Microsoft's Perspective on Risk & Compliance

Jeff Jinnett: Worldwide Partner Conference – One Way Microsoft Supports Its GRC Partners

Mimi S — Tue, 14 Jun 2011 16:39:00 GMT

The Microsoft Worldwide Partner Conference (WPC) will take place this year from July 10-14, 2011 in Los Angeles, California at the Los Angeles Convention Center[i]. WPC is an annual gathering for the Microsoft partner community to meet top Microsoft executives, learn about Microsoft’s roadmap for the upcoming year and see the latest Microsoft product innovations. Since 2003, WPC has served as a major Microsoft support event for thousands of partners from more than 130 countries worldwide, better enabling partners to plan their business strategies for the upcoming year. Microsoft executives who will speak at WPC include Steve Ballmer (CEO), Kevin Turner (COO) and Jon Roskill (corporate VP of the Worldwide Partner Group). Executives from the Microsoft U.S. financial services industry group and other industry groups also will be attending WPC and meeting with partners. The guest speaker on Wednesday, July 13^th, will be Sir Richard Branson, founder and President of Virgin Group.

It should be noted that WPC is just one of many ways that Microsoft supports its partner ecosystem. With respect to the activities that Microsoft and its strategic partners can jointly undertake to pursue joint business opportunities, these can include a wide variety of joint marketing and sales activities, such as the following:

Joint presentations at major trade conferences [ii]:
Joint presentations at Microsoft Technology Centers [iii]
Joint solution marketing videos [iv]
Joint webinars [v]
Jointly written white papers [vi]
Coordinated booths at trade conferences[vii]
Microsoft sponsorship of partner events and provision of speakers for partner events[viii]
Microsoft highlighting of partner solutions in this Microsoft GRC blog and on the Microsoft Financial Services Industry Group website [ix]
Microsoft participation in partner think tanks [x]

Sometimes the close collaboration between Microsoft and a GRC partner may lead both to decide that an even closer working relationship makes sense. For example, Microsoft recently announced the acquisition of Prodiance, a Gold Certified, industry-managed partner that markets leading Excel spreadsheet and Access database control solutions[xi], with the stated goal of bringing more compliance functionality within Microsoft Office.

[i] See http://www.digitalwpc.com/#fbid=zGscQl5BF4C.

[ii] see http://www.arma.org/conference/2010/SolutionsShowcase.aspx (ARMA conference in San Francisco, CA)

[iii] See http://campaigns.opentext.com/forms/GRC-MTC

[iv] See http://www.microsoft.com/showcase/en/us/details/9e9f907c-c27d-45f0-a938-9915b55634eb

[v] See http://www.trintech.com/news/press-releases/trintech-and-microsoft-to-conduct-webinar-on-automating-the-financial-close/

[vi] see http://www.trintech.com/unity-suite/financial-close-software/ and referenced white paper "From Crisis To Control: Full Command of Financial Close Processes and Performance"

[vii] See http://www.rsaconference.com/2010/usa/pdf/rsac2010-floor-plan.pdf (Microsoft partner pavilion -1527, next to Microsoft booth – 1517)

[viii] See http://utility.opentext.com/email/newslink/2010/December/ms.html

[ix] See http://blogs.msdn.com/b/grc/archive/2010/05/03/open-text-content-day-in-new-york-city.aspx , http://blogs.msdn.com/b/grc/archive/2011/04/14/jeff-jinnett-april-2011-update-grc-white-papers-books-webcasts-and-blogs-of-some-microsoft-partners.aspx and http://www.microsoft.com/enterprise/industry/financial-services/default.aspx

[x] See http://www.harlandfinancialsolutions.com/resources/credit-risk-consortium

[xi] See http://www.microsoft.com/pathways/prodiance/

Jeff Jinnett: April, 2011 Update - GRC White Papers, Books, Webcasts and Blogs of Some Microsoft Partners

Mimi S — Thu, 14 Apr 2011 21:31:00 GMT

Microsoft has an extensive ecosystem of ISVs and systems integration partners with offerings in the governance, risk management and compliance space. The following is a listing of some recent white papers, articles and other materials authored by Microsoft partners on GRC-related topics that you may find of value:

· Prodiance[i]

o White paper – “Automating Spreadsheet Controls for Solvency II Model Compliance”[ii]

· Open Text[iii]

o Book - Tom Jenkins, CEO of Open Text, Managing Content in the Cloud[iv]

· Harland Financial Solutions[v]

o White Paper – “Exceptions Management: Front Line Effort For Improved Credit Risk Management”[vi]

· Accenture[vii]

o Survey article – “Most European Insurers Say Compliance with Solvency II Will Cost More Than Originally Expected, Accenture Survey Finds”[viii]

· Hyland Software[ix]

o White paper on ECM workflow – “Workflow: Real Life ROI”[x]

· Thomson Reuters[xi]

o Cost of Compliance Survey 2011[xii]

· Numerix[xiii]

o White paper – “Numerix CrossAsset XL and Windows HPC Server 2008 R2: Faster Performance for Valuation and Risk Management in Complex Derivative Portfolios”[xiv]

· Fiserv[xv]

o White paper – “Headlights into 2011: U.S. Financial Regulatory Reform A Game Changer for Financial Services”[xvi]

[i] See http://www.prodiance.com/

[ii] See http://www.prodiance.com/news/releases/news_story_012511.aspx

[iii] See www.opentext.com/

[iv] See http://www.opentext.com/2/global/innovate/innovate-getyourcopy.htm

[v] See www.harlandfinancial.com/

[vi] See http://www.harlandfinancial.com/resources/white-papers/exceptions-management-front-line-effort-improved-credit-risk-management

[vii] See http://www.accenture.com/us-en/Pages/index.aspx

[viii] See http://newsroom.accenture.com/article_display.cfm?article_id=5105

[ix] See http://www.hyland.com/

[x] See http://go.hyland.com/workflow-realliferoi/

[xi] See http://thomsonreuters.com/

[xii] See http://thomsonreuters.com/content/news_ideas/white_papers/legal/406377

[xiii] See http://www.numerix.com/

[xiv] See http://www.numerix.com/research

[xv] See http://www.fiserv.com/default.htm

[xvi] See http://www.fiserv.com/white-papers_u.s.-financial-regulatory-reform-a-game-changer-for-financial-services.htm

Emerging GRC patterns around Cloud

Sai Sireesh — Wed, 13 Apr 2011 23:36:00 GMT

With Microsoft making a big bet on its Azure Cloud based services, the impact and implications for Governance, Risk & Compliance (GRC) space makes for a very interesting case. I will share some interesting industry patterns around GRC on an ongoing basis as i come across them. Today i start off with - Cloud GRC and Cloud based GRC services.

Cloud GRC - As companies in regulated industries look to adopt Cloud for relevant operating models and workloads, Cloud Governance, risk and compliance (GRC) is a key consideration. Typically firms list security, privacy, reliability, and operational control as key issues. There are baseline expectations that both existing as well as emerging certifications and standard attestations would be applied and stretched to the Cloud such as SAS 70, FISMA, ISO 27001, HIPAA, PCI DSS etc. There are also some evolving standards being worked on at bodies such as the ISO, ENISA etc. Microsoft itself addresses these issues through the coordinated and strategic application of people, processes, technologies, and experience. The result is continuous cloud security advances within the Microsoft cloud environment. For e.g. Windows Azure contains a risk-based program that hunts down and labels security and operational threats. It also keeps a detailed set of security controls updated and maintained at all times. Windows Azure operates a compliance framework that helps ensures organizational controls are designed correctly and operating as they should be.

You can find more information via this link. and whitepaper (Securing Microsoft's Cloud Infrastructure).

Cloud based GRC services - In many industries, regulatory reporting and risk assessment requirements are spread across the value chain or the supply chain. Many of these currently are supported by disparate, inconsistent and exist at country or functional level silos hosted by respective dept., suppliers. In such cases, Cloud based GRC Services lend themselves very well. An integrated Cloud based approach could help enable rapid deployment across the value chain for efficiencies. For e.g. European Environment Agency reporting and tracking is done across 32 member countries on Microsoft Azure.

Cloud as an enabler to develop and run applications with unbounded scalability and ease-of-use, lends itself very well to GRC due to rapidly changing regulations. Common GRC related activities such as stress testing, inspection, audit neccessiate temporary periodic spikes in need for collaborative workspace, computing needs and business records archiving. Currently the response to this is ad-hoc and puts a lot of pressure on the organization to manage this need. A Cloud based computing cycle, inspection, audit workspace, archiving workspace could very well fit here to manage the peak loads. For e.g. Risk specialist firm RiskMetrics, a division of MSCI, offers Monte Carlo Risk simulations from Azure to its customers during peak loads. I have blogged about this case earlier.

With such a Cloud based flexible platform, one can easily scale up or down to meet the demands of risk management and regulatory reporting. With the pay-for-use business model, one does not waste money on services one will not use 90% of the time.

Stay tuned as I cover more specifics on industry adoption in my following blogs.

Do you see similar patterns ?

Leading global bank adopts Microsoft partner FinArch for its Liquidity Risk Solutions

Sai Sireesh — Wed, 16 Mar 2011 17:22:00 GMT

New Liquidity risk frameworks as well as Stress tests were in my top 10 list for 2011. Many leading regulators with UK FSA being the first, have issued new guidelines on this globally. Whilst some banks still await the expected convergence with Basel III. I was thrilled to see a recent announcement on a leading bank ahead of the curve on enhancing its risk management capabilities.

Early this month FinArch, a key Microsoft Risk solutions global alliance partner, announced that one of the world’s largest bank has selected its Financial Studio as its global solution for liquidity risk calculation and reporting. FinArch had successfully implemented the solution in London during 2010 for the bank’s European operation. Financial Studio is a comprehensive integrated Risk and Finance solution based on a single version of the truth in data terms, i.e. a common core Financial Data Architecture. Based on the Finance Resource Planning (FRP) concept, the solution provides complete functionality for the management of the entire accounting chain, enterprise risk management function and internal and external reporting obligations.

