Jennifer Vogl (jennifer.vogl@cdw.com) is a Governance and Compliance Manager at CDW in Madison, Wisconsin, USA.
As someone on a compliance team will tell you, the question “Will we pass the audit?” is not uncommon. That question gets asked in organizations with robust, ongoing compliance programs, as well as in organizations with less formal programs; though, it probably happens more often in the latter. It could be a technical subject matter expert (SME) asking that question, or it may be a member of executive leadership. In any of those circumstances, the compliance team (or person wearing that hat) will probably have an answer that fits somewhere between, “We’ll almost definitely pass,” and “Well…we’ll only pass if we fix the following issues.” But where does the compliance team get its answers? Whether formally measured or casually monitored, those answers come from key compliance indicators (KCIs). These KCIs can be identified to benefit organizations of any size with compliance programs of varying levels of maturity. Whether your organization has an informal compliance program or a robust one, KCIs can be monitored to drive changes that reduce the risk of audit findings, incrementally mature the overall compliance program, and provide some peace of mind.
What are key compliance indicators?
KCIs, as the name suggests, are the operational and organizational clues that provide assurance that the activities required for meeting specific requirements are happening the way they should be. Those clues can be related to operational tasks, resourcing, the culture of an organization, or any of the activities necessary to achieve compliance. Specifically, a key compliance indicator is a metric or measurement that provides a quantitative description of an organization’s adherence to a stated compliance objective.
While not necessary for understanding KCIs, those familiar with key performance indicators (KPIs) may see some parallels. Both KPIs and KCIs are ways to measure success against objectives. For KPIs, those objectives are related to business goals. For KCIs, those objectives are related to compliance. As we examine this concept, it will become clear that the compliance objectives must be very specific. For example, having a compliance objective to “pass the audit” is not going to yield much value without further exploration and definition. Success with KCIs lies in specificity. The answer to the “Will we pass the audit?” question should be an aggregate of the answers to more specific compliance objectives like, “Can we demonstrate a sufficient access management program?” and “Do we have adequate separation of duties?”
KCIs may vary from company to company, even where the same compliance objectives exist. As we drill down through the levels of specificity to get to our KCIs, the specific tasks that comprise each implemented control will guide the identification of the KCIs. While some KCIs can be tied to automations related to continuous auditing, it’s also just as likely that the indicator could be derived from an implied requirement or even from a control implemented as a remediation after gaps were identified.
