May 25, 2016 By Larry Loeb 2 min read

Smarsh has released its “2016 Electronic Communications Compliance Survey Report,” which has some surprising conclusions — especially regarding social media compliance.

Major Issues Surrounding Compliance

The study polled 221 financial services professionals that had direct compliance supervision responsibilities. Respondents said that policy, enforcement and retention gaps remain high. This means that firms will be vulnerable to undetected fraud, errors and regulatory penalties, the survey noted.

The professionals responding found that current supervision practices aren’t sufficiently addressing the ongoing evolution of communication in the financial services industry. Most agreed that firms have an immediate need to rethink their approach to the retention and oversight of electronic communications amid a demanding regulatory environment.

Social Media Compliance Officers Are on the Hook

Risks in compliance are everywhere. Supervision of new communication types poses a big challenge: Most firms have been overwhelmed by the sheer volume of email they must review to meet requirements. Not only that, but the resources available to address this issue are growing slowly, if at all.

Communication “outside the compliance perimeter” can be a significant vulnerability. In fact, 48 percent of respondents thought social media was their primary compliance risk. Supervisors had little or no confidence that they could prevent users from using these social media platforms, even if they were forbidden in the workplace.

Messaging Apps Are a Problem

Messaging apps were also an area of great concern to respondents since their use has not been demarcated by the regulators. Without this formal guidance, the report notes, “A full 39 percent of those who allow but don’t archive these messages are waiting for industry regulators to enforce guidance before they will begin archiving text messages.”

Firms are struggling to find viable solutions for these social programs, particularly since existing policies don’t seem to be working. “If procedures designed to identify risk in email are ineffective and waste time, extending those same procedures to additional content only exacerbates those results,” Smarsh said in its report.

“There is a need to rethink the traditional approach to communications supervision, especially when considering finite resources and the growing strategic role of compliance in organizational risk management.”

Changing the process of regulatory compliance has been exacerbated by the rise of mobility in the workplace, along with the introduction of new and unregulated messaging platforms. Stricter control and organized archiving of employee communications in all forms will be needed in days to come.

More from

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today