It’s yet another example of a mission critical Risk data model and business application being deployed on Microsoft SQL Server & platform. The need for real-time risk modeling,high performance computing, RAROC models will only increase in the coming months for the industry.

The FinArch solution provides the bank with a common Microsoft based data model & architecture in which to store, manage and enrich data from all parts of the business. The solution offers a powerful simulation engine for the expected slew of mandatory stress testing prescribed by multiple regulators. It also provides capabilities beyond regulatory compliance. It is also unique in the sense that it integrates Risk and Finance world genuinely providing risk, finance, accounting and reporting functionality in 1 single unified platform.

The core capabilities being:

Cash Flow analysis
Valuations
Gap Analysis
Concentration Risk
Stress Testing simulations
Basel III convergence – counter cyclicality, leverage ratio, liquidity risk

Congratulations to the FinArch team for achieving this significant milestone, amongst many others. I look forward to sharing many other success stories in the area of Risk and compliance.

Source: Based on FinArch Press Release, March 2011

Sai Sireesh Predicts Top 10 Risk and Compliance Initiatives in 2011

Mimi S — Tue, 22 Feb 2011 23:32:00 GMT

In the last few months, many new regulations have been introduced impacting all major markets. They include the Dodd Frank reform in the USA, Liquidity Risk in the UK and Basel III in the EU and globally. Based on the changing risk and regulatory landscape, I predict the following top 10 initiatives in 2011. Am I on track? What do you think?

1. Basel III consultations for EU and global firms

2. New Liquidity Risk requirements for firms in the UK and Australia

3. Dodd Frank Reform and Consumer Protection Law - interpretations and implications for US firms

4. Basel II, IFRS for those countries on delayed timelines

5. Solvency II for insurance companies

6. Electronic discovery (e-discovery) for US and global firms

7. Expanding and executing Operational Risk/Enterprise Risk Management initiatives

8. Technology Risk - potential for Cloud-based business models

9. Reputation Risk - Social Media usage for business

10. Environmental Sustainability & Compliance – Green IT

Jeff Jinnett: GRC White Papers, Online Articles and Blogs of Some Microsoft Partners

Phyllis McNeice — Sun, 03 Oct 2010 04:48:00 GMT

Microsoft has an extensive ecosystem of software and systems integration partners with offerings in the governance, risk management and compliance space[i]. The three areas of governance, risk management and compliance intersect to a certain extent and some Microsoft partners have solution offerings bridging all three topics, such as Open Text[ii]. Other Microsoft partners have offerings that are individually focused on governance, risk management or compliance. For example, Prodiance offers spreadsheet control solutions that can help companies comply with internal financial control requirements of the Sarbanes-Oxley Act and internal auditing standards, such as GTAG-14.

The following is a listing of some white papers and weblogs authored by Microsoft partners on GRC-related topics that our blog readers may find of value:

Open Text:

Blogs – “Meet the Experts”[iii], such as “FDIC Issues Alert re Sensitive Data on Fax Machines”[iv]

Prodiance:

White papers, such as “Addressing Guidance from the IIA’s GTAG-14 for Auditing User-Developed Applications[v]
Blog “End-User Computing.Org”, such as “Cohmad Fined $200,000 in Madoff Case for Failure to Keep Spreadsheet Records”[vi]

Harland Financial Solutions:

White papers, such as “Ten Reasons to Move to Closed-End Lending” [due to changes to Regulation Z, effective July 1, 2010][vii]

Fiserv:

White papers[viii], such as “Headlights into 2011: U.S. Financial Regulatory Reform A Game Changer for Financial Services[ix]

Accenture:

Articles, such as “It’s All About Balance”, a risk management article in the Outlook online magazine[x]
Blogs[xi], such as the Accenture Security Blog[xii]

Finarch:

Dedicated website with materials on the International Financial Reporting Standards[xiii]

Lexis Nexis Insurance:

White papers, such as “Emerging Anti-Money Laundering Risks to Financial Institutions”[xiv]

[i] See e.g., the Microsoft “Governance, Risk Management and Governance Partner Solutions Guide”, located at http://www.bing.com/search?q=microsoft+risk+management+partner+guide&form=QBRE&qs=n&sk=. Microsoft partner solutions for specific GRC issues can also be located through the partner finder located here: https://solutionfinder.microsoft.com/.

[ii] See http://www.prnewswire.com/news-releases/open-text-featured-in-microsoft-technology-centers-for-governance-risk-and-compliance-solutions-91697959.html.

[iii] See http://conversations.opentext.com/.

[iv] See http://faxsolutionsblog.opentext.com/2010/09/20/announcement-%e2%80%93-fdic-issues-alert-re-sensitive-data-on-fax-machines/.

[v] See http://www.prodiance.com/downloads/requestwp_gtag14.asp

[vi] See http://endusercomputing.org/

[vii] See http://www.harlandfinancialsolutions.com/sub-items.php?item_id=2007012611313746&cat_id=2007010400410309&p1=000000000000000020070108151411472007010815043276&from_pc=

[viii] See http://www.harlandfinancialsolutions.com/sub-items.php?item_id=2007012611313746&cat_id=2007010400410309&p1=000000000000000020070108151411472007010815043276&from_pc=

[ix] See http://www.fiserv.com/white-papers_u.s.-financial-regulatory-reform-a-game-changer-for-financial-services.htm

[x] See http://www.accenture.com/Global/Research_and_Insights/Outlook/outlook-journal-2010-balance-risk.htm

[xi] See http://www.accenture.com/Global/Accenture_Blogs/default.htm

[xii] See http://blogs.accenture.com/security_blog/default.aspx

[xiii] See http://www.ifrsforbanks.com/default.aspx

[xiv] See http://www.lexisnexis.com/risk/industryinsights/financial-services.aspx.

Sai Sireesh: Key Findings - Future State of Risk 2010 Survey

Phyllis McNeice — Mon, 20 Sep 2010 16:37:00 GMT

In my previous blog, I broadly covered the release of the “Future State of Risk 2010” survey which was commissioned jointly by PRMIA.org and Microsoft. In addition, I briefly covered the summary in a webinar last week to over 120 professionals. The webinar was well received and followed by multiple requests for a survey copy.

Today, I will provide more details on the survey findings. This survey polled respondents across financial industry, as well as the broader sector to have a more balanced view of the results. Out of a total of 1,662 global respondents, 1,398 (84%) were from financial institutions and 264 (16%) from non-financial institutions. Here are some key results:

The top five financial risk management future trends are: 1. Liquidity Risk Buffers, 2. Enterprise Risk Management, 3. Stress Testing, 4. Managing Systemic Risk, and 5. Banking Book Credit Risk Models.
The top five non-financial risk management future trends were: 1. Enterprise Risk Management, 2. Operational Risk, 3. Cash Flow at Risk (CFAR), 4. Productivity & Efficiency in Risk, and 5. Technology Risk.
Risk Management/Compliance trends foreseen in the next two to three years include: 1. More visualization of analysis, 2. Collaboration as a key pillar, and 3. Broader and wider access to business insights and analytics, i.e. risk management for everybody.
Risk management and compliance functions will rely much more on: 1. Automating work flows and processes, 2. Self serve – providing powerful analytics to end users, and 3. Unlocking business data/insights.
Top skills which risk managers of the future need to focus on include: Deeper business knowledge was ranked the top skill; Quantitative skills (math, statistics) and Communication skills ranked second and third respectively.
Risk managers today spend on average 62% of their time on tactical tasks (e.g. data collection),and only 36% on strategic/analytical activities. The percentage of firms taking a more strategic and longer term view of risk management practices will rise.
The percentage of operational costs needed for an effective risk management program: 27% felt 2-5% of the operational costs was adequate; 25% voted for 5-7% of the operational costs and 24% voted for a much larger share of 7-10% of the operational costs.
Future decisions on risk management technology investments will be based on: 1. Efficiency - Integrated offerings which help bring efficiency to work flows and processes, 2. Self-service – The right information, at the right time in the right format for end users, and 3. Productivity – Saving valuable hours for employees in everyday risk management tasks. Interestingly, cost came out as the lowest factor.

Do you agree /disagree with your peers in the risk industry? I welcome your thoughts.

Jeff Jinnett: Dodd-Frank Legislation: Some Post-Passage Developments

Phyllis McNeice — Wed, 15 Sep 2010 05:49:55 GMT

On the eve of heading off on vacation, I decided to post on some developments that have occurred post-passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act:

A. M. Best announces it will not permit its ratings of insurance companies to be cited in registration statements and related prospectuses, since that could expose A.M. Best to “expert” liability as a result of the Dodd-Frank legislation[i]
Citigroup and other banking institutions reportedly begin the process of spinning off their hedge fund and private equity lines of business[ii]
The U.S. Securities and Exchange Commission adopts a final rule “Proxy Disclosure Enhancements” pursuant to authority granted in the Dodd-Frank legislation[iii]
CalPERS establishes its Diverse Director Database to support nominations of directors by institutional shareholders pursuant to the new SEC proxy access rules[iv]
The SEC seeks comments on other regulatory initiatives undertaken as a result of the Dodd-Frank legislation[v]
Companies begin planning for compliance with the “say on pay” requirements for shareholder meetings held on or after January 21, 2011 and Towers Watson surveys 251 large and mid-sized companies on their preparations[vi]
The FDIC, OCC and FRB issued a joint advance notice of proposed rulemaking (“ANPR”) regarding alternatives to the use of credit ratings in the agencies’ risk-based capital rules for banking organizations[vii]
The U.S. Office of the Comptroller of the Currency (OCC) and other U.S. banking agencies express support for the September 12, 2010 Basel III agreement as being in harmony with the goal of the Dodd-Frank legislation to establish “more stringent prudential standards, including higher capital and liquidity requirements for large, interconnected financial institutions.”[viii]
The FDIC hosts a roundtable to discuss implementation of the new resolution authority granted to the FDIC under Dodd-Frank[ix]
Personnel at the U.S. Treasury Department work to establish the Bureau of Consumer Financial Protection and rumors surface that President Obama may make an interim appointment of Harvard Law Professor Elizabeth Warren as its first director[x]

[i] See http://www3.ambest.com/frames/frameserver.asp?site=press&tab=1&altsrc=14&altnum=&refnum=65494653775746536653.

