This Often-Overlooked Department Deserves a Seat at the Decision-Making Table If your business aims to be nimble in its growth strategies, including geographical expansion, a cutting-edge compliance department has become more vital than ever.
By Yair Kuznitsov Edited by Matt Scanlon
Opinions expressed by Entrepreneur contributors are their own.
Any leader reading this has likely had the following experience: There's a board room with a long mahogany table, at which sits the C-suite, VP of marketing, VP of sales, the CIO and assorted board members. In this room things are happening — tough choices are being hashed out and strategies for the future made.
These decisions could be regarding new verticals to enter, new lines of business to undertake and new ideal customer profiles (ICPs) to envision, and all parties in attendance are there to put their heads together and devise the best approaches. The marketing VP wants to make sure that the best go-to-market strategy will be in place to enter these new verticals/regions/line of business, etc. The sales VP wants to ensure that there is enough interest and potential use cases, while the C-Suite cares about the ROI, and so on.
Each party must ensure that their pathway for entry into this uncharted territory is built on solid ground. This means establishing that they have the resources needed to ensure success, at least as far as their own department and responsibilities are concerned.
The too-often-missing member
One department frequently omitted from this exclusive invite list is security compliance. Tasked with ensuring companies adhere to external (and sometimes internal) security frameworks and regulations, this group isn't usually top of mind when it comes to making high-priority decisions regarding the future of a company. In fact, compliance is more often seen as a hurdle to be bypassed — a collection of bothersome activities to be addressed as effortlessly as possible, but failing to address compliance concerns at all or doing so at the very last moment leaves an organization open to risk and disappointment.
Related: An Entrepreneur's Guide to Compliance
Why is compliance important?
In a world where reputation and customer trust are key facets of growth, ensuring both remain pristine is everything. Optimally adhering to compliance is an organization's ticket to demonstrating a deep commitment to both upholding and ever-improving upon high standards when it comes to protecting its own data and that of its customers.
And that's just one reason why it should be a priority. Compliance done right also serves as a powerful business accelerant. Conversely, when it's not taken into consideration from the initial stages, it will likely become a business blocker.
How so?
Imagine that the decision makers at the top have determined that there is a strong interest and need for their service/product in a new geographic area, Australia perhaps. But to do business in this new region, that organization needs to adhere to local security compliance standards. One vital consideration is then how long will it take to meet the country's Essential Eight - Australian Signals Directorate (ASD) framework, the Prudential Standard CPS 234 or any of the other applicable standards. Failing to understand how easily (or not) applicable frameworks can be met is a game-changer for companies that expect to regionally-pivot quickly.
Another example: A company that manufactures microchips has just determined that it wants to sell to the medical device industry. Does it need to be HIPAA compliant? What about HITRUST; how long will it take for it to reach these standards, if they are indeed relevant at all?
Related: Making Data Security Compliance a Revenue Driver
In some cases, senior management and the board of directors might even give up on plans if the price for meeting compliance standards (then staying compliant) is going to be higher than the value this business is expected to be. For example, while the choice of whether or not to go public might sound like a no-brainer, in order to do so, Sarbanes–Oxley Act (SOX)-mandated corporate record keeping and reporting mandates must be met, which is both highly complex and time- and resource-consuming. If the company is too far away from being able to fulfill the requirements, they might just delay an IPO.
Whether consciously or not, when a company takes on new opportunities, it has also made the decision to take on new frameworks, and often new regulations. Along with these new compliance audits come new controls and other processes. This becomes an embedded decision, and organizations must know what resources will be required and how their existing program can be optimized so that they can enter new markets/verticals/lines of business with reduced friction.
This is why compliance must be connected to business decisions and why it's so critical that it has a seat at the table. Whether a company wants to enter into a region, line of business or industry, it is the pathway to accessibility.
Related: What Your Company Gets Wrong About Compliance
With compliance as a key element of the decision-making process, companies can run faster while protecting brand reputation and solidifying customer trust. Theirs is a voice that's incredibly worthy of being heard and listened to.
