【NAVEXGlobal】2024年十大风险与合规趋势报告_41页_2mb

2024 Risk and Compliance Trends Summary

Core Content

2024 is expected to be a pivotal year for corporate compliance and ethics programs, driven by both evolving regulatory demands and the growing influence of emerging technologies like artificial intelligence (AI). The report highlights the increasing complexity of the regulatory landscape and the need for compliance officers to adapt and lead in this dynamic environment.

Main Trends and Topics

1. Regulatory Environment and Compliance Program Expectations

• Economic Sanctions: The U.S. Justice Department (DOJ) is prioritizing the enforcement of economic sanctions, which are now considered as significant as the Foreign Corrupt Practices Act (FCPA). Compliance programs must adapt to these new realities.
• ESG Reporting Rules: New ESG reporting regulations are expected to shape how companies manage their sustainability practices and disclose related information.
• Data Privacy and Protection: Regulatory activity is accelerating globally, with the EU, UK, and U.S. states implementing stricter data privacy laws. Compliance officers must stay vigilant and proactive in managing these requirements.
• DOJ Compliance Program Guidance: The DOJ has introduced more detailed and stringent expectations for corporate compliance programs, including the Clawback Pilot Program and updated Evaluation of Corporate Compliance Programs (ECCP) guidance.

2. Artificial Intelligence and Compliance

• AI Governance: Organizations must establish an enterprise-wide governance structure for AI adoption. This includes forming a steering committee with key stakeholders such as the CISO, Chief Compliance Officer (CCO), and General Counsel.
• AI Use in Compliance: Compliance officers can leverage AI to improve risk detection and analysis, but must also ensure that AI is used ethically and legally.
• AI Regulation: While specific regulations are still in development, the EU is working on the Artificial Intelligence Act, and the U.S. is exploring various frameworks. Compliance officers should anticipate and prepare for these regulatory changes.

3. Data Privacy and Protection Challenges

• Global Data Laws: Countries like the EU, UK, and China are enacting data privacy laws that include data localization requirements and strict data transfer rules.
• Emerging Issues: The report discusses deep fake media, biometric data misuse, and the potential for data privacy litigation through cases like Schrems III.
• Practical Steps for Compliance:
  • Implement a principles-based approach to data use, similar to GDPR's framework.
  • Conduct data inventory and mapping to understand data flows and ensure transparency.
  • Review and update contracts with third parties to include data security and breach notification requirements.
  • Include personal data breaches in tabletop exercises to prepare for real-world scenarios.
  • Monitor legal updates and stay informed about evolving data privacy laws and enforcement actions.

4. Compliance and Cybersecurity Integration

• Collaboration is Key: Compliance and cybersecurity leaders must work together to address the intersection of people and technology, especially with the rise of AI and distributed workforces.
• Risk Management: The report emphasizes the need for compliance officers to expand their risk management objectives across the enterprise, embedding compliance into all business processes.

5. Board-Level Strategic Focus

• Strategic Imperative: Risk and compliance are increasingly viewed as strategic priorities for the board, requiring a more integrated and proactive approach to managing corporate risks and ethical standards.

Key Insights

• Compliance Officers as Advisors: Compliance officers are expected to act as trusted advisers to senior management, guiding the ethical and legal use of AI across the enterprise.
• Digital Transformation: The digital transformation of GRC systems enables more effective decision-making and business resilience. Compliance teams should invest in modern GRC technology to harness AI's potential.
• Board Engagement: Compliance should not be seen as a standalone function but as a strategic asset that informs and supports board-level decision-making.

2024 Predictions

• Increased Enforcement: The DOJ will continue to enforce compliance programs rigorously, with a focus on clawbacks, financial incentives, and data security.
• More AI Regulation: The EU is likely to finalize the Artificial Intelligence Act by 2026, while the U.S. is expected to see more AI-related legislation and guidance.
• Data Localization Laws: More countries may introduce data localization laws to protect citizen data from foreign threats.
• GDPR Enforcement: The EU will continue to enforce GDPR with higher fines and increased scrutiny, especially in the context of AI and data transfers.

Conclusion

2024 will be a year of both regulatory adaptation and technological integration for compliance and ethics programs. Companies must be prepared to navigate a rapidly changing legal landscape, leverage AI responsibly, and ensure robust data protection practices. Compliance officers will play a central role in guiding the enterprise through these challenges, ensuring that the letter, spirit, and intent of regulatory expectations are met.

Authors

• Matt Kelly: Editor and CEO of Radical Compliance, focusing on corporate governance, risk, and compliance.
• A.G. Lambert: Chief Product Officer at NAVEX, responsible for product vision and strategy.
• Kristy Grant-Hart: Expert in compliance transformation and author of How to be a Wildly Effective Compliance Officer.
• Daniel Kahn: Author of the DOJ compliance guidance analysis, emphasizing the evolving expectations for corporate compliance programs.