[ii] See http://www.nytimes.com/2010/08/06/business/06wall.html?_r=1&partner=yahoofinance

[iii] See http://www.sec.gov/rules/final/2009/33-9089.pdf.

[iv] See http://www.calpers-governance.org/marketinitiatives/initiatives/board-diversity/home.

[v] See http://www.sec.gov/spotlight/regreformcomments.shtml and http://www.sec.gov/news/press/2010/2010-134.htm.

[vi] See http://www.onsecurities.com/ .

[vii] See http://www.financialcrisisrecovery.com/?p=1304#more-1304.

[viii] See http://www.occ.treas.gov/ftp/release/2010-107.htm.

[ix] See http://www.fdic.gov/regulations/reform/forum.html.

[x] See http://voices.washingtonpost.com/political-economy/2010/09/elizabeth_warrens_latest_buzz.html.

Sai Sireesh: Future State of Risk & Compliance 2010 - Global Benchmark Survey

Phyllis McNeice — Wed, 08 Sep 2010 17:50:00 GMT

Today, September 8, 2010, PRMIA (Professional Risk Managers International Association) and Microsoft jointly released a 2010 survey on global trends and industry views of the future of risk management and compliance. The survey provides a benchmark to risk and compliance practitioners across both financial and non-financial sectors. In addition, it is one of many initiatives by Microsoft and PRMIA to drive risk and compliance industry thought leadership.

Having personally led the PRMIA initiative in a pro-bono capacity, this survey was about defining the future vision, blueprint and game changers for next-generation risk management practices. The idea being to uniquely capture the broader pulse of the risk profession beyond regulations, which included future vision, game changers, productivity, and a generational shift in talent pool and technology. The survey responses clearly confirm the global demand for easy-to-use automation and analytics, and validate the focus on solutions that automate and simplify governance, compliance and risk management.

As per responses, a sign of the enhanced work pressures and real-time turnaround is being reflected in a consistent focus on productivity and efficiency in Risk and Compliance functions across many areas to save valuable time and effort. Responses also indicated a shared vision towards enhanced productivity and efficiency in future risk and compliance workflows. There is a clear sense of pain around being asked to “do more with less.” Most respondents expressed a future vision where they are able to spend more time on strategic and proactive risk mitigation activities, rather than on time consuming tactical tasks like data aggregation.

On technology front - ease of use, flexibility, self-serve and integration with current environment were key expectations, along with the need for enhanced decision support, predictive analytics and high performance computing in the processes. Also implicit was the role of technology enablers to enhance productivity and efficiency in the workplace. Tools like risk computing via cloud start to become real.

On potential game changers, being an open ended question, there was a predictably a wide range of response. The top “categories” of game changers were new regulatory concepts, risk approach and next generation risk computing. Whilst I will cover the detailed results in next few blogs, some of the key areas covered in the benchmark survey are:

- Vision and pulse of the profession

- Empowerment and culture

- Generational shift in the risk talent pool & skills

- Future trends in Risk and Compliance

- Future vision of a Risk and Compliance workplace

- Budgets, Investment Expectations

- Technology predictions

- Game changers

The survey is available for download by PRMIA members from http://www.prmia.org/

You can also request a copy via this blog. I certainly look forward to your comments & feedback.

Jeff Jinnett: SEC Adopts Final Rule on Proxy Nominations for Board of Directors

Phyllis McNeice — Wed, 01 Sep 2010 03:01:32 GMT

My June 29^th blog posting on this topic noted the Dodd-Frank legislation authorizes the SEC to issue rules granting shareholder access to management’s proxy statement for the purpose of nominating directors to the board. On August 25, 2010, the U.S. Securities and Exchange Commission adopted a final rule entitled “Facilitating Shareholder Director Nominations”[i]. Under the final rule, shareholders of public companies subject to SEC oversight that have held a three percent (3%) equity interest for at least three years may nominate directors for election to the board of directors using the management’s proxy statement. Although there is no restriction on the relationship between the 3% shareholder and its nominee(s), the nomination of directors may not be for the purpose of accomplishing a change of control of the company.

It has been reported that the SEC estimates that 33% of public companies have at least one institutional shareholder owning at least 3% of their securities for at least three years[ii]. Examples of such major shareholders would include CalPERS and other large pension funds. Although large hedge often hold positions of 3% of greater in public companies, only a subset of these same hedge funds hold their 3% equity positions for at least three years.

Under the new SEC final rule, management is not required to include shareholder nominees for more than 25% of the total board seats. If multiple shareholders nominate directors for more than 25% of the board seats, the largest shareholders will take precedence over the smaller shareholders, irrespective of which shareholder nomination was received first by management. Under New York Stock Exchange Rule 452, brokers are no longer permitted to vote the shares they hold on behalf of customers, unless the beneficial owners of the shares direct them as to how to vote the shares. Since brokers in the past typically voted shares in favor of the management’s slate of directors, this new SEC final rule, when combined with NYSE Rule 452, may now have a significant impact on the composition of boards of public companies with large institutional investor shareholders. In light of the new SEC final rule on proxy access, some companies may attempt to enact procedural barriers to thwart large institutional shareholders from replacing management-nominated directors. In a recent article, J.W. Verret of the George Mason University School of Law explored some of the legal defenses public companies might attempt.[iii]

These new developments may mean that boards of directors of some public companies over the next few years will include a significant number of independent directors nominated by large institutional investors unhappy with the way the current management is running the companies. From an information technology point of view, this may result in the independent directors requesting the board have its own IT infrastructure in the “cloud” that would not be subject to operational oversight and control by management. Boards of directors have relatively simple record-keeping requirements. For example, boards must maintain records of whistleblower complaints made to the board under the Sarbanes-Oxley Act and vendors already exist to provide record-keeping extranets specifically for boards of directors[iv]. The primary IT requirements of boards tend to be in the areas of business intelligence, communication and collaboration and document production and review. These requirements could easily be satisfied with through a cloud environment, such as the Microsoft Business Productivity Online Suite (BPOS)[v].

[i] See http://www.sec.gov/rules/final/2010/33-9136.pdf.

[ii] See Lisa Fairfax posting at http://www.theconglomerate.org/forum-proxy-access/.

[iii] See J.W. Verret, “Defending Against Shareholder Proxy Access: Delaware’s Future Reviewing Company Defenses in the Era of Dodd-Frank,” located at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1655482.

[iv] See, e.g., https://boardextranet.com/.

[v] See http://www.microsoft.com/online/faq.aspx.

Sai Sireesh: Solvency II & US Insurance Solvency Framework

Phyllis McNeice — Wed, 25 Aug 2010 16:31:00 GMT

I have been following emerging risk management regulations in the insurance industry with great interest. The two major Insurance Risk and Prudential regulations on the horizon with global impact are:

1. Solvency II in Europe

2. US Insurance Solvency Framework

Both regulations cater to the specific operating modalities of their respective markets, but will impact any companies operating globally. With the US adoption of its own Insurance Solvency Framework, it will be an interesting journey toward a globally accepted liquidity framework standard.

While Solvency II is already being adopted across many EU countries, the US Insurance Solvency framework is fairly recent. So before comparing the two approaches, I want to highlight the seven core principles of the US Insurance Solvency Framework:

1. Regulatory Reporting, Disclosure and Transparency

2. Off-site Monitoring and Analysis

3. On-site Risk-focused Examinations

4. Reserves, Capital Adequacy and Solvency

5. Regulatory Control of Significant, Broad-based Risk-related

6. Preventive and Corrective Measures, Including Enforcement

7. Exiting the Market and Receivership

More on the design principles around the two approaches in my next blog.

Source: http://www.naic.org/documents/committees_e_us_solvency_framework.pdf

Jeff Jinnett: Whistleblower “Bounty Hunters” Under the Dodd-Frank Legislation

Phyllis McNeice — Tue, 17 Aug 2010 03:26:00 GMT

If you can imagine Wall Street as an Old West Dodge City and the U. S. Securities & Exchange Commission as the local marshal, “wanted” signs are being figuratively nailed up for U. S. public companies and a new class of whistleblower “bounty hunters” will be lining up in hopes of million dollar rewards. Section 922 of the recently enacted Dodd-Frank Wall Street Reform and Consumer Protection Act[i] (the “Act”) amends the Securities and Exchange Act of 1934 to require the SEC to pay big monetary rewards to whistleblowers who voluntarily disclose original information about securities law violations by public companies. These rewards can range from 10 percent to 30 percent of monetary penalties exceeding $1 million recovered by the SEC from the company violating U.S. federal securities laws, after taking into account factors such as the significance of the whistleblower’s information.

Although this SEC bounty program existed prior to the passage of the Act, it previously applied only to reports of insider trading. Now the bounty program will apply to whistleblower reports with respect to all securities law violations. Whistleblowers in financial fraud and Foreign Corrupt Practices Act cases, which tend to generate very large civil penalties, now are eligible for awards under the Act’s new bounty program. As an example of the potentially high dollar rewards that could be involved, on July 23, 2010, the SEC awarded a $1 million bounty to a whistleblower providing information that resulted in the collection of $10 million in civil penalties in the SEC’s insider-trading case against Pequot Capital Management, Inc. and other related parties[ii]. The class of potential whistleblowers also has been expanded. Whistleblowers now can include not only employees and officers of the offending company, but also business competitors, consultants, vendors and services providers.

In addition to significant new dollar incentives, employee whistleblowers under the expanded bounty program also are accorded significant new protections under the Act. Under the Act, employers cannot demote, suspend, discharge, threaten, harass or discriminate against whistleblowers, even if the whistleblower complaint is later found to be without merit. In addition, the Act now permits whistleblowers to commence a private action against their employers if they are terminated in retaliation for notifying the SEC of the securities law violation. In addition to reinstatement, the whistleblower employee is entitled to 200% of back pay lost, plus litigation costs and attorney’s fees. Further, a whistleblower now can remain anonymous by making the report to the SEC through legal counsel, with the identity of the whistleblower being required to be disclosed only if a reward is to be paid to the whistleblower. A whistleblower also is entitled to appeal the SEC’s decision on whether or not to grant a reward to the appropriate U.S. Federal Court of Appeals.

