students are demanding firearms, managing risk on a compliance project, a spammer goes to the slammer, and a modern-day Flintstone car gets a ticket.

Remodeling Whirlpool - How to Escape the Spin

If you're wondering where I've been for the past few days ... I've been caught in a remodeling whirlpool. This time, it's over the floor.

Our floor has been the red-headed step-child of the entire project.

• In January, we started looking at the floor, only to realize that the house was really out of whack, especially the old dining room area -- so much so, that we had to call a foundation lifting company ( EagleLift ) to level things out. Not realizing that we have a pier and beam foundation, they tried to lift it without cutting the piers, resulting in a cracked foundation.
• They responded very quickly to the situation, and one week later they "fixed" the problem, but not to my general contractor's specifications. The contractor therefore proclaims, "I'm not dealing with any problems related to this area."
• The contractor goes to install the floor ( hardwood ), only to realize that the widths of the boards are as much as an eight off. This is unusual, coming from a high quality manufacturer ( BR111 ), however the wood now has to be returned, and we need a new floor. This isn't an overnight process -- obviously nobody wants to eat $10K in wood.
• Finally in February, we receive the new floor, and the contractors install it. Since it's pre-finished, and the cabinets aren't installed yet ( another debate ), it needs to be protected. As soon as the floor goes down, it's covered with paper, and thick protective boards.

Two months go by, while we encounter every kind of problem and delay you can imagine. Cabinet pieces missing, contention over who is installing what ( contractor or cabinet maker ), not enough granite, appliances not working ... you name it, the list goes on.

So, finally they pull up the paper on the floor for the big "reveal".

As you might expect at this point -- Anticlimax.

The first thing I notice is a very bad suntan on my entryway from the door to the kitchen area. I have very photosensitive wood, and the paper ( which wasn't covering the whole floor, just major portions of it ), has created the equivalent of a bad day at the beach for my floor. After talking with several sources, my understanding it that it will "eventually" go away. Could take as long as 1 year to even out. Great!

Here's the bigger problem. Remember that section of floor we had lifted? Well, if my entryway is the Irish guy who just spent 12 hours in the sun, then in my dining room are the gentle waves of the ocean. Nice for a day at the beach -- not so nice for a hardwood floor.

So, let's start the whirlpool of fault that sucks you in ...

• The contractor says, "It wasn't that way when we installed it. I told you that was going to happen, and I'm not dealing with any dining floor problems. Talk to the foundation lifting company ( EagleLift ) because your house has shifted over the last two months. Not my fault."
• So, we call EagleLift. They say, "Your house has not shifted at all. I've taken a lot of measurements with my fancy measuring tools, and there's no shifting. Your wood may be cupping, call your wood manufacturer. Not my fault."
• Well, that's not an attractive scenario. The wood has already been returned once, and what's the chances that we get two batches of bad wood in a row? So we call the wood people. They say, "It doesn't sound like your contractor installed the wood properly. The wood isn't cupping, it's buckling because it sounds like they didn't allow for expansion. Not my fault."

And around and around we go ...

Unfortunately, I'm not the project manager in this mess, so my control is limited. However, I'd like to show you how to get out of this, if you are the project manager, or have sufficient influence over the project resources involved. Here are the steps:

1. Put the whole project on hold. Explain to stakeholders that you cannot move forward because you are in a circular motion. Putting the project on hold will get everyone's attention, and will give you the leverage you need from stakeholders, to move through this. If this situation hasn't specifically been called out in your contingent risk plan, it will have to hit your management risk. Hopefully you have some left.
2. Spend your risk allocated resources ( money, time, etc. ) on attacking the root cause. It's extremely important to be scientific about this. If you have Six Sigma people available, have them do a causation study. I'm serious. It sounds like overkill, but you will need irrefutable evidence of the cause, because egos are at stake now. In my case, I'm stuck here, because I'm not controlling the project budget. Personally, I'm not willing to spend any money on causation -- that's why I'm paying the contractor. And the contractor's not willing to spend any more money on this -- he's already over budget on this job, because his project management is dreadful. He should read my blog more.
3. After causation is clearly identified, you have a very delicate ego issue to deal with. Do not overlook this. If you do not address the human issues, your productivity will sink rapidly. Nobody likes to be be proven wrong or guilty. Hold an upbeat "issue resolution" meeting that involves all parties, including the key stakeholders. Explain that it was an honest oversight, it tends to happen from time to time, and that you have allowed for situations like this in your risk plan, so there is no real consequence from the project standpoint.
4. Once everybody is in a good mood again, and only then, redirect resources to correct the problem, and move on. Adjust your project schedule and risk plan, and start focusing again on the project goal.

