Identity Management Compliance

By Henry Bagdasarian

Identity management compliance with regulations can be extremely costly, inefficient, and often ineffective leading to unaddressed risks, lower profit margins, and penalties from non-compliance. There are many reasons why a company’s compliance program may be less than perfect but it is usually because of lack of adequate planning, centralized oversight, training, as well as program update, enforcement and monitoring. Inefficiency in identity management compliance which results in higher compliance costs is often due to decentralized regulatory compliance efforts such as when the Legal, Compliance, Finance and IT manage various aspects of privacy, SOX, PCI and other regulations independently and without a centralized oversight. The decentralized compliance scheme may also lead to redundant efforts to address overlapping regulations which can also increase the cost of compliance, and, can lead to ineffective efforts because internal controls are interdependent and when one group relies on another group without a central oversight, controls are often overlooked and missed.

Identity management regulations are widespread and overlapping yet a well consolidated compliance program may address all regulations centrally to avoid duplication of efforts, excessive compliance costs, and ensure responsibility and oversight. Although identity risk management compliance may be managed centrally, components of the compliance tasks may be outsourced to third party companies or internal staff of various groups to seek the help of expert resources. Such resources work in harmony with all affected groups to document, test, identify and remediate internal control gaps, however, they report to the centralized compliance management and the oversight committee whether it is made of the senior company management members, board members or a combination of both for a coherent and effective identity management compliance effort.

Usually identity management regulations are introduced to protect consumers, the country and businesses because companies fail to proactively identify and address the identity risks in their respective industries and regulatory environments. Identity management regulations are not any different from other types of regulations as they aim to make businesses manage identity risks in a consistent and verifiable manner to protect and monitor personal information and activities in order to maintain individual privacy, prevent fraud, and fight terrorism.

Regulations may be introduced independently or become part of an existing regulation through revisions and additions. For example, components of HIPAA, HITECH and GLBA address security and privacy of individuals, and, Customer Identification Program, Know Your Customer and Anti-Money Laundering laws were strengthened for effective customer identification, monitoring and reporting to fight bribery, money laundering, financial fraud, and terrorism financing. On the other hand, Red Flags Rule was also introduced as part of the FACTA/FCRA to address the rising identity theft risks facing consumers.

Identity Management Institute offers a certification and accreditation process to guide, review and validate the development and implementation of an effective identity management compliance program in accordance with the regulatory requirements. The compliance program certification is a voluntary process which allows company management to obtain an independent assessment regarding the completeness and effectiveness of its compliance efforts and ensure maximum reduction of risks related to identity verification and validation, protection, privacy, fraud, and suspicious account activities. A certified compliance program provides company management, its board, as well as customers and other business partners the assurance that the company is in compliance with various regulations which is ultimately an indication of the effectiveness of management’s risk management posture.

Visit the workplace articles for other identity management compliance articles.