Compliance Unfiltered is TCT’s tell-it-like-it is podcast, dedicated to making compliance suck less. It’s a fresh, raw, uncut alternative for anyone who needs honest, reliable, compliance expertise with a sprinkling of personality.
Show Notes: The Day Your Compliance Champion Leaves
Quick Take
What happens when your compliance champion suddenly disappears? Todd Coshow and Adam Goslin explore the hidden risks of building a compliance program around one go-to person.
From tribal knowledge and scattered evidence to undocumented processes and failed handoffs, discover why single-person dependency can derail your next audit.
Learn how clear ownership, documented procedures, distributed responsibility, and a centralized source of truth can create a resilient compliance program that survives resignations, vacations, turnover, and the unexpected.
Read The Transcript
So let’s face it, managing compliance sucks. It’s complicated, it’s so hard to keep organized, and it requires a ton of expertise in order to survive the entire process.
Welcome to Compliance Unfiltered, a podcast dedicated to making compliance suck less. Now, here’s your host, Todd Coshow with Adam Goslin.
Todd Coshow:
Well, welcome in to another edition of Compliance Unfiltered. I’m Todd Coshow, alongside the perfect sear to your compliance rib eye, Mr. Adam Goslin. How the heck are you, sir?
Adam Goslin:
I am doing fantabulous today, Todd. How about you?
Todd Coshow:
I can’t complain, I really can’t.
I wanna take this time, as always, to say thank you to the folks who listen to this podcast and invite you to reach out to us with anything that you may like to share at [email protected].
Today, Adam, we’re gonna talk about a fateful day, and that is the day that your compliance champion leaves.
Every successful compliance program seems to have that one person who knows where everything is, understands every control, remembers every audit finding, and somehow keeps the entire program running and the coffee cups full.
But here’s the question, Adam: If your compliance manager quits tomorrow, would most organizations’ compliance programs survive? Also, why do so many compliance programs become dependent on one single person?
Adam Goslin:
I just had this visual of people running down the hallway screaming. It’s cats and dogs and da, da, da, da.
I think it’s a little extreme to go, would they survive? Well, yeah. There’s that expression out there, right? “Everybody’s replaceable.” That’s what they think.
It doesn’t mean… Now, could they be replaced? Sure. But at what cost is really the question.
Todd Coshow:
Exactly.
Adam Goslin:
Most companies kind of have that central figure.
Quite honestly, the main reason why for a lot of organizations that it ends up funneling down to this one person is that, at the end of the day, most organizations are managing their stuff manually.
There’s too much going on. There’s too many control owners. There’s too many hands in the pie. There’s too many assessors. There’s too many states this stuff can be in for everybody to go sticking their fingers in the midst of all of the tracking, etc.
If you’re using a manual system, then you’re almost forced into this notion. But not even almost forced.
For every single company that I’ve ever seen that has either completely manual or hodgepodge manual and internal systems, etc., it ends up eventually gravitating to that single individual.
The reason is simple. Organizations keep getting burned as they are trying to manage their programs.
Somebody went in there to go and make mass updates to their stuff. Let’s pretend we’re using an Excel sheet.
I go, “Oh, I need to mark these 10 things in this state.”
Inadvertently, the person that’s going in to make their 10 things update accidentally blasts 57 items in the process and overwrites their statuses, etc.
When you’ve got shared sheets, etc., it is not if you’re going to have a problem, but when or how many times you’re gonna experience a problem.
It forces organizations to move into this notion where they’ve got the one ring to rule them all, type of deal.
So you end up with that go-to person.
The other thing is that whoever that central figure was, they’ve learned a lot, right? Year over year over year.
It’s knowledge building that basically accumulates between their ears.
I’ve been through so many audits, and I’ve learned what the assessors are looking for and their feedback. I’ve got boots-on-the-ground operational experience of running the program, etc.
That person that’s at the center of the compliance efforts, they literally amass an unbelievable amount of data, information, experience.
It isn’t experience that this person could just poof, walk away, and somebody else is just gonna inherit it. It’s not the reality.
Over time, the knowledge, data, and information moves out of documented processes and things along those lines and lands up in somebody’s noggin.
That works out great up until the moment that said person is hit by the bus, if you will.
I love using the hit-by-the-bus thing when I’ve been doing consulting engagements over the years because it makes people think about if so-and-so is suddenly not there, what the hell do you do?
Literally, if they were hit by a bus.
The funnier part is that I’ve been using hit by a bus for decades at this point in the game.
I actually ran across somebody, thank God they didn’t die through it or anything, but they did actually get hit by the bus.
I found it thrilling personally because I’d never actually met anybody that got hit by a bus before.
But the euphemism works well because you’ve got this organization with this high level of dependency.
It’s great when, whatever, we’ll call this person Bob.
