CRISC Certified in Risk and Information Systems ControlGovernanceHard
A bank is undergoing a major digital transformation, introducing new online services and mobile applications. The Chief Compliance Officer (CCO) is concerned about ensuring that all new digital offerings comply with a multitude of financial regulations (e.g., anti-money laundering, consumer protection). To proactively manage this, the CCO should advocate for which of the following?
- ADeveloping a comprehensive list of all applicable regulations and distributing it to development teams.
- BHiring additional compliance officers to review products post-launch.
- CRelying on external legal counsel to perform a final compliance check before each product release.
- DIntegrating compliance requirements and checks into the product development lifecycle from the initial design phase (Compliance-by-Design).
Show answer & explanationAnswer & explanation
Correct answer: D. Integrating compliance requirements and checks into the product development lifecycle from the initial design phase (Compliance-by-Design).
Integrating compliance requirements from the design phase (Compliance-by-Design) is a proactive and efficient governance strategy. It prevents costly rework, ensures built-in adherence, and fosters a culture where compliance is a core consideration, rather than an afterthought.
Why the other options are wrong
- A. While providing a list is a starting point, it doesn't ensure that development teams fully understand or implement the requirements without a structured integration process.
- B. Reviewing post-launch is reactive and can lead to costly rework or delayed releases if non-compliance is found, which is not proactive.
- C. Relying on a final check, like a post-launch review, is reactive. Issues found late in the cycle are expensive and time-consuming to fix.
Compliance-by-Design (CbD)
A proactive approach to governance where compliance requirements are integrated into the design and development phases of products, services, or systems, ensuring that adherence to regulations is built-in rather than retrofitted.
- Prevents costly rework and delays.
- Fosters a culture of compliance.
- Ensures proactive adherence to regulations.
Memory trick: Build compliance in from the start, a proactive, smart heart.