EY: Global companies still unprepared for GDPR compliance

The third biennial EY Global Forensic Data Analytics Survey examined the responses of 745 executives from 19 countries and analysed the legal, compliance, and fraud risks global companies face and the use of forensic data analytics (FDA) to manage them.

Intensifying regulatory pressures are on the top of the mind of business leaders, with 78 per cent of respondents expressing increasing concern about data protection and data privacy compliance.

However, with more than two months to go until the General Data Protection Regulation (GDPR) comes into force on May 25, 2018, only 33 per cent of respondents state that they have a plan in place to comply with the EU legislation.

While the average response of those in Europe was more positive, with 60 per cent indicating they have a compliance plan in place, there is still much work to be done in other markets where significantly fewer companies indicated readiness for GDPR compliance, including Africa and the Middle East (27 per cent), the Americas (13 per cent), and the Asia-Pacific (12 per cent).

There is a general lack of GDPR compliance plans in the most parts of the world

According to Andrew Gordon, EY Global Fraud Investigation & Dispute Services leader, the pace of regulatory change continues to accelerate and the introduction of data protection and data privacy laws, such as GDPR, are major compliance challenges for global organisations.

However, businesses that adopt FDA technologies can achieve significant advantages, benefitting from more effective risk management and increased business transparency across all of their operations.

Increased FDA adoption for risk management

According to the report, respondents expressed a strong belief in the value of FDA and its benefits for an organisation’s governance programme, which is evidenced by a 51 per cent increase in average annual spending per respondent compared with 2016.

Companies have developed beyond relying on the basic FDA tools of the last decade, with 14 per cent of respondents stating that they are already using robotic process automation (RPA) to manage legal, compliance, and fraud risks, and a further 39 per cent stating they are likely to adopt RPA within the next 12 months, followed by artificial intelligence (AI) at 38 per cent.

The survey found that 42 per cent of businesses believe that data protection and data privacy regulations have a significant impact on the design or use of FDA. The survey further revealed that 13 per cent of respondents indicated that they currently use FDA to achieve GDPR compliance, with more than half (52 per cent) of the respondents indicating that they are currently in the process of analysing exactly which FDA tools they would use to assist them with achieving compliance.

Saman Bandara, EY Vietnam’s head of Forensics, IT Risk & Assurance and Analytics, and the Global Ambassador for Institute of Risk Management, said, “In today’s times, we are witnessing digital disruption in every aspect of businesses, be it in financial services, big pharma, retail, real estate, telecom or the infrastructure industry.”

“There is significant investment being made by companies in digital technology, such as robotics process automation, artificial intelligence, and advanced analytics in terms of setting up digital platforms, developing tools, as well as engaging skilled expertise. Now is also the time to start thinking about unleashing the potential of forensic data analytics to improve operational efficiencies and manage risks arising from embracing this digital disruption,” Bandara said.

Investment in people and skills key to unlocking full potential of FDA

Overall, the report highlights how increased adoption of and spending on advanced FDA technologies needs to be matched with greater investment in skilled resources. Of the respondents surveyed, only 13 per cent feel that their organisation has the right technical skills in FDA, and only 12 per cent believe they have the right data analytics/data science skills.

“FDA is not just about technology, but about the people who manage that technology and how they use it to manage risks. While it is encouraging to see that investment in advanced FDA is increasing, companies need to hire the right talent and invest in core skills, such as domain knowledge and data analytics in order to be successful in managing their risk profile,” said Gordon.