We’re Certified, Now What?—The Value of Ongoing Monitoring
March 17, 2016
By Matthew Rekers
After buying a car, how many of us believe that we can drive it worry-free for two years without regular maintenance? Although it’s an appealing idea, the reality is that regular maintenance keeps our vehicles operating at peak condition. This same approach should be considered when a title or settlement agent obtains certification to ALTA’s Title Insurance and Settlement Company Best Practices. Since ALTA has suggested that a Best Practices certification be updated every two years—after we overcome the excitement of attaining certification—we should maintain regular monitoring procedures to ensure compliance during the interim period. Ongoing maintenance of your compliance program provides you, your clients, and your lenders with the confidence that your organization is prepared for whatever may lie on the road ahead.
The Benefits of Ongoing Monitoring
Changing your car’s oil is a key element of a vehicle maintenance program to help you avoid costly repairs. Likewise, monitoring your compliance posture helps you mitigate the costs of non-compliance, while keeping your organization running at its optimal performance. So, what are some of the likely outcomes of monitoring your Best Practices compliance during the two years between your certifications?
First, compliance monitoring can help your organization remain efficient. Since pursuing certification, you have developed Best Practices policies and procedures that likely resulted in changed processes. These new processes may have changed workflow that had been in place for long periods of time. Ongoing monitoring of your Best Practices compliance program is intended to identify compliance disruption due to the altering of your new organizational processes. This disruption may adversely impact others who are required to prepare reconciliations or record documents. However, by monitoring these regularly, you can be confident that your organization’s new processes are performing optimally.
Second, by maintaining your compliance, you decrease your risk of exposure. When you establish your organization as having adopted Best Practices, you are asserting the standard to which your organization adheres. When studying organizations that have had a data breach, one often finds a correlation between efforts to protect customer information and the significance of the penalty assessed. While achieving Best Practices certification will most likely be looked upon favorably, maintaining the program after receiving a certification further demonstrates your commitment to protecting customer information and could result in less severe penalties in the event of a breach.
Finally, maintaining your Best Practices compliance allows you to retain your status on a lender’s approved vendor listing. Through ongoing monitoring of your Best Practices compliance, you can avoid the potential cost of losing a key business partner whose confidence in your organization’s compliance with industry standards has been shattered by your failure to remain compliant.
What Does a Monitoring Program Look Like?
Now that we have identified the benefits of ongoing monitoring, how do you create a monitoring program appropriate for your organization? Our experience has enabled us to conclude that an effective framework for ongoing maintenance of Best Practices should include at least the following steps:
1. Obtain owner/senior management buy-in.
2. Designate employee(s) responsible for conducting the ongoing monitoring.
3. Develop and approve ongoing monitoring and documentation procedures.
4. Follow up and correct any detected issues.
5. Engage management in the periodic review of the program.
Step One: Obtain owner/senior management buy-in
Buy-in from senior management is paramount. Similar to when you began implementing Best Practices in your organization, proper monitoring without managerial commitment and support proves ineffective. Leadership must develop a culture of compliance by setting the objectives of the compliance maintenance program. The very existence of a maintenance program reinforces that management is watching and expects that necessary corrective action will be taken when a problem occurs.
Step Two: Designate employee(s) responsible for conducting the ongoing monitoring
Senior management should assume accountability for the maintenance program, but the actual conduct of the program should consider the time commitment and staff competence when assigning program responsibilities. Best Practices have a way of permeating every aspect of your business, so it is important that you find and assign competent personnel who have a clear understanding of Best Practices and are as independent from the processes they are monitoring as possible. These participants and all employees need to be empowered by management to report any issue openly and directly to senior management or the owners without repercussions. It is important to ensure that whoever monitors Best Practices in your organization has the appropriate capabilities, objectivity, and authority, and also can provide effective oversight.
Step Three: Develop and approve ongoing monitoring and documentation procedures
Have you taken your car through an oil change station lately? If the station is like mine, the technicians immediately start calling out their inspection results and notifying each other as to how they are progressing along a well-rehearsed, documented process. The same approach should be adopted for employee(s) designated to oversee your maintenance process. In developing your monitoring procedures, you will need to address explicitly which activities must be monitored. An effective way to ensure that you are maintaining all of the Best Practices is to utilize the ALTA Best Practices Framework Assessment Procedures version 2.1 as a benchmark. And most importantly, keep all of your tracking records.
Management should take into consideration the risk associated with activities when determining how often to conduct monitoring. Developing a checklist or tracking tool to effectively document your maintenance testing on a daily, monthly, quarterly, or annual basis will provide sufficient guidance for employee(s) you’ve made responsible for maintenance. Discuss your approach with the firm that conducted your assessment. For example, our firm has developed a Best Practice Monitoring Tool that we provide to our clients post-certification to help them develop their ongoing monitoring process.
Step Four: Follow up and correct any detected issues
The goal of your monitoring process should be to fine-tune any Best Practices activities that are outside compliance standards. This step is a pivotal part of your Best Practices program. Your business is at risk of potential exposure if it is determined that you did not take reasonable measures to achieve compliance once failures or other deficiencies were identified. The outcome of monitoring must go beyond identifying actual or potential non-compliance—management must take the necessary corrective action. Often such action requires you to determine the root cause of non-compliance. For instance, if a monitor is testing transactions for non-compliance and determines that it took more than the Best Practices standard of 30 days to provide a policy to a customer, the monitor should determine why this non-compliance occurred. Only then can an appropriate corrective solution be determined.
Step Five: Engage management in the periodic review of the program
Successful monitoring processes start and end with management involvement. Step one emphasizes obtaining senior management buy-in and places the accountability for the overall oversight with management. Although the monitoring employee(s) should report to management any potential non-compliance during the monitoring process, management also should regularly review the monitoring documentation to ensure that the guidelines developed in step three are followed. Since Best Practices involve virtually every facet of an organization, it is crucial that management is involved with administering necessary corrective actions.
Time to Hit the Road
The intent of the third-party certification is to instill in your customers and lenders the confidence that your organization operates according to industry standards and properly protects consumer information. Therefore, implementing an ongoing monitoring program after certification helps your organization steer clear of potential risks down the road. Compliance with Best Practices should not be viewed as a single assessment to be performed every two years. Instead, we should promote maintaining our compliance efforts like we maintain our cars. Just as a well-maintained car will give you confidence as you drive the open road, a well-maintained compliance program ensures your business is upholding the industry’s highest standards.
Matthew Rekers CPA CIA, is the director of ALTA Best Practices Services Group for PYA (Pershing Yoakley & Associates PC. PYA is a certified public accounting and consulting firm and ALTA Elite Provider, which specializes in ALTA Best Practices implementation and assessments. Rekers can be reached at [email protected] or 800-270-9629.
Contact ALTA at 202-296-3671 or [email protected].