When Bob is there and Bob’s on fire and Bob’s doing his thing and Bob just knows everything under the sun, hey, everybody else can take it easy ’cause we got Bob here.
But the minute that Bob’s not there to run things, then yeah, you’re running some risk there.
Todd Coshow:
No doubt. Now, what’s the biggest risk when that person leaves?
Adam Goslin:
Well, bar none, you’ve got somebody that’s accumulated up, could be years or decades, of information, experience, knowledge, etc.
There’s a lot of things that happen when that person goes away.
Certainly the loss of that institutional knowledge because most of it is in between their ears, as I said.
You have some type of a control that needs to have some upgrading made to it.
The team goes in, and now that Bob’s not here, Bob knows precisely why the controls were designed the way that they were designed eight and a half years ago.
But now the people that are actively running the program, they don’t know why was that designed that way? Why do we have this exception in for this particular tool set, etc.?
All of the hoops and the hurdles and the challenges that got solved, etc., all of that knowledge goes out the window.
Now you basically have staged up the leftover team to go ahead and run their heads straight into the same wall, etc.
A lot of the historical stuff just vanishes in a heartbeat.
Certainly, from a relationships perspective, when Bob goes poof, Bob was the primary one that had the established relationship with your assessors or with your security and compliance consulting crew or with vendors, things along those lines.
There’s gonna be a lot of loss in that arena as well.
The unfortunate part is that the organization doesn’t figure it all out until they realize just how much was not documented once Bob goes poof.
You’re not just replacing a person.
Going back to this whole everybody’s replaceable, and again, at what level of pain?
When all of a sudden Bob isn’t there, you could be talking about somebody that’s rebuilding years of experience.
I have an organization that I’ve worked with for, no joke, I’m closing in on two decades.
In that relationship, I look back at it and gosh, I’ve been through one, two, three, four… I’ve been through five CEOs with the organization, and I’ve been through no less than about 25 to 30 different key personnel at the organization that I would do coordination with.
Todd Coshow:
Wow.
Adam Goslin:
When I have people that are the new entrants to the program, and they’re like, “Geez, why the hell did we do fill in the blank?” I actually know.
It becomes helpful.
But the biggest challenge is if the only place that some of this stuff exists is between ears, it’s a double-edged sword for sure.
Todd Coshow:
No doubt. Now, where do you usually see the biggest documentation gaps?
Adam Goslin:
Well, when Bob goes poof, and I hope you’re getting used to Bob goes poof, ‘cause it’s gonna be a theme today, just so you’re aware. Just fair warning.
Todd Coshow:
Fair enough.
Adam Goslin:
When Bob goes poof, you’ve got processes that you used for collecting evidence that would go away.
Keep in mind that Bob knew how to go ahead and grab this stuff and where to get it from and who do I need to go ahead and talk to? What secret handshakes do I need to be able to get this done?
Precisely which system or systems is it that I was pulling this stuff from, etc.
There’s a lot of that that goes away.
Also, a lot of the audit prep checklists.
We were talking earlier about the problems that you experience when you’ve got a manual tracking mechanism for your security and compliance engagement.
Bob would normally be the one that would receive from the assessors their audit prep checklists and knew exactly how to translate.
He was already familiar with those lists. He knew how to translate those over to the various storage repositories and whatnot.
Knowledge of who handles which of the controls. That’s something that Bob would know in his head and may or likely may not be completely documented in whatever artifacts remained from your prior run.
Certainly, Bob would have seen exceptions popping up during the last year and the year before and the year before’s annual engagement, and how do we handle those exceptions previously?
Any risk acceptance decisions that had previously been made, Bob knew why and whatnot.
Now the noob has to go in and learn all of this stuff.
In many cases, this is how we’ve always done it. It’s not necessarily written down.
Even if it does exist somewhere, where does it exist?
Especially in these manual systems. You and I have talked about this repetitively, right?
Todd Coshow:
Mm-hmm.
Adam Goslin:
I’ve got documentation sitting on the file server. I’ve got documentation sitting over on a OneDrive.
I’ve got documentation on a SharePoint.
Bob just always knows that the people in such-and-such a department will always dump their stuff to a certain special spot on fill-in-the-blank because they have access to it.
They had granted Bob access to it as well.
But the noob that just came in doesn’t even know where the hell it is, let alone gaining access to it, if you will.
In many cases, the documentation that’s left shows you what the outcome was of what was done.
But it’s not gonna tell you who did it, where did they do it, why did they do it, what system did they pull this from, etc.
There are a whole lot of vacuums that are left when Bob goes poof.
Todd Coshow:
Well, how do organizations accidentally create this type of dependency?
Adam Goslin:
Well, in a lot of cases, just because these engagements are so damn hard, right?
