Content based on the webinar: Compliance Quick Hits – Collaboration Tools in 20 Mins by Elin Cherry, CEO, Elinphant, LLC and Tiffany Magri, Regulatory Compliance Advisor, Smarsh.

In a modern, hybrid-workplace where many employees now work remotely, collaboration technologies — like Microsoft Teams, Slack, and Zoom — have become a central part of business communications. From a compliance standpoint, financial services firms must ensure such communications satisfy their books and records and supervisory obligations. Failure to meet regulatory requirements will result in penalties that can hurt the business’s finances and reputation.

Regulatory requirements

Compliance pitfalls and solutions

Define business records

By their very design, collaboration technologies enable multimodal conversations and features, including email, video files, text messages and more. Because firms can use these tools in various ways, businesses must look at all the features and then define which features in the collaboration tools are business records that need to be stored.

One potential compliance pitfall of collaboration technologies is failing to define which communications need to be captured from a books and records standpoint. A business must establish these definitions to lay the groundwork for policies and practices.

Develop policies and procedures

Once upon a time, firms used to be able to write their policies and procedures more broadly. By doing so, they “didn’t have to be updated quite as often, maybe just annually,” said Tiffany Magri, a senior regulatory advisor at Smarsh. That’s no longer the case. “I don’t think you can get by with general policies and procedures for communication anymore,” she said.

Policies and procedures should be strategic, allowing businesses to operate efficiently while maintaining regulatory compliance to avoid disruption and fines. “I would caution, when going through policies and procedures, make sure that they are customized to each collaboration platform,” Magri added. “How are you documenting that? How are you supervising those?” The key is to understand the use of your different platforms thoroughly.

Stay apprised of new features

New features or updates are often added to these collaboration technologies unbeknownst to the firm. It’s critical to stay on top of any recent updates. Staying apprised of new features or updates can help the firm ensure it remains compliant with its obligations and avoids falling into hot water. Cherry recommended one way to achieve compliance may be to have the chief compliance officer or a key IT team member review the collaboration features regularly.

Sit back and observe

Another best practice is for the compliance officer to sit with back-office employees occasionally and ask them what features they use within the collaboration tools. Cherry advises compliance officers have employees demonstrate how they use it, and to do this with a sample of people across the firm.

Compliance officers may be surprised about what they learn. “I think you’ve got less than a perfect net if all you’re doing is sampling what’s being captured,” Cherry said.

Conduct training

When training, don’t just train the back-office employees and IT. Everyone is connected to compliance. Be sure to also train those responsible for onboarding new vendors. When a new vendor is onboarded, for example, they should know when and how to contact the compliance department to determine whether that needs to be captured from a books and records and supervisory standpoint.

Perform ongoing e-communication risk assessments

Perform ongoing e-communication risk assessments on how employees and the firm use these collaboration technologies. Magri recommended reviewing technology features quarterly rather than annually because even if certain features are turned off, they can easily be turned back on — knowingly or unknowingly — by an employee or through an application update or system error.

Also, be sure to conduct risk assessments on the technology features and how employees communicate with one another — and what’s being communicated. For example, emojis in emails and text messages have become a growing enforcement risk in recent years, opening firms up to charges from the SEC for securities law violations. Careful and thorough supervision is imperative to staying ahead of risk.

Expand the scope of oversight

If the firm has all the communications data it needs to satisfy books and records requirements, another best practice is to think about how the firm can analyze that data to identify other types of potential compliance risks that could be lurking. Taking advantage of that and thinking outside of just compliance, you can add more value to your program.