Technical Case Study

Published: February 2009

Situation

Increased governmental oversight in recent years has resulted in new requirements that affect organizations in a wide range of industries. Governmental controls over companies come from a variety of sources, including local and national governments. Industry-specific oversight groups often produce guidance that can be mandatory for industry participants. This complex universe of controls is often referred to by the general term regulatory compliance. For any company that conducts business in multiple jurisdictions, their compliance obligations quickly become incredibly complex because they must comply with all applicable regulations of the locales in which they operate.

However, reacting to each new regulatory requirement by creating an individual compliance initiative is inefficient and can quickly place a burden on a business and its IT organization. This case study describes how the Microsoft IT group is addressing this challenge by introducing a holistic approach towards IT support of regulatory compliance. This document discusses the processes and tools that Microsoft IT has developed to manage the requirements mandated by Sarbanes-Oxley (SOX), the Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry (PCI) Data Security Standard, as well as additional regulations and requirements. It also lists the benefits Microsoft IT has derived as a result of working under this new model, and provides best practices to assist the reader in leveraging this model and applying it to their company in order to improve their own regulatory compliance efforts.

History of Microsoft IT Regulatory Compliance Efforts

All companies are facing significant legal and regulatory challenges in areas such as information security, privacy, reliability, and business integrity. These challenges can require major changes to systems and processes across companies. Companies must react to and plan for the increasing structure and regulation around corporate accountability and control in order to meet many legal and ethical objectives.

As with many companies, Microsoft IT has been challenged by the numbers of different regulatory requirements and frameworks they must manage and with which they must comply. Microsoft IT's initial simplistic methodology quickly turned complex, and they realized that they needed to develop an overall regulatory compliance framework that could address current regulations as well as support future regulations. Until recently, Microsoft IT's support of regulatory compliance efforts has been focused on each separate regulatory framework as a distinct set of rules, processes, and tools including:

• SOX: As one of the first extensive regulatory frameworks Microsoft had to address, much of Microsoft IT's framework was initially created specifically for SOX. The initial program was rolled out in 2004. Soon after, the proof of process and first successful external audit and technology rollout occurred. From 2006 through 2008, the focus was on gaining efficiencies: controls were optimized, quarterly processes were streamlined, and efforts were made to improve internal tools and reduce costs. Most recently, the focus has been on rationalizing risk assessment, monitoring controls, automating controls, and shifting from a SOX-based mindset to overall internal governance.
• HIPAA: The Microsoft U.S. Benefits Team initially built a Microsoft HIPAA compliance program. When technical compliance became necessary, the Benefits Team engaged Microsoft IT with the HIPAA Security Rule. Microsoft IT then began identifying accountable owners and optimized compliance using Microsoft Excel®, e-mail, and Microsoft SharePoint®. Although these tools provide an outstanding cross-group collaboration environment and support the control assessment and sign-off process, a more scalable, automated, and flexible solution needs to be developed for the long term.
• PCI: As one of the latest high-profile industry regulations to be addressed, Microsoft IT had started its PCI compliance efforts as a mostly manual tracking process that included using Excel spreadsheets, e-mail messages, and other ad-hoc materials. Spreadsheets were automated in order to improve scalability, status-tracking reporting, and visibility. Scans of the production environment were implemented in order to reduce the compliancy validation work. Current efforts are underway to improve productivity by leveraging the compliancy overlap between SOX, HIPAA, and PCI controls. The objective is to establish a single regulatory compliance schedule rhythm of the business, increase the percentage of automated control compliancy scanning, and centralize control compliancy tracking and reporting.

Solution

As a very well-known publicly traded company, Microsoft realizes that not only is it under constant scrutiny, it is being looked to for guidance by other companies that are also facing the challenge of trying to remain compliant in an evolving legal and regulatory landscape. In developing and improving business and IT processes, Microsoft must proactively address regulatory compliance and lead by example.

The key to how Microsoft IT improved its regulatory compliance processes was to design a new, holistic approach whose primary objective was to simplify across processes, roles, and tools. Each of these areas is described in the following text.