Todd Coshow:
Yeah.
Adam Goslin:
The organization, in many cases, they’re just happy that we got through it, right?
What a lot of people don’t realize is that when they’re like, whatever, Bob goes poof, hit by the bus, or somebody in an office far, far away decides that Bob’s replaceable, what they’re not exposed to is the fact that, hey, what happened is we went into the six weeks before this assessment really culminated.
Bob was working nights. Bob was working weekends. He was putting in north of 100 hours a week holding all of this together.
The company ends up effectively being glad that we made it through the process, but no real connection to the level of heroics that had to be done.
In many cases, they’ll focus on the get-’er-done approach rather than, “Hey, could we do this again? What happens if Bob gets smoked by a bus? What then?”
Creating repeatable process, etc.
In a lot of cases, just for all the reasons we’ve mentioned already, that one person becomes the center of every compliance question.
It’s easier for the people that are within the organization to just go to Bob.
But the double-edged sword there is that because Bob’s the one that’s answering all of the questions, Bob is amassing this repository of information and knowledge and whatnot, and nobody else is.
We’ve talked previously about how, as organizations come up to the end of their compliance cycle, there’s a mantra that happens at the organization.
“Oh, we just need to get this freaking assessment over with so that we can go back to our real jobs.”
There’s often a lot of pressure on the operational teams to get it done and get back to the backlog of operational day-by-day organizational duties.
It’s hilarious because I’ve seen this happen more times than I can fricking count over the decades.
Everybody who goes and walks into it, “Hey, at the end of this, we’re gonna go out, we’re gonna do cross-training, and Bob’s gonna show Martha, and Martha’s gonna show Fred, and we’re gonna have all these people that know all this stuff.”
Meanwhile, the bird swoops in from the executive office.
“Everybody, stop doing the compliance stuff. We’re gonna go back. We’re gonna do our day jobs again.”
All that’s left in the dust is this absolute crap show of however the hell they decided to leave the last bastions of the prior year’s compliance crap.
Only to get a year, whatever, nine months down the road, and then somebody decides to go look back on the prior year, invariably makes the statement, “Holy crap. This is an absolute disaster. Well, we’ll just start over again.”
It’s almost like I’m sitting there watching Groundhog Day, right?
The alarm… What the hell was that song that came on on the damn alarm clock? But anyway.
Todd Coshow:
Oh, Kenny Loggins, right? “I’m All Right”?
Adam Goslin:
Yeah, I don’t even remember. We have to look that one up.
Todd Coshow:
Oh, I may have been mixing that up with Caddyshack. You got it.
Adam Goslin:
Yeah, no, I don’t think it’s it, but anyway, you get the point, right?
Todd Coshow:
Oh, no, it’s Sonny & Cher. It’s Sonny & Cher. That’s exactly…
Adam Goslin:
Oh, okay. All right. Got it, got it.
Anyway, the alarm clock goes off, and all of a sudden, bam, we just hit the reset fricking button, and we’re starting a new compliance cycle.
Now what are we doing?
We’re walking back in, making all the same damn mistakes.
Bob’s still here, da, da, da, da, da, and you’re literally just kicking the can down the road, kicking the can down the road, kicking the can down the road.
These organizations don’t realize the level of risk that they’re running as they go through and do that.
That sounded very Forrest Gump-like, running. Sorry.
A lot of the documentation, they look at it as administrative work instead of operational resilience that can get tied into the program.
With all of this information tied up in this one individual, it lacks the systematic capability that’s really needed to improve the robustness of the program.
Todd Coshow:
Hmm. So I guess that kind of begs the question, what does a resilient compliance program actually look like?
Adam Goslin:
As you’re going through the engagement, this is the way that I would articulate this.
The resilience of the compliance program should be measured from the final artifacts from that particular engagement run, right?
This year’s assessment or the assessments that we go through.
Looking at the final state of the documentation that we have and making sure that the control owners, every single one of them has a clearly defined owner.
Not just that we need to know who owns this, because it may be that Mary’s in charge of the department, however, Brett’s the one that actually spits this evidence, type of a deal.
You really need granular identification of the responsibility for the controls.
Making sure that you’ve got the spreading of those responsibilities distributed across the various departments.
That you’ve got procedures that are documented and regularly updated for how are we gathering and garnering and grabbing this evidence, type of a deal.
At the back end of the engagement, depending on what’s happened, there’s a lot of things that happen in the course of a compliance engagement, right?
People coming, people going, people within the departments that are getting swapped out for different people, etc.
A lot of times, just because of the pressure that happens on the engagement, as long as the prior expert didn’t get hit by the bus, the organization, very shortsightedly, will just say, “Hey, you wanna know what? Let’s go have Brett pull… I know that Marco is supposed to be taking this over, right? But Marco doesn’t have any idea what he’s doing. This is taking too long. Let’s just go ahead and get our SME Brett to go ahead and pull the information. That way we can just get through this.”
