What will you tell your board, if they ask how strong your compliance function is?

Transcription

1 GACP QAR TM What will you tell your board, if they ask how strong your compliance function is? Service Establishment and Delivery Category (SEAD) Service Delivery (SD) Compliance Assurance (CA) Periodic Risk Assessment (PRA) Incident Resolution and Prevention (IRP) Governance and Work Management Category (GAWM) Process Management Category (PRCM) Governance (GOV) Work Planning Monitoring and Control (WPMC) Supplier Agreement Management (SAM) Organisational Process Definition and Improvement (OPDI) Support Category (SUPP) Measurement Analysis and Process Performance (MAPP) Process and Product Quality Assurance (PPQA) Service System Development (SSD) Record Retention (RR) Organisational Training and Professional Development (OTPD) Dr Pieter van Zyl, 16 August 2017 Document version 18.4 Page 1

2 Page 2

3 GACP QAR TM What will you tell your board, if they ask how strong your compliance function is? Service Establishment and Delivery Category (SEAD) Service Delivery (SD) Compliance Assurance (CA) Periodic Risk Assessment (PRA) Incident Resolution and Prevention (IRP) Governance and Work Management Category (GAWM) Process Management Category (PRCM) Governance (GOV) Work Planning Monitoring and Control (WPMC) Supplier Agreement Management (SAM) Organisational Process Definition and Improvement (OPDI) Support Category (SUPP) Measurement Analysis and Process Performance (MAPP) Process and Product Quality Assurance (PPQA) Service System Development (SSD) Record Retention (RR) Organisational Training and Professional Development (OTPD) Dr Pieter van Zyl, 16 August 2017 Document version 18.1 Page 3

4 Background on Demix CMMI Institute partner Demix is a global CMMI appraisal service provider Company was founded in South Africa 2009 Past three years, Demix was #2 (of 254) global CMMI appraisal providers For past 12 months, Demix is #1 globally 14 registered Demix Lead Appraisers Demix Developing an additional 6, can add up to 100 on sub contract if needed Global footprint and reach Demix office - South Africa, Hong Kong, China Beijing and China Shanghai Planned offices for New Zealand and UK Partnerships in China, Dubai, France, Germany, Italy, India, France, Malaysia, Pakistan, UK, USA, Slovakia, Switzerland and Thailand Global leader on CMMI best practices and appraisals Page 4

5 Background on Dr Pieter van Zyl CEO Demix (Pty) Ltd, Director Demix Hong Kong Ltd, Director Demix China Beijing Member of Institute of Directors South Africa (IODSA) and ISACA Certified High Maturity SCAMPI (Standard CMMI Appraisal Method for Process Improvement) Lead Appraiser Certified instructor for CMMI for Development, CMMI Acquisition and CMMI Services Reviewer and contributor to CMMI Secure+ and CMMI v2.0 Chief architect for MCM (Maturity Capability Model ) for Internal Audit, MCM for Compliance and MCM for SCRUM Agile. Have conducted SCAMPI Class A Appraisals Globally. Countries included are China, Dubai, Thailand, Slovakia, South Africa, Switzerland, UK and USA Lead a program to apply CMMI practices to Compliance 17 years experience on organisational compliance to processes, standards, policies AND best practices. Page 5

6 What will you tell your board, if they ask how strong your compliance function is? King IV principle 13-22: The governing body should consider the need to receive periodic independent assurance on the effectiveness of compliance management. Page 6

7 How good is the system? A bad system will beat a good person every time. ~ W. Edward Deming Page 7

8 Page 8

9 Solution GACP Generally Accepted Compliance Practices QAR Quality Assurance Review Marry compliance best practices with Capability Maturity Model (CMMI) best practices Page 9

10 Maturity Capability Model (MCM) for Compliance (v1.0) Page 10

11 Why use CMMI to develop a MCM for Compliance? CMMI v1.3 MCM for Internal Audit MCM Maturity Capability Model Software People Services Acquisition CMMI v2.0 CMMI is the grandfather of most Maturity Models today!

12 Goodness scales TM Why use CMMI to develop the MCM for Compliance? CMMI (Capability Maturity Model for Integration) Most other models ML5 Optimisation based quantitative understanding Organisation Focus quantitative understanding Organisational standards & quantitative ML4 ML3 ML2 Variance & dispersion Organisational measurements Team measurements Team focus Quantitative understanding Organisation focus Team focus Organisational standards & qualitative Measurement Focus Improvement Page 12

13 Goodness scales TM Example of the goodness scale Most other models Level 5 Level 4 Metrics reviewed regularly & updated as needed; results monitored & used for process continuous improvement. Process metrics are defined and measured; results are monitored and used to adjust and validate process CMMI Maturity Level 2 requirement Level 3 Level 2 Level 1 Standard process is established and shows little variation; participants consistently follow the process Process is repeatable but varies based on circumstances and/or participants; owner identified Process is ad hoc and / or does not have a formal owner CMMI enables a strongly architected MCM for Compliance Processes are standardised, but must be tailored to fit need to prevent bureaucratic on-size fits all. Page 13

14 MCM for Compliance GACP 16 principles QAR 8 additional principles (including efficiency and effectiveness) MCM for Compliance 4 categories and 13 process areas Page 14

15 Where are you? If you don t know where you are, a map won t help. ~ Watts Humphrey Page 15

16 Self assessment and the Origami experiment During self assessment, you will inevitably value your work higher Page 16

17 Conduct a Quality Assurance and Maturity Appraisal Key principles for successful appraisals Start with a process reference model such as MCM for Compliance Observe strict confidentiality Observe strict non-attribution Involve senior management as appraisal sponsor Approach appraisal collaboratively to the extent possible Focus on improvements and action plan Value add of external assessment Industry experience Should only be used to rate (determine) your true Capability or Maturity Level (Origami effect) Can provide true benchmarking comparisons External professional appraisal services add value and is necessary for rated appraisal results. Page 17

18 Quality Assurance Maturity Appraisal (QAMA) Results Findings Action Plan Refer to Slide 14 for acronyms. Page 18

19 What will you tell your board, if they ask how strong your compliance function is? Quality Assurance and Improvement Program (QAIP) External Quality Assurance Maturity Appraisal (QAMA) Page 19

20 What the Compliance community need to check Mindless compliance and a quantitative approach is not the aim. Instead, King IV strives to instil a qualitative approach in which recommended practices are implemented to achieve the principles and realise the intended governance outcome., Proportionality, King IV Page 20

21 MCM for Compliance release cycles with broad industry feedback Lead Appraisers, Partner, Institutes Compliance officers` Page 21

22 Focus of continuous improvement for MCM for Compliance strives to instil a qualitative approach in which recommended practices are implemented to achieve the principles and realise the intended governance outcome., Proportionality, King IV Page 22

23 Page 23

24 Lead Appraisers, Partners, Institutes Compliance officers What will you tell your board, if they ask how strong your compliance function is? Page 24

25 /compliance Page 25