In light of the incentives and protections being granted to whistleblowers by the Act, it is likely that the volume of whistleblower reports may increase significantly in coming years. This apparently was the intention of the U.S. Congress. The Act provides that the SEC must establish a special office to administer and enforce the Act’s whistleblower provisions and report back annually to Congress on the office’s activities and its response to all whistleblower complaints. In addition, the SEC Inspector General is required to report to Congress on whether the SEC has adequately promoted and publicized the whistleblower program.

Independent of the passage of the Act, the SEC has now made permanent its one year trial program whereby the SEC commissioners delegated their subpoena power to the SEC enforcement director, who thereafter sub-delegated subpoena authority to a number of his deputies[iii]. This may increase the likelihood of SEC inquiries initiated by a whistleblower complaint more quickly evolving into much higher profile investigations. With the issuance of a subpoena under a formal order of investigation, subjects of the SEC probe can be forced to testify under oath in addition to furnishing requested documents. As Samuel Johnson once said, “nothing focuses the mind like a hanging”. Public companies may want to take the “wanted” posters seriously and focus on modifying their policies and procedures in light of their increased risk of being the subject of whistleblower reports to the SEC from employees or third parties as a result of the new bounty program created by the Act.

[i] See http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=111_cong_bills&docid=f:h4173enr.txt.pdf.

[ii] See http://www.gibsondunn.com/Publications/Pages/SECAwards1MillionDollarBounty-InsiderTradingAction.aspx.

[iii] See http://www.washingtonpost.com/wp-dyn/content/article/2010/08/11/AR2010081106274.html?nav=emailpage.

Sai Sireesh: Top Six Basel III Design Elements

Phyllis McNeice — Tue, 10 Aug 2010 00:29:00 GMT

Let’s start learning LR, LCR, NSFR, Capital Surcharge, Gone Concern! A mouthful isn’t it?

Well, Basel III is coming our way sooner than expected! The much awaited (do I hear a groan?!) Basel III regulation is getting its final touches. The Group of Governors and Heads of Supervision - the oversight body of the Basel Committee on Banking Supervision - met on July 26, 2010 to review the Basel Committee's capital and liquidity reform package. The BIS, with G20 consultation, is driving the Basel III release by November 2010 with an implementation start by end 2012. Although, the deadline for final institution level Basel III conformance is expected around 2018.

Their focus is on:

quality, quantity, and international consistency of capital
strengthening liquidity standards
discouraging excessive leverage and risk-taking
reducing procyclicality

In general, banks will need to hold more capital and manage liquidity better to withstand economic and market events. The global regulators are reviewing new bank's Tier 1 capital requirement from its current four percent level. Another key decision awaited is the timeline for banks to exclude lower quality capital from their capital calculations.

While the regulation is still evolving, some of the design elements of Basel III at a high-level are:

Definition of Capital - Tighter definition of top quality capital with a capital buffer range with capital distribution constraints around it
Treatment of Counterparty credit risk – Capital buffers
Leverage Ratio - Cap on debt via leverage ratio; Definition and Transition; 2011 start; Parallel run Jan 2013-Jan 2017; Disclosure starts Jan 2015; Migration Jan 2018
Regulatory Buffers, Provisions, and Cyclicality of the minimum
Systemic banks, contingent capital and a capital surcharge
Global liquidity standard – Liquidity Coverage Ratio(LCR), Net Stable Funding ratio (NSFR) - Measure of long term liquidity but with diluted initial pilot of one year horizon liquidity buffer

Some of the industry concerns are already addressed in Basel III. For example, less stringent treatment of deferred tax assets and affiliates for calculating capital, longer phase-in for new liquidity rules, and cap on debt. These regulations especially help many banks gain time to raise vast amounts of funds and a more considered roadmap for their minority stakes.

Basel III originally proposed a ban on banks counting capital held in affiliates as part of their own holdings. This did trigger concerns of a freeze in acquisition of minority stakes or sell-offs to avoid the need for extra capital. Banks will now be able to include capital from minority-held companies up to a certain threshold. Basel III has included top-rated corporate debt in short term liquidity buffer. The industry and regional concerns about including only government bonds are being considered (i.e. countries such as Australia with strong public finances do not have enough government debt for local banks to buy).

For those of you wanting to dig deeper, you can download the document from http://bis.org/press/p100726/annex.pdf

I look forward to your hearing thoughts and comments.

Source: BIS, Reuters, Bloomberg

Jeff Jinnett: Framework for Designing Applications for Microsoft Surface®

Phyllis McNeice — Thu, 05 Aug 2010 00:25:00 GMT

Microsoft Surface® is a table-top computer that responds to natural hand movements and tag-enabled objects, with four unique capabilities: (a) direct interaction (users can interact with content on-screen by touch and gesture), (b) multi-user experience (the display enables several people to interact in a face-to-face computing experience), (c) multi-touch (the display responds not just to the touch of one finger, as with a typical touch screen, but from dozens of contact points at once) and (d) object recognition (users can place physical objects on the display, such as for the transfer of digital content to mobile devices).

Microsoft itself has developed applications that (1) add the Seadragon[i] image zoom capability to Surface, (2) enable Bluetooth device connectivity[ii], and (3) enable recognition of byte tags and identity tags placed on objects in order to launch applications[iii], among other processes. In addition, Microsoft Surface partners such as Infusion Development Corp., Stimulant, Luminos, Infostrat, nsquared and Vectorform have developed Surface applications that incorporate additional capabilities, such as (1) the use of physical image magnification rings[iv] and on-screen magnification lenses[v] , (2) the ability to explore documents and coordinate calendars[vi], (3) the ability to navigate 3-D data collected from Internet, desktop and Surface data sources[vii], (4) the ability to use stackable objects for 3-D renderings and interaction[viii] (5) the ability to “flip” images from the surface up to a wall monitor with a hand motion[ix], and (6) the ability to interact with fiber optics embedded in objects[x].

Design and development training is now available online for those interested in developing applications for Surface[xi]. Also, a new book is available on a pre-publication basis dealing with multi-touch code development for Surface[xii]. Demos exist illustrating how Surface can be used to create unique user experiences for customers in various industries, such the Razorfish demo for the financial services industry[xiii] and the Infusion Surface application for Barclays[xiv]. A new addition to the Surface suite of tools is the Microsoft Surface Toolkit for Windows Touch Beta, which permits developers to create applications for touch PCs and prepare for the next version of Surface[xv].

In order to better identify situations that are well-suited to the use of Surface and other multi-touch displays, it might be helpful to develop a framework for mapping the capabilities of Surface against business use cases, while taking into account any limiting factors. For example, a customer to a stock brokerage firm could be issued a card that has a Surface identity tag on it. If the customer visits a local office of the stock brokerage firm, the customer could place the card on a Surface display at the brokerage. The tag would identify the customer and ask for the customer to authenticate onscreen by typing in a password. Then the Surface display would connect online to a database containing information about the stocks and bonds owned by the customer. The Surface display would then map that portfolio against various portfolio analysis tools to show the customer how his or her portfolio was performing in real time. The portfolio analysis could be displayed using a 3-D touch-capable visualization tool, such as the Aqumin AlphaVision™ tool[xvi]. One positive factor from a business point of view is that the customer would be encouraged to visit his or her broker at the broker’s local office in order to use the Surface application. One limiting factor could be the reluctance of the customer to have his or her portfolio displayed on a table top display that could be seen by other customers in the vicinity.

Also, if the broker were to assist the customer in the use of the display, the multi-user capability of Surface would be involved. The proposed design framework for Surface applications would need to include a list of potential positive and negative factors to be taken into account in deciding whether the potential Surface application for a particular use case merited development. A subjective and quantitative analysis of successful Surface and other multi-touch user experiences could provide a benchmark against which potential future applications then could be judged.

[i] See http://www.microsoft.com/showcase/en/US/details/2b7260af-873f-499b-acfa-281d84c8d3ba.

[ii] See http://blogs.msdn.com/b/surface/archive/2010/06/15/microsoft-surface-bluetooth-connect-code-sample-now-available-for-download.aspx.

[iii] See http://msdn.microsoft.com/en-us/library/ee804762(Surface.10).aspx, http://msdn.microsoft.com/en-us/library/ee804803(Surface.10).aspx and

[iv] See http://www.microsoft.com/showcase/en/US/details/5cc82ab8-9e1e-4e6a-803d-5ffa6d824f2d.

[v] See http://stimulant.io/wp/index.php/blog/2009/07/microsoft-local-impact-map-surface-edition/.

[vi] See http://blogs.msdn.com/b/surface/archive/2010/07/08/nsquared-presents-their-surface-business-pack.aspx.

[vii] See http://www.microsoft.com/showcase/en/US/details/9cc401dc-5a7c-40bc-8aa7-5787cf52acf2.

[viii] See http://www.pcworld.com/article/194051/luminos_add_third_dimension_to_microsoft_surface.html.

[ix] See http://blogs.msdn.com/b/surface/archive/2010/04/27/experience-the-garibaldi-panorama-on-surface.aspx.

[x] See http://www.microsoft.com/showcase/en/US/details/78929a20-e8d8-48bc-86b2-6af1ee961dd6.

[xi] See http://www.microsoft.com/surface/en/us/Pages/Technical/Training.aspx.

[xii] See Joshua Blake, Multitouch on Windows (Manning Early Access Program), at http://manning.com/blake/.

[xiii] See http://www.vimeo.com/2543518.

[xiv] See http://www.infusion.com/Case-Study.aspx?cat=4&sub=4&id=2.

[xv] See http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=801907a7-b2dd-4e63-9ff3-8a2e63932a74.

[xvi] See http://www.aqumin.com/.

Sai Sireesh: Stress Testing - Measuring Systemic Risk Across the Globe

Phyllis McNeice — Wed, 28 Jul 2010 04:22:00 GMT

Last year, the European Union was exploring a Systemic Risk Council to better manage risks. A small, but significant step towards a consolidated EU Systemic Risk management is the recent round of Stress Tests in EU.

