After one of the most difficult economic years in U.S history, businesses are bracing themselves for what challenges 2021 will bring. With a new administration incoming, and the possibility of a democratic senate, the potential for broad federal data privacy legislation seems almost imminent as the interest of consumer data privacy continues to take a front seat to the commercial exchange of it.

In ZenGRC’s webinar How the U.S. Election Could Alter Privacy Requirements, GRC expert Dr. Maxine Henry walked through California data legislation changes expected to go into effect as soon as next month as well as what November’s election and potential federal data privacy legislation could mean for businesses who buy and sell consumer data.

Preparing your business for amendments to existing legislation or that which is forthcoming can seem arduous. This in mind, Dr. Henry offered 12 steps every business can take to demonstrate compliance with regard to data privacy laws:

1. Determine if you are in scope: With regard to existing laws, the first step is to simply identify whether or not they apply to your business. Revenue and the amount of consumer data your business buys and sells play critical roles in determining your eligibility. 
2. Identify and map your data: Assuming your business does fall within scope, you’ll want to conduct a thorough mapping of what type of data you collect, why you collect it and where it’s kept. 
3. Identify any exemptions: Certain types of businesses are not required to comply wholly or at all with data privacy legislation. If your business falls within that category, identify and articulate why some or all of your data would not be subject to legislation requirements. 
4. Manage your vendors and service provider relationships: Create and continually update documentation that lists, explains and justifies all contracts and relationships that have anything to do with the exchange of consumer data — including what type of data is being shared and transmitted, and the nature and purpose of its exchange.
5. Manage privacy notifications: Each law requires your participation in displaying specific privacy notifications on digital properties including your website. These notifications change constantly, and it is the responsibility of each business to manually update in compliance with law requirements.
6. Data subject access request: Create a process for responding to data subject access requests, should you be subject to an audit. Data privacy acts have clearly articulated time frames under which you will be required to provide your data without error or extension.
7. Update policies and procedures: Establish an annual review, audit, update and rollout of your data privacy policies and procedures to ensure your policies and procedures remain in compliance as legislation and requirements evolve. 
8. Security controls and data protection mechanisms: In the event your business is audited, the first and most critical component you’ll be measured on is the quality of your security controls and data protection mechanisms. It is critical you establish a process to establish and carry out these measures to protect consumer data as much as possible. 
9. Data breach management: Create, update and implement a documented data breach management plan. This includes building and acting out myriad data breach scenarios at least annually with the proper resources and staff, assuming specific roles and responsibilities in each given scenario.  
10. Training and awareness: Establish a documented, comprehensive training and awareness program requiring each employee to be certified annually, and be sure this certification is available as evidence in the event of an audit. 
11. Adopt a GRC system: Simplify and streamline the entire process of managing risk and compliance. Reduce time-consuming manual tasks by leveraging an integrated and automated information security solution.  
12. Assessments and audit: Periodically conduct internal audits of your existing privacy programs to identify vulnerabilities and opportunities for improvement proactively, prior to an audit or breach.

With the current congress session ending in December, the need to prepare your company for the potential legislative impact on how, where and why you use consumer data has never been more critical. To learn exactly what changes we know are coming, what we can predict and what you need to do to ensure your business is fully prepared, watch Dr. Henry’s webinar How the U.S. Election Could Alter Privacy Requirements in its entirety.

An FCPA compliance program checklist outlines the things an American company needs to check when it wants to do business in a foreign country to ensure it follows the guidelines of the U.S. Foreign Corrupt Practices Act (FCPA) of 1977.

The FCPA is a federal law that aims to prevent all U.S. companies and their officers, directors, employees, and agents from making corrupt payments to foreign government officials to retain or obtain business. 

Agents, including consultants, third-party business partners, distributors, and joint ventures, are also subject to the FCPA’s anti-bribery provisions. The FCPA also applies to foreign companies with subsidiaries in the United States, that do business in the U.S., or whose transactions go through the U.S. banking system

FCPA violations can also occur if companies make payments to non-government third parties acting for or on behalf of foreign government officials. 

In addition to the anti-bribery provision, the FCPA also has specific accounting transparency requirements mandating that every company that reports to the SEC maintain accurate books and records and have a system of internal controls. 

Corporations that don’t comply with the FCPA could be hit with huge government fines, and individuals could be fined and imprisoned. The SEC and the DOJ (U.S. Department of Justice) are jointly responsible for FCPA enforcement actions. The FCPA is the most enforced U.S. anti-corruption law.

Follow an FCPA Compliance Checklist

An organization can avoid an FCPA violation by following an FCPA compliance checklist. The DOJ and the SEC evaluate the adequacy of a company’s compliance program. The key factors they look at to determine whether an organization’s compliance program is effective are training, risk assessment, and corporate policies.

Before companies draft their compliance programs they should conduct comprehensive risk assessments. 

The risk assessment should identify key risk areas, including where they have significant dealings with foreign officials and workers of state-owned companies; business units operating in countries with high levels of supposed corruption; locations where anti-corruption concerns have been identified in the past, and business operations that depend heavily on third-parties, such as agents, business partners, and distributors.

The DOJ and the SEC don’t establish the requirements for a compliance program because there isn’t anyone compliance program that can meet the needs of every business. Therefore, each company will formulate its own compliance program based on its size and risk exposure.

What to Include in an FCPA Compliance Checklist

To help organizations design effective compliance programs, the FCPA recommends that a compliance program include the following: 

• A clear policy that prohibits FCPA violations and violations of other applicable anti-corruption laws.
• A commitment from senior management that trickles down through the organization.
• Compliance program policies and procedures that detail proper internal controls, auditing practices, and documentation policies.
• Communicate the compliance program policies and procedures throughout the organization.
• Clear disciplinary measures for violating compliance policies and procedures. Encourage employees to adhere to compliance policies and procedures and offer compliance incentives.
• Employees in charge of oversight should be separate from management and have sufficient resources to implement the compliance program correctly.
• Regularly assess third-parties, including business partners, and inform them of the company’s compliance program and code of conduct.
• A whistleblowing mechanism based on confidentiality where employees can report possible FCPA violations without being afraid of retaliation. After an internal investigation, an organization should update its compliance program and internal controls.
• Review and update the compliance program and internal controls regularly because the business environment is constantly changing.

Additional Questions to Ask

As they assess and improve their compliance programs, companies should also consider these questions:

• Do you periodically analyze the results of your investigations to look for patterns of wrongdoing or other red flags that could indicate weaknesses in your FCPA compliance?
• How often and how do you measure your culture of compliance?
• How do you determine which FCPA complaints or red flags you should investigate further? Red flags are conditions or activities that increase the chances of possible FCPA violations.
• How do you determine who should conduct an investigation of potential FCPA violations? Who makes that determination?
• Do you have a process to monitor the outcome of your FCPA investigations and ensure accountability for the response to any recommendation or finding?
• Have your supervisors received role-specific or supplemental training?
• Have you conducted a gap analysis to determine whether you’re sufficiently addressing particular areas of risk in your policies, internal controls, and training?
• If you have foreign subsidiaries, are there language or other barriers that hinder your foreign employees’ access to your FCPA compliance program policies and procedures?
• Have you updated your FCPA compliance program policies and procedures in light of the lessons that you’ve learned?
• Do you periodically analyze the results of your investigations to look for patterns of wrongdoing or other red flags that could indicate weaknesses in your FCPA compliance?
• How often and how do you measure your culture of compliance?