CCO Insight: Evolving Compliance in Tech Risk

KPMG client Chief Compliance Officers (CCOs) offer their insights on the expanding role of Compliance amid increasing technology risks (and opportunities)—from broadening the use of data analytics and technology to governance and control enhancements.

Key themes and insights shared include:

Trusted Partner

• Seat at the Table: Compliance involvement in strategy, review, and selection of new business technology/functionality/features
• Tech/AI Governance: Establishment of tech risk and AI committee and/or subcommittee with Compliance as critical member along with other risk pillars; recognition that involvement will continue to expand/grow

Actions

• Skills/Talent: Hiring challenges, engineering + Compliance skills gap, upskilling and investments for Compliance and Tech; Ongoing assessment of resources and structure to evolving tech risks
• Risk Assessment: Reassessment of risk appetite, risk aggregation, KRIs, etc., in light of evolving and interconnected tech risks

Data/Tech Use

• Data Analysis: Some industries utilizing AI for some time, but asking different questions given broader accessibility/usage; Putting new data analysis and surveillance tools and new Compliance use cases in place (e.g., regulatory parsing to controls, etc.)
• Trends / Outside-In Analysis: Use of third parties for predictive/emerging analysis to better identify patterns and anomalies and anticipate risks

KPMG Perspective

Compliance functions will need to ensure that they have the data access, data monitoring/surveillance, assets, resources and technology, and appropriate coverage to disruptive technologies (including AI) in risk assessment, risk mitigation and monitoring/testing. Ongoing and expanding regulations related to the development, deployment, and use of advanced technology such as AI/GenAI will continue to transform Compliance into a Data/Technology Change Agent to the business. 

Future expansion of Compliance coverage can entail:

• Ensuring balance and adherence to diverging federal, state, and global regulations on automated systems and innovative new technologies (e.g., software; models; predictive analytics; and algorithmic processes, such as AI, ML, NLP, and LLMs) across the full lifecycle of design, development, and deployment
• Fostering a culture of transparency and accountability within the organization through clear communication of compliance-related goals, functionality, and potential impacts of automated systems to both internal and external stakeholders
• Identifying and prioritizing AI and other technology/automation use cases to drive efficiencies in data analysis/insights and compliance programs
• Inventorying the varying AI applications and models being deployed across the organization and identifying and building mitigating controls to the downstream compliance risks related to each
• Serving as a trusted advisor to technology and data teams
• Incorporating new and evolving technologies in ongoing risk assessments, and facilitating ongoing monitoring of new tools and analyses
• Shifting from policy and regulatory change management of data/technology risks to ensuring real-time monitoring and surveillance of data/technology risks