Category Archives: Governance

It’s a theme

In the prior post, I expressed some shock and amazement that Amazon would meddle with the patient-doctor relationship.  See www.infogovnuggets.com/2018/12/03/these-folks-have-lost-the-plot/.

Apparently I am not alone in raising some questions about the antitrust implications of some of Amazon’s behavior. “Germany Opens Amazon Antitrust Probe, Adding to European Scrutiny,” The Wall Street Journal, November 30, 2018 (online).  Is Amazon hindering other sellers on their website?

This is primarily a Compliance issue.  I note, however, that the types of behavior at issue here are basic antitrust blocking and tackling.  If you get to a certain size, you can no longer get away with behavior that would be acceptable by a smaller player. Sometimes this isn’t part of the Compliance education package.

 

Advertisements

Leave a comment

Filed under Compliance, Compliance (General), Controls, Corporation, Duty, Governance, Interconnections, Legal, Requirements, Third parties

Making a list and checking it twice

So, you have a baby coming.  You establish a baby registry online, and list the items/gifts you want to receive.  And then the host of the registry accepts payments from vendors of baby products to add certain items to “your” list.

Is nothing sacred?

“New Parents Complain Amazon Baby-Registry Ads Are Deceptive,” The Wall Street Journal, November 29, 2018 (online).  Amazon accepts money from major companies to put “sponsored ads” on your list; there’s a small gray box saying “Sponsored.”  Nothing descriptive like, “Similar to things the mother-to-be actually wants.”

I guess you have to check to make sure that you check “your” list at least twice, to make sure that Amazon hasn’t made it theirs.  No bait, just switch.

Where’s the FTC on this? Would you buy from a company that paid to advertise on someone else’s gift registry, without asking?  Are they a bit scummy?  These aren’t small-time companies; advertisers buying the ads include Kimberly-Clark and Johnson & Johnson.  To sell baby products!

Next thing, they’ll be posting billboards on your roof and on your car. Without so much as a by-your-leave.

Leave a comment

Filed under Accuracy, Compliance, Controls, Corporation, Culture, Data quality, Duty, Duty of Care, Governance, Information, Internal controls, Oversight, Ownership, Third parties, Value

Selling what isn’t yours

One profit model that seems to be working well is selling stuff that doesn’t belong to you.  Cuts your cost-of-goods-sold dramatically.

“Facebook Considered Charging for Access to User Data,” The Wall Street Journal, November 29, 2018 (online).  Facebook considered charging people to access user data.

Now, I guess that’s marginally different than letting third parties see the “Facebook” user data (i.e., the data of the users of Facebook) for free, in order to develop apps or whatever.  But isn’t it still the users’ information?  Oh, and it might be somewhat contrary to what the CEO said to Congress about Facebook’s policy of never selling user data.

Leave a comment

Filed under Access, Collect, Compliance, Controls, Corporation, Culture, Duty, Duty of Care, Governance, Information, Internal controls, Management, Oversight, Ownership, Ownership, Third parties, To report, Use, Value

Those pesky Romulans!

You may not be old enough or nerdy enough to remember the Romulan cloaking device from the original Star Trek.  But I do/am.

“Fake Signals and Illegal Flags: How North Korea Uses Clandestine Shipping to Fund Regime,” The Wall Street Journal, November 29, 2018 (online). How do shipments still arrive in and leave from North Korea, notwithstanding the various sanctions on the regime there?  Apparently, it’s blue smoke and mirrors.

I raise this here for two reasons.  First, in the North Korean story this is a bunch of information being generated that is deliberately false, and the compliance types struggle to deal with it in order to enforce the applicable rules.  The enforcers use satellites and data analytics; the shippers use deception and semi-legal and illegal stratagems.

Second, what extremes might your employees go to to avoid being detected when they are doing something they know is wrong, and how well prepared are you to deal with it?  Do you have the proper controls and investigative procedures?  What should you look at to confirm that what you’re being told is true?

 

Leave a comment

Filed under Collect, Compliance, Compliance, Compliance (General), Controls, Corporation, Data quality, Directors, Duty, Employees, Governance, Information, Internal controls, Management, Oversight, Policy, Supervision, Third parties, To report, Use

What you say is information, too

“Mueller Accuses Paul Manafort of Lying to FBI After Plea Agreement, The Wall Street Journal, November 26, 2018 (online).  Did Manafort lie after he reached a plea deal?

Information is not limited to what you write in a document or an email.  It includes verbal utterances.  How do you control your “verbal utterances” when the penalty for lying to the FBI can result in 20 years in prison, regardless of what happened prior to your plea deal?

So, this involves Information (verbal statements are information), Compliance (lying to the FBI exposes you to 20 years’ in prison for each offense), and Governance (how do you avoid making an untrue utterance?).  Do your policies and controls address verbal information, and, generally, not lying to the FBI?  Need they?

Leave a comment

Filed under Communications, Compliance (General), Content, Controls, Definition, Duty, Governance, Information, Internal controls, Legal

What happens when the boss gets jailed?

This blog tends to mention cases where senior executives get (or don’t get) punished for their alleged misdeeds.  The spin is often that the seniors don’t get punished as hard as the worker bees.

But what happens when the CEO gets put in jail for his or her alleged misdeeds, which may have led to under-reporting in the company’s financials for the past five years?

“Carlos Ghosn’s Arrest Rocks Auto Empire,” The Wall Street Journal, November 21, 2018 (online).  Nissan’s CEO jailed for allegedly under-reporting his earnings by several tens of millions of dollars.

How do you explain this to the worker bees?  What’s the culture at the top?  How did the Board not catch this?  Were there not controls in place?  Might the shareholders be a bit upset?

More a Governance and a Compliance issue, perhaps, although if one looks, one could find some information-related failures.

 

Leave a comment

Filed under Board, Compliance, Compliance (General), Compliance Verification, Controls, Corporation, Culture, Culture, Data quality, Directors, Duty, Duty of Care, Governance, Internal controls, Oversight, Oversight

Coming up to speed

Marriott Says Starwood Data Breach Affects Up to 500 Million People,” The Wall Street Journal, November 30, 2018 (online).  Data breach potentially affecting passports and credit cards of as many as 500 million guests at Marriott’s Starwood properties, which were acquired in 2016.  They knew about this in September, but reflects a breach that may go back to 2014.

So, two years after an acquisition, the target’s information security practices blow up in the acquiror’s face.  What does that say about the acquiror’s duty to integrate the data practices and controls around information protection?

Does your M&A team think about information governance issues?  Is that an identified risk, with an identified (and owned) action plan?  Did the Board identify this as a risk?  What the value of this information considered part of the transaction value?  How was that reflected?

Leave a comment

Filed under Board, Compliance, Compliance Verification, Controls, Corporation, Directors, Duty, Duty of Care, Governance, Information, Internal controls, IT, Management, Oversight, Protect, Protect assets, Protect information assets, Risk Assessment, Risk assessment, Security, Value