A Holistic Strategy for IT Support of Regulatory Compliance

In developing a strategy to address its compliance needs, Microsoft IT examined many of its existing business and IT processes to identify regulatory compliance risks and solutions. The goal was to create a long-term, holistic strategy for compliance that could be built into business processes, rather than simply creating ad-hoc processes and tools to address specific compliance requirements.

The Annual Rhythm of the Business

Microsoft IT's approach towards support of regulatory compliance is to use a framework of common security controls, unique tools for monitoring, and IT tools for tracking and reporting compliance.

The following high-level diagram illustrates the rhythm that unifies the regulatory program. While the model is holistic in approach, it is flexible enough to support tools, requirements, or activities that are not common across all supported regulatory frameworks.

Figure 1. Annual rhythm of the business

Quarterly Activities

Although regulatory compliance is an ongoing process, its tasks and milestones follow an annual cycle. The combination of developing a formalized schedule that addresses the required tasks across all regulatory frameworks, and using compliance tools to automate and streamline the processes, is the centerpiece for Microsoft IT's productivity and efficiency gains.

Each quarter's key regulatory compliance activities are summarized below:

• Q1: Evaluate scope, rationalize controls, conduct training, and focus on control owner communication. Commence design effectiveness testing.
• Q2: Complete design effectiveness training, followed by running the bulk of operational effectiveness testing. Compliance validation scanning scripts are run (either automated or manually), and their status are reported to their control owners.
• Q3: Complete operational effectiveness testing, and work on remediating design issues and control failures identified during testing. External audit begins.
• Q4: Complete external audits and review their feedback. Perform year-end inquiry, followed by Management sign-off with external audit attestation, where applicable.

Compliance Tools

Microsoft IT has developed a set of tools that help streamline its regulatory compliance process:

• Regulatory Compliance Tool: This tool was initially developed for SOX, but is being modified to support the other regulatory frameworks. It functions as a control repository that integrates risks and control objectives across locations and transactions. It provides visibility to role ownership, workflow assignments, and remediation. It also tracks reviews and signoff of documentation and testing, and provides enhanced reporting. It integrates with the Issue Management tool in order to document issues and the remediation of failed controls.
• Issue Management Tool: When a control is set to fail in the Regulatory Compliance tool, this application automatically prompts the tester to enter the issue into the Issue Management tool. This tool is used to create issues enterprise-wide and assigns ownership of each issue. It also allows for reporting, searching, and filtering of issues, monitoring of issue status, and tracking remediation.
• Segregation of Duty Analysis Tool: A financial compliance tool used to identify segregation of duties conflicts to help prevent fraud and financial statement errors or irregularities.

Defining a Holistic Strategy Best Practices

• Streamline your processes: Organize all the regulatory compliance activities and formalize a single, all-encompassing process that enables work to be performed in a predictable manner each year and schedule compliance activities accordingly.
• Consolidate peoples' regulatory responsibilities: Identify where multiple controls operate in an organization and look for a single point of accountability that will oversee regulatory compliance within that organization.

Role-based Accountability Model

A key aspect of the holistic approach towards regulatory compliance is defining a role-based accountability model. This model offers a more efficient way to coordinate compliance activities, and results in increased effectiveness of control testing and adherence to regulations due to individuals taking ownership of regulatory compliance.

In order to provide an end-to-end service horizontally across IT and vertically between management and regulatory owners, a dedicated regulatory compliance program management team was created to continuously drive an aggregate compliance effort with all stakeholders.

The diagram in the following figure provides a sample accountability model that clearly identifies who is responsible for what information. In particular, note that this is a roll-up model, where those at the bottom of the chart are responsible for the most granular level of detail for specific applications and related infrastructure. Information is rolled up to managers who are responsible for their groups, which is further rolled up by application/infrastructure senior owners, and is ultimately provided to the VP Leadership Team and CIO.