As we know, the American banks underwent a similar stress testing exercise early in 2009. Ten of 19 large US banks were required to raise a combined $75 billion in capital after the stress testing was completed.

On Friday, CEBS released stress tests results that subject each bank's Tier 1 capital projections until the end of 2011 to worst case scenarios. The tests were conducted on 91 banks across 20 countries. Only seven out of 91 banks in EU failed the tests. EU banks need a total of 3.5 billion euros (US $4.5 billion) to boost their capital reserves, compared to the fear it would be much higher. Given the diverse nature of EU states, there were different measures in different countries around some assumptions of the shock scenarios around recession, unemployment rates, property values, during economic and financial storm.

A total of seven banks failed the tests including five small Spanish banks, Germany's state-rescued Hypo Real Estate and Greece's Atebank. There were 17 banks that met the borderline 6-6.9 % Tier 1 capital in the worst case scenario. There were 15 banks each on 7%-7.9% and 8%-8.9% range. There were 13 banks in 9% - 9.9% ratios, and 24 banks with 10% or higher Tier 1 capital ratios.

Spain, of course, led the drive for transparency and conducted much wider tests of its banking system and more disclosures. Other major economies are exploring stress testing, too, in order to boost confidence, as well as systemic risk measures (e.g. Chinese regulators are expected to conduct industry-wide stress testing). Investors and analysts can also run their own risk simulations based on the detailed breakdown of the bank’s exposure to the sovereign debt of EU and other countries.

More power to high performance computing capabilities, essential for more stress and back testing to come!

Jeff Jinnett: Dodd-Frank Act - The Devil’s in the Details and Fasten Your Seatbelts

Phyllis McNeice — Wed, 21 Jul 2010 23:49:00 GMT

Now that the Restoring American Financial Stability Act of 2010 (the Dodd-Frank legislation or “the Act”) is about to be enacted into law, the question is: what happens next? At a length of approximately 2,300 pages, one might assume the Act contains detailed rules on the reforms the U.S. Congress believes must be imposed on the financial services industry. That assumption is wrong. According to the law firm of Davis Polk & Wardwell LLP, a critical regulatory phase is about to commence[i]. In this phase, over the next six to eighteen months, at least ten regulatory agencies will undertake a minimum of 243 rule-makings and 67 studies[ii]. For example, Davis Polk estimates that the U.S. Securities and Exchange Commission will undertake 95 rule-makings and the U.S. Commodity Futures Trading Commission will undertake 61 rule-makings. Over one-half of the anticipated rule-making therefore appears to hit the capital markets industry. Each new regulation likely will run into the hundreds of pages when reported in the Federal Register. Davis Polk’s flow chart outlining the timelines for agency rule-making and studies shows the regulatory phase continuing for the next 12 years. To put all of this into perspective and reveal the immensity of the new reforms, the Sarbanes-Oxley Act required only 16 new regulations and 6 studies[iii].

Certainly, the financial reform legislation may result in immediate business decisions being made by financial services firms. Thus, it has been reported that Goldman Sachs may divest itself of its bank holding company charter in order to avoid the impact of the provision in the act that prohibits a bank from owning more than a three percent (3%) stake in any private equity group or hedge fund[iv]. However, for most financial services firms, the next few years will be devoted to constantly monitoring the proposed rules that will issue from the various regulatory agencies. Thus, it has been reported that J.P. Morgan Chase has over 100 teams already assigned to reviewing the legislation and future regulations in order to assess their impact on JPMC[v]. For example, under the “Swaps Pushout Rule” of the Act, a “major swap participant” will be denied certain types of “Federal assistance”[vi]. However, securities lawyers already have differing opinions as to how the SEC and CFTC will define who is a “major swap participant”[vii].

In addition, the Act and subsequent regulations may serve as a launching pad for future expansion of federal regulation into the financial services industry. It has been conjectured, for example, that the creation by the Act of the Federal Insurance Office within the U. S. Department of the Treasury is just the first step towards the creation of an optional federal charter for insurance companies[viii]. The House Committee on Financial Services reportedly will debate the creation of an optional federal charter for insurance companies in 2011[ix].

Senator Dodd has frankly admitted, “No one will know until this is actually in place how it works.”[x] It could be added that the expansion of federal regulation into the financial services industry may not be over even with the passage of the Dodd-Frank legislation and the agencies’ issuance of related regulations. As Bette Davis famously said in the classic movie “All About Eve”: “Fasten your seat belts, it’s going to be a bumpy night!” Only, for the financial services industry, this “bumpy night” could last for years.

__________________

[i] See Davis Polk Summary of the Act at http://www.davispolk.com/files/Publication/7084f9fe-6580-413b-b870-b7c025ed2ecf/Presentation/PublicationAttachment/1d4495c7-0be0-4e9a-ba77-f786fb90464a/070910_Financial_Reform_Summary.pdf and Implementation Timeline Deck at http://www.davispolk.com/files/Publication/bc70cd4c-c6bd-472d-ad37-0a63481fe36a/Presentation/PublicationAttachment/6a2f81d8-d5c5-4d5d-9b97-fef48b6821e6/070910_Implementation_Slides.pdf. The Davis Polk summary notes on page 3 (of 130 pages) that the estimated number of regulations is based on explicit references in the Act and is likely to be a “significant underestimate.”

[ii] See http://online.wsj.com/article/SB10001424052748704288204575363162664835780.html.

[iii] See http://www.chamberpost.com/2010/07/financial-regulatory-reform-uncertainty-grows.html.

[iv] See http://www.theatlantic.com/business/archive/2010/06/dodd-frank-bills-volcker-rule-a-win-for-big-banks/58747/. See also, page 47 of 130 of the Davis Polk Summary of the Act.

[v] See http://www.fow.com/Article/2632162/Dodd-Frank-is-herecertainty-is-years-away.html.

[vi] See page 51 of 130 of the Davis Polk Summary of the Act.

[vii] See, e.g., http://www.risk.net/risk-magazine/news/1722952/dodd-frank-passes-leaves-questions-unanswered and page 52 of 130 of the Davis Polk Summary of the Act.

[viii] See, e.g., http://www.financetech.com/feed/showArticle.jhtml?articleID=225900059&cid=RSSfeed_FTN_All.

[ix] See http://insurancenewsnet.com/article.aspx?id=205842.

[x] See http://www.washingtonpost.com/wp-dyn/content/article/2010/06/25/AR2010062500675_pf.html.

Jeff Jinnett: Directors of Public Companies No Longer “Parsley on the Fish”

AnnaVAubry — Tue, 29 Jun 2010 20:28:00 GMT

Irving Olds, Chairman of U.S. Steel from 1940-1952, once opened a speech by declaring, "Directors are like the parsley on fish – decorative but useless.” The perceived importance of directors has changed radically since the time of that speech as a result of the Sarbanes-Oxley Act and New York Stock Exchange listing requirements. The role of directors on boards may change radically once again as a result of financial reform legislation that has just passed out of a Senate-House conference and that is expected soon to be voted on and enacted into law[i].

The first radical increase in the perceived importance of the role of directors of public companies was due to the passage of the Sarbanes-Oxley Act of 2002[ii], which, among other things, requires the audit committee to be directly responsible for the appointment, compensation, and oversight of the corporation’s outside auditor. The New York Stock Exchange followed up on the Sarbanes-Oxley Act mandates by imposing requirements on listed companies that mandate a minimum number of independent directors be serving on the board of directors itself and on specific committees, such as the audit committee. In addition, the directors serving on the audit committee must satisfy specified financial literacy standards[iii].

Despite the substantial changes introduced by the Sarbanes-Oxley Act and NYSE listing requirements, industry experts have noted that shareholders of public companies still may not be well represented by their boards. As one commentator noted:

“Today, directors certainly have many more duties than in Olds’ time, and they have already been a focus of structural and legal reforms such as the Sarbanes-Oxley Act and exchange rules on director independence – reforms and rules aimed at preventing yet more leadership failures in our largest companies. The problems were compounded by compensation systems that encouraged short-term strategies and excessive risk-taking…Scandal and reform. Rinse and repeat…human beings will always be the weakest link in that tenuous chain that begins with investment capital and ends in sustainable profits…Boards carry bad directors – those who leave their spines and better judgment at the door – far too long.”[iv]

The pending financial reform legislation appears designed to address these concerns. As a result of the recent credit crisis, the pending reform legislation contains provisions aimed at increasing board transparency, eliminating compensation incentives for management to focus on risky, short-term strategies, and increasing the ability of shareholders to elect directors who will be more mindful of their interests than the interests of management. Thus, the proposed financial reform legislation reportedly[v] would, among other things:

give shareholders, under certain circumstances, a non-binding vote on executive compensation
mandate independent board compensation committees with the authority to hire compensation consultants
prohibit members that are not beneficial owners of a security (e.g., brokers) from granting a proxy to vote the security in connection with a shareholder vote for the election of directors, executive compensation or any other matter deemed significant by the SEC, unless instructed by the beneficial owner, and
authorize the SEC to issue rules granting shareholders access to management’s proxy statement for the purpose of nominating directors to the board

These proposed changes, if enacted into law, will increase the likelihood that large institutional shareholders, at least, will be able to nominate and elect independent directors who would tend to keep their interests in mind while still honoring their fiduciary duty to the company as directors. For example, the California Public Employees’ Retirement System (CalPERS) has created a “Diverse Director Database” in order to recruit independent directors that CalPERS can nominate for election to boards that CalPERS deems to be poorly performing[vi].

One possible information technology impact of these corporate governance reforms is the need to design and implement intranet and extranet portals with dashboards, business intelligence tools, databases, and archives for the exclusive use of the Board of Directors and its committees, such as the audit, nominating/governance and compensation committees. These portals would have security and access controls designed to insulate Board activities and information from unauthorized access by management and other company personnel. Limited access, however, would be permitted for personnel such as chief compliance officers reporting directly to the board or audit committee, compensation consultants advising the compensation committee, legal counsel to the board and the independent auditors of the company reporting to the audit committee.

[i] See, e.g. http://online.wsj.com/article/SB10001424052748703485304575330373406264584.html. .