Well, what happens?
Marco doesn’t learn anything.
Brett ends up pulling the data and the information using his repository, and Brett and Marco never do any handoff.
You want cross-training at the back end of these engagements so that you’re not just setting yourself up for future landmines.
You don’t want evidence collection dependent on a single person’s memory or anything along those lines.
Certainly, the people that step into roles, they need to understand how the overall program is operating.
We don’t want everybody having to reinvent the wheel every time that they step into the limelight.
Todd Coshow:
No, definitely not.
If someone listening to this wanted to test the resilience of their compliance program tomorrow morning, what questions should they ask?
Adam Goslin:
Better yet, I would suggest there’s a really, really simple way.
I’ve actually done this in a couple of BCDR-style engagements where we would deliberately, as part of a risk exercise, I call it kneecapping the team, if you will.
Todd Coshow:
Okay.
Adam Goslin:
In other words, there’s a real easy test. Real easy test.
If you have a Bob, then you go ahead and you basically put Bob into a conference room.
Nobody’s allowed to text Bob, call Bob, stop by the conference room, bobbidy, bobbidy, blah.
Just go to the team and say, “Hey, I wanna know where our audit evidence is for this control.”
Start grabbing different controls as part of this test.
Go in and ask for the written documentation around critical processes and procedures that you’ve got as an organization.
Cherry-pick off 15 different controls.
Who is it that owns it? Who grabs the evidence? Do we know that?
Would somebody even understand why does this control exist in its current form?
Ask personnel that.
Could we even get through the next audit if the lead wasn’t there?
If you go set Bob off in the corner, don’t make him get hit by the bus, but you temporarily kneecap Bob, right?
Then put the onus in the hands of the team.
I would not be asking these questions as I’m walking into my annual assessment, by the way.
Take an appropriate moment, midstream between your compliance cycles, and just don’t tell the team you’re gonna do it.
Just get it all lined up, get all the right information, da, da, da, da, and do an experiment.
It doesn’t take that long, and it’s gonna be extremely insightful.
The reality is that if the answer to several of those questions is no, which is probably gonna be the case, especially if it’s a manual extravaganza, it’s not a compliance program.
It’s reliance on a single individual.
People take vacations, get promoted, they retire, they leave, they get hit by buses.
You don’t want your compliance program effectively to evaporate.
You wanna make sure that you’ve got a compliance manager, you’ve got things stored and saved.
It’s part of the reason why, back in the day, this is literally through experience of running into these issues, having these problems, realizing the lack of streamlining, etc.
That’s the reason why we built the TCT portal.
It was off the backs of running into walls, watching companies go through this stuff, having issues, having problems, and quite frankly, seeing what happens when that institutional knowledge that everybody depends on suddenly goes poof.
You don’t want Bob to go poof.
You wanna be able to actually have a compliance program.
You do want a compliance manager that will be capable of running it, but you also want it in a source or a record that is referable, repeatable.
There’s so many benefits from having all of your compliance stuff organized, all of it in one spot, all those control owners identified.
Who gave what? Where did they get it from? What screenshot did they grab?
All of that at your fingertips, it’s absolute gold.
Now, it doesn’t negate the benefits of having a Bob with that historical archive, but at bare minimum, you’re not tying the hands of the company behind their back when it comes to what happens if something happens to Bob.
The company is not screwed at that point in the game.
Todd Coshow:
Parting shots and thoughts for the folks this week, Adam?
Adam Goslin:
I really love the notion of the whole BCDR test and kneecapping the team and putting Bob in the conference room.
Honestly, it will be eye-opening.
If, as a leadership team of an organization, or somebody that’s high up in the IT ranks, etc., it’s a very simplistic test to go in and run and do.
But I can’t tell you, man, I’ve been in way too many, especially in the early days before the organization, we were able to gain out of the TCT portal, where clients would have these manual systems and the assessor was asking a simple question.
“Where’s the evidence for fill in the blank?”
Literally, it’s almost like people saw ghosts or something.
Looking around the room, scraping through emails and searching file servers and blah, blah, blah, blah.
It’s like, man, if all of this stuff is at your fingertips, it makes things markedly easier.
But I love the notion of go do the test.
Go put Bob in the corner and see what havoc is occurring within your program if he’s not there.
But if you got a Bob, then you may very well think about making some changes so that you’re not stuck in the same position.
Todd Coshow:
And that right there, that’s the good stuff.
Well, that’s all the time we have for this episode of Compliance Unfiltered. I’m Todd Coshow.
Adam Goslin:
And I’m Adam Goslin.
Hope we helped to get you fired up to make your compliance suck less.