Figure 2. The role-based accountability model

The list of roles involved in regulatory compliance and their responsibilities is provided in the following table:

Table 1. Roles and Responsibilities

Accountability Model Best Practices

• Consider defining a dedicated program management role (and team, if required) who is solely focused on managing the regulatory compliance process across IT.
• Define a hierarchy that is appropriate for your business; consider designing a model along existing business groups or units.
• Carefully define documentation, remediation, and testing responsibilities at each level.
• Confirm that your accountability model allows both granular responsibilities and roll-up reporting.
• Ensure performance review commitments are in place for all regulatory roles. This provides incentive for individuals to take ownership for regulatory responsibilities. Escalation is usually not needed when individuals are committed to upholding program milestones and deliverables. Make sure key executives–IT Controller and CIO/VPs–communicate their personal commitment to overall regulatory governance.
• Maximize the value of your external audit by having your regulatory compliance project management team and compliance governance group maintain an open and honest relationship with your auditor.

Implementation of Similar Controls Across All Regulatory Frameworks

Because many controls are similar across the various frameworks, Microsoft IT carefully reviewed the complete set of controls for all frameworks and identified where such overlaps or supersets occurred, and merged them where synergies exist.

Figure 3. Implementation of controls and roles across frameworks

As the following table illustrates, merging similar controls can significantly reduce duplication of effort while simultaneously streamlining the test process.

Table 2. Reduction of Testing Effort Due to Merged Testing of Similar Controls

Implementing Similar Controls Best Practices

• Identify control overlap by grouping similar objectives across frameworks.
• Review your test steps across all regulatory controls in each framework and identify where overlaps–and thus reduced numbers of test–can be achieved.
• Explore existing industry-standard frameworks that can be used as a guide to bring together multiple regulations to help you create an integrated approach.

Benefits

By taking a holistic approach to regulatory compliance, Microsoft IT has derived a number of benefits:

• Increased awareness: The role-based accountability model gives insight to the overall state of compliance. Upcoming projects are communicated early and evaluated for impacts to regulatory compliance.
• Improved regulatory compliance support: By dedicating a team of regulatory compliance program managers who can monitor and manage any control compliance, Microsoft IT gained the ability to look at issues broadly and ultimately provide the means to leverage best practices and make recommendations to improve the overall process.
• Eased adoption of new regulatory frameworks: Microsoft IT's scalable model eases the process of on-boarding other regulatory frameworks when new laws are created or existing regulations change.
• Remediation of failures: An aggregate view enables the Regulatory Compliance Team to find commonalities and allows the organization to address the root cause of potentially systemic issues.
• Streamlined communications: Merging processes and controls reduces the redundancy and frequency of multiple communications, improves the prioritization of tasks, and allows for a more meaningful conversation with senior management.
• Reduction in overhead costs: Merging controls reduces audit touch points.

Conclusion

Microsoft IT is developing a holistic approach to IT support of regulatory compliance by standardizing processes, creating common controls that address multiple regulatory frameworks, and implementing a role-based accountability model that allows capturing of key impacting information in the early stages of business processes.

This holistic approach starts with a single overarching regulatory compliance framework that combines all compliance frameworks (such as SOX, HIPAA, and PCI) into a single process, and uses tools that help automate and streamline the process in its entirety. In addition, Microsoft IT designed a role-based accountability model that includes a dedicated regulatory compliance program management team. This model clearly articulates each role's responsibilities and provides a streamlined "roll-up" report path that provides each person the information and reports they require.

Microsoft IT views regulatory compliance support as an ongoing effort. Microsoft IT uses compliance tools to fully optimize the program and reduce the time and effort Microsoft IT spends in support of regulatory compliance. The current model described in this case study will evolve over time to address the company's future regulatory compliance needs. In designing this new model, Microsoft IT found that taking a holistic approach to supporting regulatory compliance not only increases the efficiency of testing and appropriate reporting, it also standardizes processes and makes IT professionals more efficient in their operations.

For More Information

For more information about Microsoft products or services, call the Microsoft Sales Information Center at (800) 426-9400. In Canada, call the Microsoft Canada information Centre at (800) 563-9048. Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access information via the World Wide Web, go to:

http://www.microsoft.com

http://www.microsoft.com/technet/itshowcase

© 2009 Microsoft Corporation. All rights reserved.

This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Microsoft, Excel, and SharePoint are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.