[ii] See http://www.mayerbrown.com/public_docs/Sarbanes_Oxley_Act_2002.pdf and generally, http://www.mayerbrown.com/sarbanesoxley/.

[iii] See http://www.nyse.com/regulation/nyse/1101074746736.html.

[iv] See David Zweig, “The Board That Couldn’t Think Straight”, The Conference Board Review (Winter 2010), located at http://www.tcbreview.com/board-couldnt-think.php. .

[v] See, e.g., http://jimhamiltonblog.blogspot.com/2010/06/house-senate-conference-reports-out.html.

[vi] See http://online.wsj.com/article/SB10001424052748703513604575310944269110772.html.

Sai Sireesh: Journey to Regulatory Vision 2020 - Prescriptive Enforcement

AnnaVAubry — Mon, 21 Jun 2010 20:00:00 GMT

The continued wave of Systemic Risks in Greece and now increasingly Spain, the environmental disaster threaten to shatter the relative financial and economic calm in the business world. Amidst this many countries are undergoing some major changes in the regulatory landscape as a result of the events in the last two years.

As I mentioned in one of my previous blogs, the age of “light touch “ supervision has certainly shifted towards the more heavy handed and “ Prescriptive and Intrusive” regulation for a few years to come. These changes will have profound impact on the Risk and Compliance practices to come across all industries and sectors.

With increasing clamor for more operational risk, environmental compliance and disaster management oversight for Oil and Gas, there certainly will be some big changes to come in the Oil and Gas regulations.

This week has particularly seen many announced changes in the financial sector with fairly global impact, given the influence of some of these regulators across borders.

Continuing from my last blog on Regulatory Vision 2020, I cover off a few of these developments:

1. Ireland - Irish Financial Services Regulatory Authority plans to reveal its plans to enhance and intensify the regulation of banks from the previous light touch supervision. As per initial reports this will be more prescriptive and intrusive. Next week the authority will release its report. The report is expected to cover off some of the enhancements such as:

Liquidity Buffers
Remuneration & Pay
Operating Procedures
Counterparty Exposure Limits
Sector based Loans exposure limits
Loan to Value caps on mortgages

There are also discussion on a Bad banks or Failed banks mitigation plan. These would establish some norms for managing at a national level the failed and at risk banks. Another area would be the cross border supervision and tightening oversight of the global banks that operate out of Dublin’s International Financial Services Center. It will be interesting to see as to how the authority balances out the financial sector promotion with prescriptive supervision. Like many other offshore centres, IFSC has in the past offered many incentives like low corporate-tax rates, lighter touch supervision, faster approvals etc.

2. London - The recent political change in UK has directly impacted the financial sector much earlier than expected. Currently UK’s Financial Services Authority (FSA) is the independent oversight regulator spun off from Bank of England (BOE) in 1998 – a model that many other countries around the world followed. This week FSA functions were split across 3 new agencies and its role eliminated. BOE will its inherit prudential supervision role. The Bank of England governor Mervyn King is expected to drive enhanced regulatory approach. The dual focus for BOE would be Monetary policy and Systemic risk. The FSA was split into:

BOE Subsidiary - Prudential Regulatory Authority
New Agency - Law Enforcement
New Agency - Consumer Protection

In addition, an independent commission is also established to reshape the banking sector and recommend structural changes to manage the too big to fail banks in future. The decision on separation of investment banking from retail banking is still up for consideration.

3. Switzerland - After long and iterative deliberations, the Swiss parliament approved a law that allows the Swiss government to hand over names of US tax evaders to the US tax authorities. This has profound implications on the need for balance between local country banking secrecy laws and cross border regulatory /taxation/anti money laundering oversight needs. It is too early in my opinion to judge the impact of this on the overall banking secrecy act but it certainly puts pressure on other financial wealth and offshore centres around the world to be more transparent.

4. EU agree on Stress Testing disclosures - EU agreed to subject their public banks to stress tests results and disclose results. Each country will publish results of national stress testing on all its banks once completed. Test results are to be published be end of July. This will provide transparency on Europe’s big banks to debt in Greece, Portugal and Spain. The new stress tests will provide more details compared to the broad October 2009 European stress testing of its entire banking sector, not for individual countries or banks. The results in autumn 2009 gave a pass to the banks against worse case economic downturn. The new 2010 parameters for stress testing across all 27 countries need to be agreed upon. But, I do expect that Europe's 25 biggest banks will be subject to these stress tests.

5. Spain - Bank of Spain proactively has completed its industry wide stress testing to reinforce its banks solvency strengths. The results are to be released in next few days. The following are part of the Bank of Spain efforts - Restructuring of financial system, budget adjustment, public pension reform.

6. Asia - Central banks in both South Korea and Indonesia have introduced stricter capital controls to better manage global capital swings.

There is a lot happening in the US around financial regulations. But more on that in another blog!

Jeff Jinnett: Amendments to U.S. Federal Sentencing Guidelines as to What Constitutes an Effective Compliance and Ethics Program, to Take Effect on November 1, 2010

AnnaVAubry — Tue, 15 Jun 2010 18:49:00 GMT

On April 7, 2010, the United States Sentencing Commission[i] voted to modify the U. S. Federal Sentencing Guidelines' standards for what constitutes an “effective compliance and ethics program”[ii]. The Sentencing Guidelines are consulted by judges in connection with companies found guilty in federal court of having violated U.S. federal law in order to determine appropriate penalties to impose, such as monetary fines, prison terms for corporate officers and/or court-supervised remedial compliance programs. However, if a company is found by the court to have had an “effective compliance and ethics program” in place, the penalties to be imposed on the company by the judge are reduced. The new amendments will take effect on November 1, 2010, unless the U.S. Congress passes legislation rejecting the amendments.

Under Section 8B2.1 of the Federal Sentencing Guidelines, an “effective compliance and ethics program” would require a company to, among other things:

exercise reasonable oversight through its board and officers to implement the compliance program in an effective manner
not place in authority any person that the company knows, or should have known, was engaged in criminal or unethical activities
train all employees, officers and directors on the compliance program's standards and guidelines and establish a confidential “hot line” for the anonymous reporting of criminal or unethical conduct
establish appropriate incentives and disciplinary measures in support of the program
establish standards and guidelines to detect and prevent criminal conduct
monitor and audit the effectiveness of the compliance program
immediately respond in an appropriate manner to discovered criminal conduct and act to prevent further criminal conduct

The recent amendments include new guidance as to self-reporting, cooperating with authorities, and the prevention of further criminal conduct by taking steps to assess the future risk of criminal conduct. One critical change that should be highlighted is that in the past, companies have been denied credit for maintaining an effective compliance program (and denied a reduction in penalties), because one or more of their directors, officers or other high-level personnel participated in or condoned the criminal conduct or were willfully ignorant of the criminal conduct. The new amendments to the Sentencing Guidelines permit a company to receive a reduction in criminal penalties despite the involvement of high-level personnel in criminal conduct, if the company has met the following four criteria:

The head of the compliance program reports directly to the board of directors or the board audit committee;
The compliance program uncovered the criminal conduct before discovery outside the company was reasonably likely;
The company promptly reported the criminal conduct to the company’s regulator or other appropriate governmental authority; and
No compliance officer participated in or condoned the criminal conduct, or was willfully ignorant of the criminal conduct

In light of these new amendments to the U.S. Federal Sentencing Guidelines, companies should strongly consider establishing a compliance portal and related compliance records archive prior to November 1, 2010 for the collection of information necessary to operate a compliance program that would satisfy the key elements of what constitutes an “effective compliance and ethics program” under Section 8B2.1 of the Sentencing Guidelines. The portal also could be used to support the risk assessment activities recommended to be undertaken under the amendments to the Sentencing Guidelines. Microsoft SharePoint Server 2010[i] is well-suited for such a compliance portal due to its robust communication and collaboration, business intelligence, records management and search capabilities.

In addition, the company’s chief compliance officer could be authorized to report directly to the company’s board of directors or the board audit committee using the portal to produce reports and information requested by the board. In light of the new amendments to the Sentencing Guidelines, Companies may wish to move away from other reporting structures, such as where the chief compliance officer produces reports for the General Counsel, with the General Counsel filtering the reports and deciding which information to report up to the board of directors or audit committee. Reporting structures where the chief compliance officer does not report directly to the board or the audit committee would not satisfy the new penalty reduction provisions under the amended Sentencing Guidelines in the event that one of the company’s high-level personnel participated in, condoned, or was willfully ignorant of the discovered criminal conduct. A side benefit of having the chief compliance officer utilize the portal would be that the General Counsel and other C-level officers with a need to be “kept in the loop” could be given access to the compliance portal without interfering with the compliance officer’s direct line of report to the board or audit committee.

[i] See http://www.ussc.gov/guidelin.htm.

[ii] See http://www.ussc.gov/2010guid/20100503_Reader_Friendly_Proposed_Amendments.pdf, beginning at page 32.

[iii] See http://sharepoint.microsoft.com/en-us/Pages/default.aspx.

Sai Sireesh - Regulatory Vision 2020 - Top 10 list

AnnaVAubry — Tue, 08 Jun 2010 18:36:00 GMT

I am a keen follower of the Australian regulator APRA that in my mind certainly ranks amongst the thought leaders in regulatory thinking. APRA has been at the forefront of many new regulatory concepts and pro-active adoption. Its current focus is on 3 major areas - Financial stability and systemic risk, Group Supervision, Remuneration. Their approach to reform being best captured by how they term it – “ just right‟ – "not too much, not too little.“

Below is the my list of 10 areas that will serve as foundation for APRA’s 2010-2020 blueprint. This list is based on my reading of their consultative papers and speeches in 2010.

Twin Peaks model - Continued enhancement and evolution of the twin peaks regulatory model – APRA (Australian Prudential Regulatory Authority) and ASIC (Australian Securities and Investments Commission)
Risk of Complacency - Proactive watch against risk of complacency by maintaining the intensity of supervisory rigor in their own activities as well as industry
Financial stability and systemic risk – APRA has an active role in the G20 Financial Stability Board as well as IAIS coordinated Financial Stability Task Force to review principles around - quality of liquid assets, longer survival horizon, longer-term funding
Inherent pro-cyclicality in prudential frameworks
Means to address the “too big to fail” problem
Concept of macro-prudential supervision and surveillance
Effective cross-border cooperation
Group Supervision – legislative power, effective regulatory frameworks, supervision capability for conglomerate groups
Risk Management oriented Sound Remuneration Policies and related Prudential Requirements
MOU on financial distress management with other regulatory bodies– both within country and cross border

I have tried my best to capture the essence of their thinking, let me know if I have done full justice to their thought leadership or not!