You don't know how badly I wish I was the project manager on this remodeling project. Obviously, I know enough to get out of this, but I can tell you it won't be handled smoothly. As a stakeholder dealing with bad project management, I'll probably have to go down a pretty bumpy road to get my results. Project management is everything. Don't let this happen to you.

How To Avoid Being April-Fooled By Your Computer ( Even When It's Not April )

I'm excited and honored to be invited by Quest Software, to join their rank of Expert Bloggers on ToadWorld, their information portal. Of course, my blog is about compliance -- and in this particular venue, I discuss the impacts and concerns for database administrators, developers, and managers.

Excited by the opportunity, I couldn't wait to crank out my inaugural blog, "Let's Talk Compliance!"

So, last Thursday night I start writing away. The format is a little different than you would normally expect. Most expert bloggers post weekly which is a little less frequent than normal, however the posts are longer and loaded with more content.

True to norm, I spend a good hour or so on my post. As you would expect, they have a blogging entry system similar to the one I'm typing in now, so I just start typing there. Once sufficiently satisfied with my entry, I hit the "spell check" button to make sure I don't have any typos.

Well, unlike the spell-checker on this blog, I received a prompt from my browser saying that it needed to install something first.

Of course, I complied.

Then I got a little message at the top of my browser -- some sort of warning about popups or scripts or something, and it wanted to know if I wanted to allow it.

And again, I complied.

Here's where the computer decided to play an early April fools joke on me. As soon as I "allowed" whatever it is I needed to allow, it refreshed the page -- without my hour's worth of blog entry!

First, I searched for some way to get my entry back. Refresh, Back Button, Undo, "Paste" ... Nothing.

Second, I spewed profanity profusely out loud.

Third, I took a walk outside, and gave myself an internal scolding. I've been doing this for close to 20 years. I've had to deal with numerous disasters in my time -- all preventable. I teach and preach on how to avoid situations like this. And yet, now I'm faced with having to regurgitate everything I just wrote for the last hour. I couldn't put it off, because I promised the site editor that I would have it done.

So after cooling down, I sat back in front of my computer and did what I should have done in the first place.

I opened MS Word, and started to reconstruct my blog entry. Doing it in Word has the following 3 advantages:

• I've already formed a habit of hitting CTL+S ( Save ) on a regular basis
• I've got a built in spell-check feature and grammar checker ( as worthless as it is, it does catch some things on the spot )
• If the computer completely crashes, Word has a good facility for trying to recover what you've already done ( i.e. auto-save ).

The point here is not about blogging with MS Word -- let's generalize a bit.

As you are dealing with technology development ( i.e. compliance data system ), be aware of the fatal assumption that everything is going to operate as it should. We are all old enough to know better by now. Computers crash, hard drives fail, networks mysteriously lose connectivity, ..., you get my point. And yes, published software has bugs.

So don't ever assume that things are going to work the way they're supposed to. Instead, use these tips for proceeding with caution:

• Get into the habit of saving your work, frequently. Sounds trite, but I constantly see people in the middle of long hours of unsaved work.
• Use tools that have a long undo stack. Java development tools like Eclipse are great at this. If you feel yourself getting lost, just keep undo-ing until you get back to familiar territory
• Use a version control system ( i.e. cvs, subversion, etc. ), and constantly version out. You shouldn't wait for a huge set of changes before versioning your system.
• Back up your work to remote devices or even locations. Have an auto-pilot system that automatically backs things up, so you don't need to worry about it.
• If the tool that you are working on does not have inherent safety nets ( i.e. save, multiple undos, etc. ), then use another tool, and transfer the data over when the content is complete.

It doesn't have to be April 1 for your computer to pull a fast one on you. As Mick Jagger says, "Don't get fooled again!"