Are we Complying with the Law? A Google (or ChatGPT) for Compliance

TL/DR: Today an excerpt from my book, Stop Harming Customers, where I discuss the dream. A meeting of technology and Compliance that moves us towards a continuous, one-click answer to the question: are we complying with the law? I've been working on this problem for the better part of two decades now, and the time seems ripe for a sea change.

The solution requires solving for the boundary between external regulations and internal controls. That interface requires knowledge of both the law and the company.

Today, this is a largely manual task, and made more difficult by both constant external regulatory change and internal process change. We need to knit together federal, state, agency rules, their interpretation, case law, and regulatory enforcement actions with our internal policies, procedures, tests, metrics, controls, audits, and so on.

Note: I am excerpting this excerpt from what I wrote over a year ago, and if you want to replace Google with AI assisted or LLM driven, please feel free. Indeed these approaches may help solve for some of the data mapping challenges. But the core ideas of the solution are the same as ever.

Excerpt starts.....now!

An Example Use Case

We talked back earlier about the regulator asking a bank how it was handling regulations related to font size, aka font size, and that to answer it would require a lot of emailing and cutting and pasting. The picture looked like this:

Instead, we want to link these systems via search and take the people out of the finding process. That looks like this. Here the lines are the search engine connecting across databases using the knowledge graph to understand and translate between the patois of each business and corporate function.

Can I Have It?

In a word: maybe. There are technical challenges. The nature and structure of the internet allows Google to do its thing, and there are significant differences with the way corporate information works.?

For the most popular topics on the internet there are billions of documents, millions of users, and thousands of searches every second. These documents are also linked together with the most relevant documents having the most links to them. This is the heart of Google's Page Rank algorithm that got them started originally. Relevance is provided by the social fabric of the internet.

Contrast this with corporate information. In a company there are maybe hundreds of documents and a few dozen users for a given topic with a handful of searches a month. And, crucially, there aren’t links between the various systems. I mean, that’s what we’re trying to build in the picture above because it doesn’t exist naturally!?

For this reason most companies have given up on the Google search appliance–Google’s attempt to break into intranet search. It doesn’t work with the way corporate data is created and maintained.

But there is a way in which the procedures, issues, tests, and financial data are better than the internet. On the web, no individual piece of information is trustworthy. I could post on Twitter that Kim Kardashian has begun another round of missile tests over South Korea. This is not the right Kim, and Google will know this because of the weight of evidence to the contrary.?

By contrast, my internal data at the bank is all true. Or at least “true” in the sense that no one is making a fake corporate procedure document. The domain of the data is also much smaller than the entire world wide web. Given this truth, and scale, we can build a knowledge graph off of less data.

There is some work that has been done in this space and some banks and software companies that have made progress. I fully expect more and better solutions to emerge over the course of time. I also have a lot more specific thoughts on how to implement, how to translate other Google stuff like A/B testing to the corporate world, but that’s beyond the scope of this book.