Source: APRA consultative papers and speeches:

Role of the Prudential Regulator 2010-2020, Helen Rowell, GM, Policy Development
Reform of Global Banking Regulation – Wayne Byres, Exec. GM, Diversified Institutions Division
Regulatory Update 2010 – John Trowbridge, Executive Member, APRA

Jeff Jinnett: Towards a Structured GRC Taxonomy

AnnaVAubry — Tue, 01 Jun 2010 16:39:00 GMT

Although governance, risk management and compliance laws and regulations may vary greatly depending on the jurisdiction, issuing authority, regulator and target industry, there appear to be certain common GRC issues that can be used to group mandates into categories. For example, the following nine GRC issues (with examples) may represent a useful taxonomy for the key common GRC issues: (1) corporate governance, (2) risk assessment and risk management, (3) privacy & security, (4) documentation, (5) records and information management, (6) audit and controls, (7) reporting, (8) certification, and (9) know your customer.

1. Example of Mandates Dealing With Corporate Governance:

Sarbanes-Oxley Act: See, e.g., Title III, Section 301 (“Public Company Audit Committees”) and Title IV (“Enhanced Financial Disclosures”), Section 407 (Disclosure of Audit Committee Financial Expert)

2. Example of Mandates Dealing With Risk Assessment and Risk Management

Sarbanes-Oxley Act: See, e.g., Section 404 (“Management Assessment of Internal Controls”), which can be supplemented by the COSO Enterprise Risk Management (ERM) Framework, as per SEC Release Nos. 33-8238 and 34-47986, located at http://www.sec.gov/rules/final/33-8238.htm.
HIPAA: See, e.g., HIPAA Security Rule, Section 164.308(a)(1)

3. Example of Mandates Dealing With Privacy and Security

HIPAA: See HIPAA Privacy Rule and HIPAA Security Rule

4. Example of Mandates Requiring Documentation

Sarbanes-Oxley Act: Sarbanes-Oxley Act: See Title IV (“Enhanced Financial Disclosures”), Section 404 (“Management Assessment of Internal Controls”) which requires the documentation of internal controls
HIPAA: See, e.g., requirement to develop a written contingency plan, disaster recovery plan and data backup plan, pursuant to HIPAA Security Rule, Section 164.308(a)(7); see also HIPAA Privacy Rule, Section 164.530(j)(1)

5. Example of Mandates Dealing with Records & Information Management

Sarbanes-Oxley Act: See, e.g., Title I, Section 103(2)(A)(i) (“Auditing, Quality Control, and Independence Standards and Rules”) and Title XI, Section 1102 (“Tampering With a Record or Otherwise Impeding an Official Investigation”)
HIPAA: See, e.g., HIPAA Privacy Rule, Section 164.530(j)(2)

6. Example of Mandates Dealing With Audit & Controls

Sarbanes-Oxley Act: See, e.g., Title II (“Auditor Independence”), which impacts how audits are performed for the company
HIPAA: See, e.g., requirement to obtain a third party security evaluation, pursuant to HIPAA Security Rule, Section 164.308(a)(8)

7. Example of Mandates Requiring Reporting

Sarbanes-Oxley Act: See, e.g., Title IV, Section 404(b) (“Management Assessment of Internal Controls”), which requires the auditor to prepare an attestation report on the internal control assessment of the company’s management; see also Title IV (“Enhanced Financial Disclosures”), Section 409 (“Real Time Issuer Disclosures”), which requires the issuer to disclose to the public on a “rapid and current basis” any material changes in the issuer’s financial condition or operations
HIPAA: See, e.g., HIPAA Privacy Rule, Section 160.310(a)

8. Example of Mandates Requiring Certification

Sarbanes-Oxley Act: See, e.g., Title IX, Section 906 (“Corporate Responsibility for Financial Reports”) (CEO/CFO certifications as to financial reports)
HIPAA: See, e.g., covered entity’s self-evaluation, pursuant to HIPAA Security Rule, Section 164.308(a)(8)

9. Example of Mandates Dealing With “Know Your Customer”

USA Patriot Act: See, e.g., Section 326 (“Verification of Identification”)

In order to better understand the IT and business impact of international, U.S. Federal and state laws and regulations, it could be helpful to create a database of the various laws and regulations, classified based on the above GRC categories. This would then enable corporate users of the database, for example, to analyze the overlap and duplication of all laws and regulations that require them to engage in risk assessment and risk management activities. After this analysis has been completed, the corporate users will be better prepared to apply risk management IT solutions in a focused manner against the combined and distilled risk assessment requirements of all their applicable mandates.

Sai Sireesh: Pro-active Systemic Risk Mitigation by German Regulator BaFin

AnnaVAubry — Mon, 24 May 2010 19:07:00 GMT

There is increased speculation against euro over concerns of euro zone sovereign debt levels triggered by the Greek debt refinancing crisis. The euro has already hit a four year low of $1.2209. As expected and predicted in one of my earlier blogs, this crisis is forcing the shift much more aggressively towards water tight regulation mode from light touch supervision mode to ensure market stability, transparency and systemic risk management.

This week the German Federal Financial Supervisory Authority (BaFin) temporarily prohibited naked short sales of euro debt securities, naked short selling of shares in 10 leading German financial institutions, and naked transactions of credit default swaps (CDS) linked to euro government debt. The bans apply from May 18 2200 GMT to March 31 2011, 2200 GMT. This does not impact transactions in the specified shares that are backed by securities lending.

The 10 firms being:

Aareal Bank AG	Allianz SE
Commerzbank AG	Deutsche Bank AG
Deutsche Boerse AG	Deutsche Postbank AG
Generali Deutschland Holding AG	Hannover Rueckversicherung AG
MLP AG	Muenchener Rueckversicherungs-Gesellschaft AG

Earlier in March, BaFin also issued mandated that market participants notify it of any net short-selling positions in the same financial stocks of a threshold of 0.2 % or more and publish the same of a threshold of 0.5 % or more. This allowed BaFin to intervene sufficiently in advance and swiftly, against short-selling transactions that may trigger systemic risks. The provision provides for a two-tier transparency system: first, net short-selling positions of 0.2 % or more of the shares in issue of the specified companies must be notified to BaFin. Further notifications are required when such positions reach, exceed or fall below a further 0.1 % in each case. In addition, a publication of the position in anonymous form on the homepage of BaFin for 0.5 % or more.

This decree, aligns to the proposals published on 2 March 2010 by the Committee of European Securities Regulators (CESR), that include Bafin, for a pan-European transparency system for net short-selling positions. Paris-based CESR’s role is to coordinate national market regulators and make policy recommendations to the EU on securities regulation.

I was expecting other EU block nations to synchronize or follow suit for a wider impact, but has not happened yet. But there are similar discussions or measures in place in selected EU countries. Austria’s finance ministry is calling for talks on long- term regulation of credit-default swaps and naked short-selling of sovereign debt. Portugal restricts naked short-selling as far back as 2008 onwards. France and Austria restrict short selling of financial shares from 2008 onwards. Germany, along with the U.S. and other EU nations, has also banned short selling of banks and insurance company shares in 2008. BaFin had lifted its ban in January and reinstated it back now.

Certainly many more regulatory changes are coming (today’s USA reforms proposal) but for this particular regulatory effort, my key takeaways are:

Underscores the challenge the ambitious new EU Systemic Risk council will have in executing its charter and blueprint to manage systemic risk across EU.
Perhaps there is a regulatory arbitrage opportunity given that the ban applies to deals executed on German market? Maybe not, but we shall see.
Surveillance Technology - I will be talking to my middle office/market risk contacts to see how the front office trading control rooms/compliance process works to handle the naked short sell ban for specific instruments. Beyond manual instructions to Money Market, Equities, and Structured Products desks & traders, would firms look at front office trading systems technology to enforce automated alerts against trades? Would they use pre-deal positions limits? Would an automated rule trigger a BaFin reporting flag alert if positions breach the prescribed bands?
Increased pressure on governments to pass regulations against speculative practices
Traders with fat fingers being asked to tend gardens and stay away from trading floors (just kidding but an entirely plausible solution !)

Research source: Bafin, Reuters, Dow Jones, Bloomberg

Jeff Jinnett: Prepare for Coming HITECH Act Healthcare Privacy & Security Audits

AnnaVAubry — Mon, 17 May 2010 19:40:00 GMT

The Health Information Technology for Economic and Clinical Health (HITECH) Act[i], signed into law on February 17, 2009, is designed to promote the adoption and meaningful use of health information technology. Subtitle D of the HITECH Act strengthens the civil and criminal enforcement of the privacy and security requirements of the Health Insurance Portability and Accountability Act (HIPAA)[ii]. For example, Section 13411 of the HITECH Act mandates that the U.S. Department of Health & Human Services (DHHS) shall conduct periodic audits of entities covered under HIPAA (e.g., health plans, healthcare clearinghouses and certain medical providers) and their business associates.

HITECH/HIPAA Audits

It has been reported that the DHHS Office for Civil Rights (OCR) will begin conducting HITECH/HIPAA audits later this year[iii]. Reportedly, the audits will check to ensure that covered organizations have completed a risk assessment and have implemented appropriate administrative, technical and physical safeguards in compliance with the HIPAA Security Rule. Audits for compliance with the HIPAA Privacy Rule reportedly will include confirmation that individual rights (e.g., a patient’s right to access her or his medical records) have been upheld by the covered entity.

