Banner artwork by Poofig / Shutterstock.com
Having completed an article series counting down the top 10 habits of successful in-house counsel for the ACC Docket, I am excited to become a regular columnist this year. My articles will address emerging areas where you can take actions to improve your legal advice and career.
This month’s focus is on compliance, which is a notable topic — my #9 top habit of successful in-house counsel is that a lawyer needs a true compliance mindset — which means approaching your company’s corporate governance and compliance programs from the perspective of a compliance officer, rather than a lawyer.
To me, the emerging issue in compliance that in-house lawyers need to fully appreciate is the explosion in the use of data and analytics in the field. It’s similar what has happened in sports. I love watching professional football and baseball and the impact on their professions feels just like ours (i.e., Do you go for it on fourth down or do you punt? What does the data say about the pitching matchup?). The use of analytics to guide decision-making and risk taking has fundamentally changed the way the game is played from a few years ago.
I have enlisted two of my trusted colleagues in GSK compliance to help explain how in-house counsel should be thinking about these game-changing times. In this article, there will be a three-way conversation between myself, Richard Walters, GSK’s vice president of compliance R&D and enterprise risk management, and Marcus Green, GSK’s vice president of risk analytics and monitoring.
I will ask them a series of questions, but the catch is that I have asked them to explain their answers first using emojis. Why emojis? Because they are fun, but also one of the emerging issues is how do compliance departments monitor risks in email and messaging with the increasing use of emojis in their data.
Q: Richard and Marcus, thanks for joining me in this conversation. How would you describe the impact of analytics/data in the compliance functions of companies over the last five years? Pick any emoji to visualize the impact and explain your answer.
Richard Walters:🚀 Roughly five years ago, we started on our data journey in GSK compliance. After talking with industry peers, I would say we are one of the frontrunners in this space. I will leave it to Marcus to cover the impact on the commercial business. In terms of a company’s enterprise risk management framework, the use of data and Key Risk Indicators (KRIs) has shifted. Where once companies produced lengthy written papers looking backwards (confirming what they did the previous year to address the risk identified the year before that) to now having data, which if reviewed regularly, can drive a dynamic, more real-time risk focus. This has increased the impact and value of the compliance function — while also gaining efficiency.
Marcus Green:🔍 Data analytics has allowed us to “zoom in” and better understand the business, enabling more effective partnership. A large part of compliance is using your judgment or “gut feel” to assess potential risk. With that in mind, increased data availability has helped us to:
- Challenge initial assumptions with supporting data; and
- Identify potential issues earlier — we can then use our judgment to determine appropriate next steps.
Brennan Torregrossa: From an in-house counsel perspective, their answers and emojis really capture the sea change occurring in our profession. The use of data and analytics is exploding 🚀 and allowing for much more focused risk 🔍 discussions. Increasingly, companies will be challenged if they do not have an analytics department as part of their compliance review as an industry standard.
Increasingly, companies will be challenged if they do not have an analytics department as part of their compliance review as an industry standard.
If you are a lawyer or compliance professional, what action-oriented emoji best reflects how the increasing use of analytics in compliance manifested itself in their day-to-day work or risk management? Explain your emoji answer.
Walters:💪 I feel more powerful as a business partner to influence with the data and insights I now have. Couple this with sound judgement and gut feeling, and it is a superpower!
Green:🤝 Heightened quality of interactions with business stakeholders. The business uses data to assess performance, and the availability of compliance data allows us to speak their language, enabling better integration of risk discussions into the broader business context. I’ll never forget the first time that I presented data to business leaders — they instantly understood the topic and began leading the compliance discussion!
Torregrossa: Again, their emojis capture powerful shifts in our profession due to the ability to tap into data and analytics in risk management. Both raise “gut feel” (even though they did not know what the other would say to these questions) as something that has been and will continue to be important to legal and compliance professionals. But now “gut feel” can be tested or backed up by data and analytics. Additionally, it powers them to be stronger 💪 partners and collaborators with the business increasing compliance engagement 🤝.
Q: Does the use the use of data analytics in compliance affect large and small companies differently? If you think they differ in terms of challenges, express it using two emojis (one for larger companies and one for smaller companies).
Walters: Larger companies — 😑. I used the indifferent emoji because they are more likely to have bigger budgets and greater analytics expertise (in compliance and the broader company), but the data sets can be scattered with little connection making analytics difficult.
Smaller companies —💡. I used the light bulb emoji because they are more likely to have resource challenges, but also more likely to be easier to gather the data so it is an opportunity for them.
Green: Larger companies — 🔄. Larger companies have an abundance of data, which leads to the challenge of how to effectively integrate it all. The complexity of systems can also be an issue, as well as how to effectively tap into the broader technical landscape.
Smaller companies — 💰. The biggest challenge for smaller companies is not having enough resources to devote to analytics, as well as a lack of enterprise data sources to utilize. Interestingly, for both groups my advice is the same — prioritize initial efforts on where you can make the greatest impact and show value.
Torregrossa: Whether you are a large or small company, the theme of their answers is that data and analytics offers opportunity💡. My own view is that you cannot be indifferent 😑 no matter how large or small. Even if your challenge is too much data 🔄or too little resource 💰, in-house counsel must try to find a way to drive some data and analytics evaluation or risk that failure being used against them. These points from my colleagues is spot on: prioritize (both in terms of resource and focus) to be effective because developing too much noise from data and analytics does the opposite of unleashing the power of the data to focus. This advice applies whether you are big or small.
Even if your challenge is too much data or too little resource, in-house counsel must try to find a way to drive some data and analytics evaluation or risk that failure being used against them.
Q: How will increasing use of data analytics impact compliance in the next five years? Using an emoji as a visualization, predict the future issues for companies with increased data to mine for compliance risks.
Walters:🤖 With more automation and AI, I’m hoping for “real-time” data (Marcus will have a better view on if this is achievable). Risks associated with this are:
Not having the human capability to work with this tech to influence and effectively business partner; and
I see an increase in privacy risk with much greater instances of survey / performance data being combined with demographic data in these models.
Green:🔮 While increased use of data will ultimately have a positive impact on risk management (including predictive capabilities), a crystal ball would be more helpful in addressing the following:
- Determining which areas are best placed for disruption;
- Constantly evaluating the technical landscape (including buy vs. build) — the best solutions today may be laggards a year from now; and
- Being comfortable experimenting, while quickly identifying if something doesn’t work (and stopping it).
💡Most importantly (hence the bonus emoji!), determining how to best derive relevant insights from data. If you can’t tell a coherent story, more data will lead to confusion instead of value.
Torregrossa: This is a brilliant place to end our article. With the explosion in the use of data and analytics has come many more flags to investigate. Legal departments cannot let their companies have risk flags raised with no one addressing them. One wonders whether increased use of AI 🤖 will help with that potential increased need for demand. No one has a crystal ball 🔮, but you should bring your best ideas💡to your company because this challenge has arrived. 🛬
Disclaimer: The information in any resource in this website should not be construed as legal advice or as a legal opinion on specific facts, and should not be considered representing the views of its authors, its sponsors, and/or ACC. These resources are not intended as a definitive statement on the subject addressed. Rather, they are intended to serve as a tool providing practical guidance and references for the busy in-house practitioner and other readers.