The HITECH Act strengthened the enforcement penalties of HIPAA by, among other things, (a) increasing the maximum penalties for violations due to willful neglect (e.g., up to $50,00 per violation, with an overall cap of $1.5 million for all violations of an identical requirement or probation during a calendar year), (b) providing that fees collected for violations are retained by the OCR, thus supporting further enforcement efforts, (c) striking the bar on the imposition of penalties if the covered entity did not know and with the exercise of due diligence, would not have known of the violation, (d) having business associates be directly regulated for HIPAA Security Rule enforcement purposes by DHHS, rather than be subject merely to contractual oversight by the HIPAA covered entities, as was the case prior to passage of the HITECH Act, and (e) prohibiting penalties for violations corrected within a 30-day period, so long as the violation was not due to “willful neglect”. The HITECH Act also strengthened certain of the substantive requirements of HIPAA, such as by imposing new security breach notification requirements on covered entities[iv].

Incentives for “Meaningful Use” of EHRs

In addition, the HITECH Act provides for billions of dollars in incentives in order to promote the improvement of the healthcare infrastructure and the use of electronic health records (EHRs). For example, physicians and hospitals are to receive monetary incentives if they can demonstrate the “meaningful use” of certified EHR technologies, including existing systems as well as new installations and upgrades.

Recommendation: Seek Privacy & Security Accreditations

Given the announced start of HITECH/HIPAA audits later this year, covered health plans, health care clearinghouses and medical providers (hospitals and physicians) and their business associates (and vendors) should make sure they are ready to undergo an audit and not be found to be in violation of HIPAA and/or HITECH. Audited organizations especially will not wish to be found in violation as a result of “willful neglect”. One step that could be considered by covered organizations is to apply for a HIPAA Privacy Accreditation and HIPAA Security Accreditation from URAC, a leading healthcare accreditation organization[v]. It likely would be exceedingly difficult for any regulator or state attorney general to successfully claim that an entity was guilty of “willful neglect” of its obligations under HIPAA and/or the HITECH Act if the entity’s HIPAA privacy and security program had obtained the URAC accreditation.

Recommendation: Utilize Portal Technologies, Alone and With Certified EHR Technologies

A second step that covered entities might wish to consider is using currently available portal technology to set up a dedicated HITECH/HIPAA site for communication and collaboration (both internally and with external business associates and vendors) and for due diligence and training purposes. For example, Microsoft SharePoint 2010 (which launched on May 12, 2010)[vi], Microsoft SQL Server 2008[vii] and other related Microsoft product offerings[viii] are well-suited to be used for such a purpose, due to their communication and collaboration, privacy and security, record retention, workflow, search and other relevant capabilities. Use of portal technology and related solutions in connection with certified EHR technologies under certain circumstances also could serve to establish “meaningful use” of EHRs in order to qualify for HITECH Act stimulus funding[ix].

________________________________________________

[i] See http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/hitechact.pdf.

[ii] See http://www.hhs.gov/ocr/privacy/hipaa/administrative/combined/index.html.

[iii] See, e.g., http://www.healthcareinfosecurity.com/podcasts.php?podcastID=516&rf=051410ph and http://www.hipaa.com/2010/05/ocr-stepping-up-hipaa-security-enforcement.

[iv] See http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/index.html.

[v] See, e.g., http://www.healthnewsdigest.com/news/Guest_Columnist_710/URAC_Accreditation_Streamlines_HIPAA_Compliance_and_Mitigates_Risk.shtml and http://www.urac.org/programs/prog_accred_HIPAAS_po.aspx.

[vi] See http://sharepoint.microsoft.com/en-us/Pages/default.aspx.

[vii] See http://www.microsoft.com/sqlserver/2008/en/us/R2.aspx.

[viii] See, e.g., the Microsoft Health Portals site at http://www.microsoft.com/industry/healthcare/providers/solutions/portals.mspx; the Microsoft Health Solutions Group site at http://www.microsoft.com/hsg; and the CareGroup Healthcare System case study, at http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?CaseStudyID=4000001003.

[ix] See, e.g., http://healthit.hhs.gov/portal/server.pt?open=512&objID=1325&parentname=CommunityPage&parentid=1&mode=2. .

Sai Sireesh: Next generation Communication Compliance

AnnaVAubry — Fri, 07 May 2010 21:10:00 GMT

The explosion in information channels, and increasing use of Web 2.0 and social media poses new challenges. Financial regulations are trying to keep pace – Social Media compliance, eDiscovery, content protection, acceptable use policies, logging and archiving of messages, Instant Messaging tracking, etc. One way to meet this challenge is to deploy a Unified Communications (UC) server, but there are many related compliance aspects to address. I was recently privileged to participate in an industry webinar with FaceTime Communications Inc. - a specialist firm focused in electronic communication compliance. Facetime Vantage is used by the world's largest firms to ensure security, management and compliance for Unified Communications - from presence and instant messaging to conferencing and voice – to safely enhance business productivity and responsiveness without endangering network security.

I was hosted by FaceTime’s Eric Young, Senior Director of Field services, with rich industry experience in secure, regulated and unified communications. He provide great background for key capabilities that help firms to maximize return on OCS investment. Also addressed were key requirements of a highly scalable architecture for supporting corporate and mobile workers in a UC environment. But my favourite was his list of “Must Have Compliance Requirements for Financial Services”.

From a compliance perspective, takeaways were around four main areas:

Ø Current & emerging electronic communication regulations:

ü E-discovery – Need to manage unstructured electronically stored information – ESI (e-mails, blogs, wikis, electronic and voice communication)

ü Social Media monitoring and compliance – e.g. FINRA 10-06 guideline on social media

ü Surveillance - New aspect of control rooms specially in Broker-Dealer environments. Concept of Voice compliance

ü Cloud – Emerging aspects of secure and compliance interaction & cross border hosting of data, communications

Ø Future of Communications:

ü Across Devices - PC, Mobile, Web

ü On-Premise or in the Cloud

Ø Holistic, Unified approach to compliance

ü Getting complete visibility and reporting over employee use of UC and implementing specific acceptable use policies across all modalities

ü Microsoft approach around Amplify protection and control that comprises – Achieve and maintain compliance, Safeguard sensitive information, Reduce risk of malware and spam

ü Achieve and Maintain compliance – Preserve ata via automated policy for moving, deleting, holding messages; Reduce burden of .PST files with integrated personal archive

ü Achieve and Maintain compliance – Discover data – Search across multiple boxes

Ø Integrated offerings from FaceTime and Microsoft to be secure and compliant

ü Extending the current message retention architecture via FaceTime Vantage to accommodate regulatory and eDiscovery requirements for instant messaging

ü FaceTime Vantage secure and compliance offerings for Microsoft OCS - IM, Group Chat, Voice, Video, Live Meeting

ü FaceTime Vantage integration with Microsoft OCS, Active Directory and other existing network infrastructure technologies

ü Enable and maintain compliance for other Web 2.0 technologies that might already exist in your enterprise, such as social networking via FaceTime Vantage

For more details www.facetime.com and http://www.microsoft.com/uc/en/us/default.aspx

Signing off for now!

Jeff Jinnett: Open Text Content Day in New York City

AnnaVAubry — Mon, 03 May 2010 16:11:00 GMT

On April 21, 2010, I participated as a speaker at the Open Text Content Day, which was held at the Marriott Marquis Hotel in New York City (i). Open Text is one of Microsoft’s strategic partners in the enterprise content management space(ii). Speakers from Open Text at the Content Day included Richard Sheroff, Vice President (Eastern U.S.), James Latham, Chief Marketing Officer, Eugene Roman, Chief Technology Officer, Lubor Ptacek, Vice President, Product Marketing and Peter Near, Senior Director, Product Management(iii). My presentation was entitled “Open Text and Microsoft: Working Together to Keep You Out of the ‘Hurt Locker’” and focused on the potential IT impact of recently enacted and newly proposed U.S. federal and state laws and regulations.

The “Trends and Opportunities” presentation by James Latham set up a vision of the future that laid the framework for the day’s presentations. The Open Text Chief Marketing Officer sees a mobile, “mashed up” and multicultural future where:

social media (e.g., Facebook and vmails) will overtake traditional media (e.g., newspapers and emails) in connection with storage requirements
users will decrease use of text keyboard entry in favor of multimedia touch entry
customers will increasingly use mobile access rather than desktop access
content will be accessed in an “immersive” technology experience rather than through a traditional file hierarchy
search on the Internet will be more intuitive and accurate in order to retain users; and
customers will increasingly require ready access to influential content, rather than merely relevant content

Eugene Roman, Open Text’s Chief Technology Officer, highlighted in his presentation the technology impact of these trends and the increasing importance of the “cloud” for housing, managing and distributing all types of content from traditional to multimedia, for access at home, at work or on the go. He also noted the increasing importance of regulatory compliance, privacy and security issues for cloud offerings as a prerequisite for ensuring customer confidence. Reiterating the theme of an increased need by customers for valuable and influential content, he explored the possibilities for using technology to deliver industry-specific ECM solutions. Closing out the morning of presentations was a panel discussion and audience Q&A that included all of the Open Text keynote speakers, together with John Shackleton, President and CEO of Open Text. After the morning of presentations and the Open Text panel discussion, the afternoon of breakout sessions included some very valuable presentations by Open Text and Microsoft customers, such as Aramark, Johnson & Johnson and Becton, Dickinson and Company.

The annual Open Text Content World is scheduled to take place in Washington, D.C. from November 7-12, 2010(iv). As a speaker and attendee at last year’s Content World, I can recommend the event without reservation for Microsoft and Open Text customers and for companies seeking information on the design and implementation of a forward-looking approach to enterprise content management. In light of the many significant bills under consideration in Congress that are likely to have become law by next November, the selection of Washington, D.C. as the venue for the next Open Text Content World appears to be a smart choice.
________________________

(i)See http://www.opentext.com/2/global/events-contentdays-newyork.

(ii)See http://www.microsoft.com/business/enterprise/alliancepartner/opentext.mspx

(iii)For the slide decks of the various presentations, see http://communities.opentext.com/communities/llisapi.dll/open/NYContentDays2010

(iv)For registration information on Open Text Content World 2010, go to http://opentext.cvent.com/EVENTS/Info/Summary.aspx?e=2492a69e-634a-4a92-a2a2-f10cd9d8422f&source=CW2010home2.